lumma | 925d25b27a4a6cdfb2616b3cb64e258aaa63d7e8b19517a437cb5b5a2efd247a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 3.7MB
Sample240716-v9zz7starp
SHA256 925d25b27a4a6cdfb2616b3cb64e258aaa63d7e8b19517a437cb5b5a2efd247a
MD5 82a3c776eae4f6a5d3a81700234805c4
SHA1 585e8db74b2fe63afd8ef04f41558bbf9cdc9f66
SHA512 74aed6d5a071fc6e60fc43a5cca250b12db0079ba09a0d8b20abadd2e6cedf20e873bb2f84867938b3667cb343386b6a96e650dc2d44c38b0a7fb0284dc9295b
SSDEEP 49152:VRlBV3w2x9noVV6kWZdkRP5568RxM91Qu110cEn+dNtDX2D3GUlFtk:5BV3At06fu11Nny6sK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealc vidar discovery spyware stealer

Malware Config

Extracted

Family

vidar

https://steamcommunity.com/profiles/76561199735694209
https://t.me/puffclou

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1

Extracted

Family

lumma

https://contemplateodszsv.shop/api

Signatures

Detect Vidar Stealer 8 IoCs

stealer

resource	yara_rule
behavioral2/memory/2420-68-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/2420-66-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/2420-72-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/2420-79-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/2892-159-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/2420-160-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/2420-175-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/2892-212-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
4216	JEGDGIIJJE.exe
1332	JKEHIIJJEC.exe

Loads dropped DLL 2 IoCs

pid	Process
2420	MSBuild.exe
2420	MSBuild.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4636 set thread context of 2420	4636	file.exe	87
PID 4216 set thread context of 2892	4216	JEGDGIIJJE.exe	93
PID 1332 set thread context of 1448	1332	JKEHIIJJEC.exe	95

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1208	1448	WerFault.exe	95
624	1448	WerFault.exe	95

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1740	timeout.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4636	file.exe
4636	file.exe
2420	MSBuild.exe
2420	MSBuild.exe
2420	MSBuild.exe
2420	MSBuild.exe
2420	MSBuild.exe
2420	MSBuild.exe
2420	MSBuild.exe
2420	MSBuild.exe
2892	RegAsm.exe
2892	RegAsm.exe
2892	RegAsm.exe
2892	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4636	file.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 8	4636	file.exe	86
PID 4636 wrote to memory of 8	4636	file.exe	86
PID 4636 wrote to memory of 8	4636	file.exe	86
PID 4636 wrote to memory of 2420	4636	file.exe	87
PID 4636 wrote to memory of 2420	4636	file.exe	87
PID 4636 wrote to memory of 2420	4636	file.exe	87
PID 4636 wrote to memory of 2420	4636	file.exe	87
PID 4636 wrote to memory of 2420	4636	file.exe	87
PID 4636 wrote to memory of 2420	4636	file.exe	87
PID 4636 wrote to memory of 2420	4636	file.exe	87
PID 4636 wrote to memory of 2420	4636	file.exe	87
PID 4636 wrote to memory of 2420	4636	file.exe	87
PID 2420 wrote to memory of 4216	2420	MSBuild.exe	89
PID 2420 wrote to memory of 4216	2420	MSBuild.exe	89
PID 2420 wrote to memory of 4216	2420	MSBuild.exe	89
PID 4216 wrote to memory of 3496	4216	JEGDGIIJJE.exe	91
PID 4216 wrote to memory of 3496	4216	JEGDGIIJJE.exe	91
PID 4216 wrote to memory of 3496	4216	JEGDGIIJJE.exe	91
PID 4216 wrote to memory of 1428	4216	JEGDGIIJJE.exe	92
PID 4216 wrote to memory of 1428	4216	JEGDGIIJJE.exe	92
PID 4216 wrote to memory of 1428	4216	JEGDGIIJJE.exe	92
PID 4216 wrote to memory of 2892	4216	JEGDGIIJJE.exe	93
PID 4216 wrote to memory of 2892	4216	JEGDGIIJJE.exe	93
PID 4216 wrote to memory of 2892	4216	JEGDGIIJJE.exe	93
PID 4216 wrote to memory of 2892	4216	JEGDGIIJJE.exe	93
PID 4216 wrote to memory of 2892	4216	JEGDGIIJJE.exe	93
PID 4216 wrote to memory of 2892	4216	JEGDGIIJJE.exe	93
PID 4216 wrote to memory of 2892	4216	JEGDGIIJJE.exe	93
PID 4216 wrote to memory of 2892	4216	JEGDGIIJJE.exe	93
PID 4216 wrote to memory of 2892	4216	JEGDGIIJJE.exe	93
PID 2420 wrote to memory of 1332	2420	MSBuild.exe	94
PID 2420 wrote to memory of 1332	2420	MSBuild.exe	94
PID 2420 wrote to memory of 1332	2420	MSBuild.exe	94
PID 1332 wrote to memory of 1448	1332	JKEHIIJJEC.exe	95
PID 1332 wrote to memory of 1448	1332	JKEHIIJJEC.exe	95
PID 1332 wrote to memory of 1448	1332	JKEHIIJJEC.exe	95
PID 1332 wrote to memory of 1448	1332	JKEHIIJJEC.exe	95
PID 1332 wrote to memory of 1448	1332	JKEHIIJJEC.exe	95
PID 1332 wrote to memory of 1448	1332	JKEHIIJJEC.exe	95
PID 1332 wrote to memory of 1448	1332	JKEHIIJJEC.exe	95
PID 1332 wrote to memory of 1448	1332	JKEHIIJJEC.exe	95
PID 1332 wrote to memory of 1448	1332	JKEHIIJJEC.exe	95
PID 2420 wrote to memory of 3468	2420	MSBuild.exe	101
PID 2420 wrote to memory of 3468	2420	MSBuild.exe	101
PID 2420 wrote to memory of 3468	2420	MSBuild.exe	101
PID 3468 wrote to memory of 1740	3468	cmd.exe	103
PID 3468 wrote to memory of 1740	3468	cmd.exe	103
PID 3468 wrote to memory of 1740	3468	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:8
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\ProgramData\JEGDGIIJJE.exe
    "C:\ProgramData\JEGDGIIJJE.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:3496
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:1428
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:2892
- - C:\ProgramData\JKEHIIJJEC.exe
    "C:\ProgramData\JKEHIIJJEC.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1332
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:1448
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 1200
        5⤵
        Program crash
        
        PID:1208
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 1244
        5⤵
        Program crash
        
        PID:624
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IDAEBGCAAECA" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      Delays execution with timeout.exe
      PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1448 -ip 1448
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1448 -ip 1448
1⤵
PID:1240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AFHDAE

Path C:\ProgramData\EBAFBGIDHCBF\AFHDAE
Size 124KB
SHA256 a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
MD5 9618e15b04a4ddb39ed6c496575f6f95
SHA1 1c28f8750e5555776b3c80b187c5d15a443a7412
SHA512 f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
SSDEEP 96:hBWU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:hBl+bDo3irhnyTpvVj3XBBE3u
MD5 SHA1 SHA512 SSDEEP

Submit Download

AFHDAE

Path C:\ProgramData\EBAFBGIDHCBF\AFHDAE
Size 160KB
SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
MD5 f310cf1ff562ae14449e0167a3e1fe46
SHA1 85c58afa9049467031c6c2b17f5c12ca73bb2788
SHA512 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad
SSDEEP 96:bBY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:bBY/tH+bF+UI3iWGVYWNkqp3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AFHDAE

Path C:\ProgramData\EBAFBGIDHCBF\AFHDAE
Size 114KB
SHA256 4396c42beb6ecd2c21773c212379dfa63b7a1361bf24e32c5271659609dcd5ef
MD5 351297ffc92bb38623e9931ff5006c45
SHA1 19206cab50217b6f5926832148000b5bfaba48c6
SHA512 03b950a9a2f4b107163d6847149c5ff2d82f481e92df449f67acbde84cbbdec19a590d2d596cda64a1e3f306334dade38613d55dade5b066137cfd47fcebe116
SSDEEP 192:KZPM23W/l1jXhPE4nP+hoIky6ctqLVumf:I02m/lxhlnmhouHEVumf
MD5 SHA1 SHA512 SSDEEP

Submit Download

JEGDGIIJJE.exe

Path C:\ProgramData\JEGDGIIJJE.exe
Size 431KB
SHA256 f3f2ee666e572cea6eb5bcfd31fbfbc3b0edc9f99db528bb0a640751fb223033
MD5 51c75077bca69383b83b1c94c2406e05
SHA1 efc8d7ef37661dadc02171817ff344c84790683f
SHA512 607455d7fc1bb272c03f24205fdbb401ef3b7b09d192b2cb62e9ec271fd44bc5bc83ae8b620446ded5f9998aee3a47d9966ee5b84bb9f5ac7b11648f119b664f
SSDEEP 6144:LwcfOnB0WvTtMMR0Q+uGQ8n97bfrd1NFqGOGOwqGz5n3eU7FhdSs4ztWTH8S8EO:CnTvT729zd3RObwqGz5n3VFLqS8EO
MD5 SHA1 SHA512 SSDEEP

Submit Download

JKEHIIJJEC.exe

Path C:\ProgramData\JKEHIIJJEC.exe
Size 518KB
SHA256 1850a11acaede15b70cf7fc93830cd13ed4855f5e6226ef8110427fab9651ddf
MD5 64ae8807b8359c84c00444c2cbab6236
SHA1 db15781e8050dd032b0bd67315283089aef9dd3d
SHA512 6e598e9d74d1df6097e0594f0b2f6d06ee07eda98ba91eb9f12500c50bf6d5edc2b4d35165b67b31b627ca10504aee8d7cb1755d7d8b227229c93ee444e2787f
SSDEEP 6144:K/YU8Hd8WCoWM5qcOotxvqzdCODY1eIQfHc5/mcYpTH5vQATH+2+dU739nNjp2M7:7HvComlwToHcfoTZ9Te2Lnb2MDaMScEO
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
Size 471B
SHA256 6ebcc90e232c217e7a24c9961f7bcfca68ebd23ef4ea183bc5ff77d7a8580421
MD5 8be04440368e49a22e5b061ba2b41b3b
SHA1 6f43b106dae8c0e85a21fc1b0932952e41470cc5
SHA512 bf826de5b1dcfed25269fdc76acf4a95985b88e2ae6499c04ac1fea965d54589a972e8f75d8a495a7b3e64b4d30f86075a3b11b6ef813514ebd57e4c908f5304
MD5 SHA1 SHA512

Submit Download

EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
Size 400B
SHA256 80a066013ba9a66ee8ca96e6988bd6d8130e78e2a9c693c33983331b046ee15f
MD5 78522c164f5787ef6a66a482e02de5c5
SHA1 d3db5be2783dfdabc479dfca83c395eba2384392
SHA512 364f89122aae03f1bfce590c3d06fa630ebb7f2c3f19fc9172af860bdf9ca9609c59b636fa216a49042b554dca9b19a67d411f6f6a912c491aa454a429e89689
MD5 SHA1 SHA512

Submit Download

76561199735694209[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QOWVUGSW\76561199735694209[1].htm
Size 34KB
SHA256 8baba289c883fb78206760d8438c3e515305c96ef7f81e281e355493e5ce8c71
MD5 5f21cbd23314aab2dbabbdac13a2f088
SHA1 927e890b9239718236f51512c8ad1fda0ea021e5
SHA512 066fd016aa3fc39fc76a7f510746707fc8b825ae5c49b52f2af2d3b44214fd889e3e11c7b77e2b94873ead24e9674787e4b6e7092ce6b7bc8d73898c75c53783
SSDEEP 768:wdpqm+0Ih3tAA9CWGXOfcDAWPzzgiJmDzJtxLHfJkPVoEAdmPzzgiJmDzJtxLF26:wd8m+0Ih3tAA9CWGXOFWPzzgiJmDzJtF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2420-175-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2420-66-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2420-160-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2420-68-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2420-72-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2420-79-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2892-159-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2892-212-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/4636-59-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-11-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-47-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-45-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-43-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-41-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-39-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-37-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-35-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-33-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-31-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-29-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-27-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-25-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-23-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-19-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-17-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-15-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-13-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-49-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-9-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-6-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-71-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Download

memory/4636-51-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-53-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-55-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-57-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-0-0x00000000746FE000-0x00000000746FF000-memory.dmp

Download

memory/4636-61-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-158-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Download

memory/4636-63-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-70-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Download

memory/4636-65-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-21-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-7-0x00000000029B0000-0x00000000029C5000-memory.dmp

Download

memory/4636-5-0x00000000029B0000-0x00000000029CC000-memory.dmp

Download

memory/4636-4-0x00000000051B0000-0x00000000052C4000-memory.dmp

Download

memory/4636-3-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Download

memory/4636-2-0x00000000050F0000-0x000000000518C000-memory.dmp

Download

memory/4636-1-0x00000000002F0000-0x00000000006A0000-memory.dmp

Download