lumma | 29b828a2d4a02f4c3508e27714ceccea4e2d117dc0466671d334a6debd7a077b

Analysis

max time kernel
28s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
29b828a2d4a02f4c3508e27714ceccea4e2d117dc0466671d334a6debd7a077b.exe
Size 5.3MB
Sample240722-c8qq2avfpd
SHA256 29b828a2d4a02f4c3508e27714ceccea4e2d117dc0466671d334a6debd7a077b
MD5 f109fd54fa6c14302beff44d666a6ade
SHA1 912ad7378e837b82524c7d41e9792242bc5feacc
SHA512 38fb7b93975931cdedbd360672ac51a75de4a59883419ee46b4e739ebf1f13dfa9703062c4bba2df7cd717a5b089e364f33eb42b9fd2a703aac78da6eeeef69c
SSDEEP 49152:7ccw6QFnEEabMHciiW/LhKq3FWhR3PIa1p0seWJb9sMS0Z0fCnZ0qstZNweCRmeF:7PIKEabM87W/KIatvBaqstZsRmqEQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma vidar b607a7a47e1a6ff266af835d50c6eaa5 spyware stealer

Malware Config

Extracted

Family

vidar

Version

10.5

Botnet

b607a7a47e1a6ff266af835d50c6eaa5

https://t.me/s41l0
https://steamcommunity.com/profiles/76561199743486170

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.0 Safari/537.36

Extracted

Family

lumma

https://applyzxcksdia.shop/api

Signatures

Detect Vidar Stealer 6 IoCs

stealer

resource	yara_rule
behavioral2/memory/2980-71-0x0000000000400000-0x0000000000640000-memory.dmp	family_vidar_v7
behavioral2/memory/2980-68-0x0000000000400000-0x0000000000640000-memory.dmp	family_vidar_v7
behavioral2/memory/2980-66-0x0000000000400000-0x0000000000640000-memory.dmp	family_vidar_v7
behavioral2/memory/2980-84-0x0000000000400000-0x0000000000640000-memory.dmp	family_vidar_v7
behavioral2/memory/2980-215-0x0000000000400000-0x0000000000640000-memory.dmp	family_vidar_v7
behavioral2/memory/2980-293-0x0000000000400000-0x0000000000640000-memory.dmp	family_vidar_v7

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1536	CAFBGHIDBG.exe
4224	JKECGHCFIJ.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4680 set thread context of 2980	4680	29b828a2d4a02f4c3508e27714ceccea4e2d117dc0466671d334a6debd7a077b.exe	87
PID 1536 set thread context of 3276	1536	CAFBGHIDBG.exe	97
PID 4224 set thread context of 1604	4224	JKECGHCFIJ.exe	104

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2940	3276	WerFault.exe	97
2544	3276	WerFault.exe	97

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4688	timeout.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2980	MSBuild.exe
2980	MSBuild.exe
2980	MSBuild.exe
2980	MSBuild.exe
2980	MSBuild.exe
2980	MSBuild.exe
2980	MSBuild.exe
2980	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	29b828a2d4a02f4c3508e27714ceccea4e2d117dc0466671d334a6debd7a077b.exe
Token: SeDebugPrivilege	1536	CAFBGHIDBG.exe
Token: SeDebugPrivilege	4224	JKECGHCFIJ.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 2980	4680	29b828a2d4a02f4c3508e27714ceccea4e2d117dc0466671d334a6debd7a077b.exe	87
PID 4680 wrote to memory of 2980	4680	29b828a2d4a02f4c3508e27714ceccea4e2d117dc0466671d334a6debd7a077b.exe	87
PID 4680 wrote to memory of 2980	4680	29b828a2d4a02f4c3508e27714ceccea4e2d117dc0466671d334a6debd7a077b.exe	87
PID 4680 wrote to memory of 2980	4680	29b828a2d4a02f4c3508e27714ceccea4e2d117dc0466671d334a6debd7a077b.exe	87
PID 4680 wrote to memory of 2980	4680	29b828a2d4a02f4c3508e27714ceccea4e2d117dc0466671d334a6debd7a077b.exe	87
PID 4680 wrote to memory of 2980	4680	29b828a2d4a02f4c3508e27714ceccea4e2d117dc0466671d334a6debd7a077b.exe	87
PID 4680 wrote to memory of 2980	4680	29b828a2d4a02f4c3508e27714ceccea4e2d117dc0466671d334a6debd7a077b.exe	87
PID 4680 wrote to memory of 2980	4680	29b828a2d4a02f4c3508e27714ceccea4e2d117dc0466671d334a6debd7a077b.exe	87
PID 4680 wrote to memory of 2980	4680	29b828a2d4a02f4c3508e27714ceccea4e2d117dc0466671d334a6debd7a077b.exe	87
PID 4680 wrote to memory of 2980	4680	29b828a2d4a02f4c3508e27714ceccea4e2d117dc0466671d334a6debd7a077b.exe	87
PID 2980 wrote to memory of 1536	2980	MSBuild.exe	95
PID 2980 wrote to memory of 1536	2980	MSBuild.exe	95
PID 2980 wrote to memory of 1536	2980	MSBuild.exe	95
PID 1536 wrote to memory of 3276	1536	CAFBGHIDBG.exe	97
PID 1536 wrote to memory of 3276	1536	CAFBGHIDBG.exe	97
PID 1536 wrote to memory of 3276	1536	CAFBGHIDBG.exe	97
PID 1536 wrote to memory of 3276	1536	CAFBGHIDBG.exe	97
PID 1536 wrote to memory of 3276	1536	CAFBGHIDBG.exe	97
PID 1536 wrote to memory of 3276	1536	CAFBGHIDBG.exe	97
PID 1536 wrote to memory of 3276	1536	CAFBGHIDBG.exe	97
PID 1536 wrote to memory of 3276	1536	CAFBGHIDBG.exe	97
PID 1536 wrote to memory of 3276	1536	CAFBGHIDBG.exe	97
PID 2980 wrote to memory of 4224	2980	MSBuild.exe	103
PID 2980 wrote to memory of 4224	2980	MSBuild.exe	103
PID 2980 wrote to memory of 4224	2980	MSBuild.exe	103
PID 4224 wrote to memory of 1604	4224	JKECGHCFIJ.exe	104
PID 4224 wrote to memory of 1604	4224	JKECGHCFIJ.exe	104
PID 4224 wrote to memory of 1604	4224	JKECGHCFIJ.exe	104
PID 4224 wrote to memory of 1604	4224	JKECGHCFIJ.exe	104
PID 4224 wrote to memory of 1604	4224	JKECGHCFIJ.exe	104
PID 4224 wrote to memory of 1604	4224	JKECGHCFIJ.exe	104
PID 4224 wrote to memory of 1604	4224	JKECGHCFIJ.exe	104
PID 4224 wrote to memory of 1604	4224	JKECGHCFIJ.exe	104
PID 4224 wrote to memory of 1604	4224	JKECGHCFIJ.exe	104
PID 4224 wrote to memory of 1604	4224	JKECGHCFIJ.exe	104

C:\Users\Admin\AppData\Local\Temp\29b828a2d4a02f4c3508e27714ceccea4e2d117dc0466671d334a6debd7a077b.exe
"C:\Users\Admin\AppData\Local\Temp\29b828a2d4a02f4c3508e27714ceccea4e2d117dc0466671d334a6debd7a077b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\ProgramData\CAFBGHIDBG.exe
    "C:\ProgramData\CAFBGHIDBG.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:3276
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 1084
        5⤵
        Program crash
        
        PID:2940
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 1068
        5⤵
        Program crash
        
        PID:2544
- - C:\ProgramData\JKECGHCFIJ.exe
    "C:\ProgramData\JKECGHCFIJ.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1604
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FIDHIEBAAKJD" & exit
    3⤵
    PID:364
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      Delays execution with timeout.exe
      PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3276 -ip 3276
1⤵
PID:380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3276 -ip 3276
1⤵
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CAFBGHIDBG.exe

Path C:\ProgramData\CAFBGHIDBG.exe
Size 4.3MB
SHA256 394f23df8704f763b90149b09c73a1a841e8590541d33b98a6c7412ff9bfa27c
MD5 2b40a46d4856cb9f79ecdd2d19ad74e7
SHA1 1dc70b5aecf5e570e06dcabbc94a795df1f1549f
SHA512 6176850bb3ab1b7bb00c63b1ae4d8e5277dbb41dc4d8f8d3116bdf79c1aaeb111576911b32901745af63225faf4af07786949d7d761208475c555be1efa84654
SSDEEP 98304:T2FXYeOYP4WTVvaeXhxsnfFV7J2Y1SHHptV+PRLYO:T2FIexgWTUKanfLYY4H1+PCO
MD5 SHA1 SHA512 SSDEEP

Submit Download

BGIIEG

Path C:\ProgramData\GIEBFHCAKFBG\BGIIEG
Size 160KB
SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
MD5 f310cf1ff562ae14449e0167a3e1fe46
SHA1 85c58afa9049467031c6c2b17f5c12ca73bb2788
SHA512 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad
SSDEEP 96:bBY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:bBY/tH+bF+UI3iWGVYWNkqp3
MD5 SHA1 SHA512 SSDEEP

Submit Download

JKECGHCFIJ.exe

Path C:\ProgramData\JKECGHCFIJ.exe
Size 4.3MB
SHA256 c23b4a05be1b5587fe7d4283c7a99e44b695f486db8f225f5eabf9d7df75f37a
MD5 7f81200d5a684a89dda672e85490ea30
SHA1 47702e5faa3b1c749e33a94f2bf9236657225c64
SHA512 f792d4d052a6e4564b245b0144750993a90a7632271af4a5513509f7a53e91f2da1e65e20c1ffeb3dc1d2695d9fe7c108811e009fbfbc34c452737af12cfb5f5
SSDEEP 98304:Myyl+72vEOx/CsyiK8o60copXFp2ijhM:MyyluMxCs68J0c2n2U
MD5 SHA1 SHA512 SSDEEP

Submit Download

156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE
Size 2KB
SHA256 0029978501db8aa686b72d133ab1d6aaf5a469d06992784af3169b84b649fbcc
MD5 93a253e6924b2b7900735c3057c1dfef
SHA1 a2e67fba9fb61ce7b2a80bf3cf2c1cc3b6a9d42d
SHA512 c11db44983397f9a1792f82e48f2971a5f604b9a3ab07c8b3ea8eca99a715d24a88da8064b24ddd020e08df5682eed1966348b68797095f03864d15633a1202f
MD5 SHA1 SHA512

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 626ce3b93cece1434908a1b57ebd56b1eee36b1098f1acb9bd75b9a9585d2ccc
MD5 9b5702f9c6e8796a17de118a87828b2e
SHA1 c5b29a2f7d598e90ccc8421f25bbf1fee7d9002c
SHA512 da6b22a478779a01fdf05029f1b2342fb3b79531ec069d960dd286b86b60c8224d158462255f3325703c43cedac6550801ae9d259e5325d85247288d9c4e7d5e
MD5 SHA1 SHA512

Submit Download

EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Size 1KB
SHA256 53204ab5e7b4eefed7fc11b9a6cb9b989e106b6584414067f9388f4a789c8810
MD5 2cb6edaf496981893540f97a25fdc9f3
SHA1 4fb7579120ce50aee48d4b61e3d42a8432293c1d
SHA512 2453a189c6f2191965fa3f152ce733ff2fbb4ff2ab2d9c5e0050428ca0eaf2067ea6610052ab8ac770578377c2ef5d28a9fffa9e1924c568c9bf67567ef8ebdd
MD5 SHA1 SHA512

Submit Download

156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE
Size 458B
SHA256 358ab33a0e4e67e68f200f4390f18042391e78001a26585f718e5b7f773431fb
MD5 f6e1c38c32847a55a64ce7df53c406f6
SHA1 7f0e32858d264d1ce4c4227e73eebd140ff1fb6f
SHA512 69452f3bb53709a7e67c7e7aea019a80998b31e066af174776a3adb4a5b009f9f4615994a2172eec48df7baeec2d4a975633a35f3e9c93d1803637ea003e0b18
MD5 SHA1 SHA512

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 9837cf8d0566d71561a9e2070c7a19c3ad37cadcf94b5b7abf64c78ebc901063
MD5 c9f92c8595aeb41359eaea7dca12795c
SHA1 5e9ed74769296490a52ddbe773981c67ab42f377
SHA512 6d68ee02d520f3da3b90c5dc20bf3ec1fb325b753309eaca3c6ffb2ac36ae5236457fc4dbf9aa5c2622921652a53e5cea5d1f8e0c5ff33a2f2db30b151884e9e
MD5 SHA1 SHA512

Submit Download

EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Size 458B
SHA256 91018fbc856306183cbc5f57687e226af6c15e27d4fefacdd13123d9fa8276e7
MD5 28234a3130bb03b87055986957b805dc
SHA1 f5eecbc7393fab5b627368c0b22d70fbcac38e78
SHA512 825b40aee26df6a3e4c5c71ea4dd20cabf9dd3f34d3a184afad67a88c8269ff413db689f39e3ce189e8b4ac1ea8bd9183ebbeb1c94c3d7d31caf5da2ac9470f9
MD5 SHA1 SHA512

Submit Download

memory/1536-147-0x0000000005CB0000-0x0000000005DE4000-memory.dmp

Download

memory/1536-143-0x000000007340E000-0x000000007340F000-memory.dmp

Download

memory/1536-144-0x0000000000D30000-0x000000000117C000-memory.dmp

Download

memory/1536-145-0x0000000073400000-0x0000000073BB0000-memory.dmp

Download

memory/1536-146-0x0000000005B60000-0x0000000005CA8000-memory.dmp

Download

memory/1536-211-0x0000000073400000-0x0000000073BB0000-memory.dmp

Download

memory/2980-215-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/2980-293-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/2980-71-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/2980-84-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/2980-66-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/2980-68-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/4224-225-0x0000000000C90000-0x00000000010F0000-memory.dmp

Download

memory/4224-226-0x0000000005A30000-0x0000000005B5E000-memory.dmp

Download

memory/4224-227-0x0000000005B70000-0x0000000005C8A000-memory.dmp

Download

memory/4680-50-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-37-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-25-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-23-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-21-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-19-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-17-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-15-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-13-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-11-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-9-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-7-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-6-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-69-0x0000000074450000-0x0000000074C00000-memory.dmp

Download

memory/4680-29-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-31-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-33-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-72-0x0000000074450000-0x0000000074C00000-memory.dmp

Download

memory/4680-35-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-27-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-39-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-41-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-45-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-47-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-0-0x000000007445E000-0x000000007445F000-memory.dmp

Download

memory/4680-51-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-54-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-55-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-57-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-59-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-62-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-63-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-65-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-43-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/4680-5-0x0000000005C10000-0x0000000005C2C000-memory.dmp

Download

memory/4680-4-0x0000000005FB0000-0x000000000613A000-memory.dmp

Download

memory/4680-3-0x0000000074450000-0x0000000074C00000-memory.dmp

Download

memory/4680-2-0x0000000005D10000-0x0000000005DAC000-memory.dmp

Download

memory/4680-1-0x0000000000CF0000-0x000000000123C000-memory.dmp

Download