lumma | be5ef0d0c91f8a841bc6f588998994df25a91d5c626f20ec0f72bf2825d3947a

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 20:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Malware Code.ps1
Size

5KB
MD5

bc7784357ac3b5378743bd38c9950a73
SHA1

969545148c0f6f15ba7a00baa92a6466848c8e7a
SHA256

be5ef0d0c91f8a841bc6f588998994df25a91d5c626f20ec0f72bf2825d3947a
SHA512

10e1015444ee2da8552ef79f683147a9e1dc1eeb2a44d25933fcc444f0f575b7231f939232a1e2c8225986c710417b09995cebdaae18041d4bb2ac742b2bae3f
SSDEEP

96:uPaXFIUEQVxJXXcoG3wI1PaXFIUEQVxJXXcoG3wII:uPaXFfEGzMP3wI1PaXFfEGzMP3wII

Score

10^/10

lumma discovery execution persistence stealer

Malware Config

Extracted

Family

lumma

https://forbidstow.site/api

https://goalyfeastz.site/api

https://contemteny.site/api

https://dilemmadu.site/api

https://authorisev.site/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Executes dropped EXE 4 IoCs

Processes:

Setup.exenc.exeSetup.exenc.exe

pid process

1996 Setup.exe
2316 nc.exe
3508 Setup.exe
2332 nc.exe

pid	process
1996	Setup.exe
2316	nc.exe
3508	Setup.exe
2332	nc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\entry555	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\entry378 = "C:\\Users\\Admin\\AppData\\Roaming\\DATA8739\\Setup.exe"	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Setup.exeSetup.exe

description pid process target process

PID 1996 set thread context of 3132 1996 Setup.exe more.com
PID 3508 set thread context of 5032 3508 Setup.exe more.com
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

3552 powershell.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2964 3608 WerFault.exe OpenWith.exe
772 3608 WerFault.exe OpenWith.exe

description	pid	process	target process
PID 1996 set thread context of 3132	1996	Setup.exe	more.com
PID 3508 set thread context of 5032	3508	Setup.exe	more.com

pid	pid_target	process	target process
2964	3608	WerFault.exe	OpenWith.exe
772	3608	WerFault.exe	OpenWith.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Setup.exemore.comSetup.exemore.comOpenWith.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpenWith.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3484 WINWORD.EXE
3484 WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

powershell.exeSetup.exeSetup.exemore.commore.com

pid	process
3552	powershell.exe
3552	powershell.exe
1996	Setup.exe
1996	Setup.exe
1996	Setup.exe
3508	Setup.exe
3508	Setup.exe
3132	more.com
3132	more.com
5032	more.com
5032	more.com
5032	more.com
5032	more.com

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

Setup.exeSetup.exemore.commore.com

pid process

1996 Setup.exe
3508 Setup.exe
3132 more.com
5032 more.com
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3552 powershell.exe

pid	process
1996	Setup.exe
3508	Setup.exe
3132	more.com
5032	more.com

description	pid	process
Token: SeDebugPrivilege	3552	powershell.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

WINWORD.EXE

pid	process
3484	WINWORD.EXE
3484	WINWORD.EXE
3484	WINWORD.EXE
3484	WINWORD.EXE
3484	WINWORD.EXE
3484	WINWORD.EXE
3484	WINWORD.EXE
3484	WINWORD.EXE
3484	WINWORD.EXE
3484	WINWORD.EXE
3484	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

powershell.exeSetup.exeSetup.exemore.commore.com

description	pid	process	target process
PID 3552 wrote to memory of 1996	3552	powershell.exe	Setup.exe
PID 3552 wrote to memory of 1996	3552	powershell.exe	Setup.exe
PID 3552 wrote to memory of 1996	3552	powershell.exe	Setup.exe
PID 1996 wrote to memory of 2316	1996	Setup.exe	nc.exe
PID 1996 wrote to memory of 2316	1996	Setup.exe	nc.exe
PID 1996 wrote to memory of 3132	1996	Setup.exe	more.com
PID 1996 wrote to memory of 3132	1996	Setup.exe	more.com
PID 1996 wrote to memory of 3132	1996	Setup.exe	more.com
PID 1996 wrote to memory of 3132	1996	Setup.exe	more.com
PID 3552 wrote to memory of 3508	3552	powershell.exe	Setup.exe
PID 3552 wrote to memory of 3508	3552	powershell.exe	Setup.exe
PID 3552 wrote to memory of 3508	3552	powershell.exe	Setup.exe
PID 3508 wrote to memory of 2332	3508	Setup.exe	nc.exe
PID 3508 wrote to memory of 2332	3508	Setup.exe	nc.exe
PID 3508 wrote to memory of 5032	3508	Setup.exe	more.com
PID 3508 wrote to memory of 5032	3508	Setup.exe	more.com
PID 3508 wrote to memory of 5032	3508	Setup.exe	more.com
PID 3508 wrote to memory of 5032	3508	Setup.exe	more.com
PID 3132 wrote to memory of 3608	3132	more.com	OpenWith.exe
PID 3132 wrote to memory of 3608	3132	more.com	OpenWith.exe
PID 3132 wrote to memory of 3608	3132	more.com	OpenWith.exe
PID 3132 wrote to memory of 3608	3132	more.com	OpenWith.exe
PID 3132 wrote to memory of 3608	3132	more.com	OpenWith.exe
PID 5032 wrote to memory of 888	5032	more.com	OpenWith.exe
PID 5032 wrote to memory of 888	5032	more.com	OpenWith.exe
PID 5032 wrote to memory of 888	5032	more.com	OpenWith.exe
PID 5032 wrote to memory of 888	5032	more.com	OpenWith.exe
PID 5032 wrote to memory of 888	5032	more.com	OpenWith.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Malware Code.ps1"
1⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552

C:\Users\Admin\AppData\Roaming\DATA1053\Setup.exe
"C:\Users\Admin\AppData\Roaming\DATA1053\Setup.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Roaming\kfqyosirg\CKVQTDQVVRZMZDXL\nc.exe
C:\Users\Admin\AppData\Roaming\kfqyosirg\CKVQTDQVVRZMZDXL\nc.exe
3⤵
- Executes dropped EXE
PID:2316

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3132

C:\Windows\SysWOW64\OpenWith.exe
C:\Windows\SysWOW64\OpenWith.exe
4⤵
- System Location Discovery: System Language Discovery
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 1316
5⤵
- Program crash
PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 1340
5⤵
- Program crash
PID:772

C:\Users\Admin\AppData\Roaming\DATA8739\Setup.exe
"C:\Users\Admin\AppData\Roaming\DATA8739\Setup.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3508

C:\Users\Admin\AppData\Roaming\kfqyosirg\CKVQTDQVVRZMZDXL\nc.exe
C:\Users\Admin\AppData\Roaming\kfqyosirg\CKVQTDQVVRZMZDXL\nc.exe
3⤵
- Executes dropped EXE
PID:2332

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5032

C:\Windows\SysWOW64\OpenWith.exe
C:\Windows\SysWOW64\OpenWith.exe
4⤵
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3608 -ip 3608
1⤵
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3608 -ip 3608
1⤵
PID:1116

C:\Windows\system32\prevhost.exe
C:\Windows\system32\prevhost.exe {914FEED8-267A-4BAA-B8AA-21E233792679} -Embedding
1⤵
PID:3036

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
60e6d43578ba1d9fcb7bf86ab2dc87a6

SHA1
2e70d2413d99899b5a3624da7d5b63b7d54dcb4d

SHA256
b482ce0447202b463a67bd027d9608dcffcbcda0c75a8bebc8e25eaa12c28e9e

SHA512
75f865ee6075c4186de839041dfadac00de0ed5fc0e7600f958489146c6b8adf00244baa1884cc82fc326aac7ad7d485bc0e7786547110f8065b807ff1c24f1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\8fc3fe7a

Filesize
1.4MB

MD5
d94d579a4af0ed1f07f988bed8f33871

SHA1
0076e7427782ccbff03bd9af226d619c7863b836

SHA256
3f20727e86b75e6589d970df06aa44831ba0af819dcab048029b6ba931cfe14e

SHA512
322d040b4baeae5212295e096af5fd99e72011b68e8610c598ca6eea3dfc2c810fac5ff5e9dbfa3639664cf69ce05a79687b07aad0459e7f2ddd114892fd6759

Download Submit
C:\Users\Admin\AppData\Local\Temp\942778f7

Filesize
1.4MB

MD5
d4741b5c722f84d837ed46b748ce8e45

SHA1
d1941263207f1300ce48270c86c435049aa98413

SHA256
2cd0df9756b4ee0005a4eb801dc78cf0f3311ff1cc0f3fc493822d9edfe93213

SHA512
e8eb70d42ae6000ea5dfbf2aadceaedb355505051dccb2c457b801e4d7be189a29f34c32a7782f097fa46198bccb917c8a8cd4d2655688cc9af71fb9785db799

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDCA0C.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mv1lvd1f.sdw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\d8b25e79

Filesize
1.4MB

MD5
0d7908a6522185d12a08460c68205f59

SHA1
25a5af0c25262bfb3f879587aa42c7d52cb60db0

SHA256
ae0f8b49af3d1e0b331656dce1d3c72ff6df3709cda68563550af6f48ef5987d

SHA512
ba6b6a74134e4ad8e73d7029d5aae7d7e53ffcd0c3aa5722041619bac3dd05fbb98ae403207f14d67d042bfbd1c48d455cc7db904186e3e71aae3dc008ef8b11

Download Submit
C:\Users\Admin\AppData\Roaming\kfqyosirg\CKVQTDQVVRZMZDXL\nc.exe

Filesize
285KB

MD5
7fb44c5bca4226d8aab7398e836807a2

SHA1
47128e4f8afabfde5037ed0fcaba8752c528ff52

SHA256
a64ead73c06470bc5c84cfc231b0723d70d29fec7d385a268be2c590dc5eb1ef

SHA512
f0bd093f054c99bcc50df4005d0190bd7e3dcefea7008ae4c9b67a29e832e02ae9ff39fa75bc1352c127aeb13afdea9bfdcc238ac826ef17f288d6fbd2ec8cab

Download Submit
memory/888-159-0x0000000000980000-0x00000000009F8000-memory.dmp

Filesize
480KB

Download
memory/888-160-0x0000000000410000-0x000000000042C000-memory.dmp

Filesize
112KB

Download
memory/888-158-0x00007FFDAB790000-0x00007FFDAB985000-memory.dmp

Filesize
2.0MB

Download
memory/1996-46-0x0000000002B20000-0x0000000002C60000-memory.dmp

Filesize
1.2MB

Download
memory/1996-38-0x0000000002B20000-0x0000000002C60000-memory.dmp

Filesize
1.2MB

Download
memory/1996-77-0x0000000073680000-0x00000000737FB000-memory.dmp

Filesize
1.5MB

Download
memory/1996-59-0x0000000073693000-0x0000000073694000-memory.dmp

Filesize
4KB

Download
memory/1996-42-0x0000000002B20000-0x0000000002C60000-memory.dmp

Filesize
1.2MB

Download
memory/1996-45-0x0000000002B20000-0x0000000002C60000-memory.dmp

Filesize
1.2MB

Download
memory/1996-44-0x0000000002B20000-0x0000000002C60000-memory.dmp

Filesize
1.2MB

Download
memory/1996-40-0x0000000002B20000-0x0000000002C60000-memory.dmp

Filesize
1.2MB

Download
memory/1996-49-0x0000000000400000-0x0000000000D36000-memory.dmp

Filesize
9.2MB

Download
memory/1996-48-0x0000000002B20000-0x0000000002C60000-memory.dmp

Filesize
1.2MB

Download
memory/1996-39-0x0000000002B20000-0x0000000002C60000-memory.dmp

Filesize
1.2MB

Download
memory/1996-61-0x0000000073680000-0x00000000737FB000-memory.dmp

Filesize
1.5MB

Download
memory/1996-37-0x0000000002B20000-0x0000000002C60000-memory.dmp

Filesize
1.2MB

Download
memory/1996-36-0x0000000002B20000-0x0000000002C60000-memory.dmp

Filesize
1.2MB

Download
memory/1996-58-0x0000000073680000-0x00000000737FB000-memory.dmp

Filesize
1.5MB

Download
memory/1996-43-0x0000000002B20000-0x0000000002C60000-memory.dmp

Filesize
1.2MB

Download
memory/1996-35-0x0000000002B20000-0x0000000002C60000-memory.dmp

Filesize
1.2MB

Download
memory/1996-41-0x0000000002B20000-0x0000000002C60000-memory.dmp

Filesize
1.2MB

Download
memory/1996-56-0x00007FFDAB790000-0x00007FFDAB985000-memory.dmp

Filesize
2.0MB

Download
memory/1996-55-0x0000000073680000-0x00000000737FB000-memory.dmp

Filesize
1.5MB

Download
memory/2316-74-0x000002D5C7700000-0x000002D5C7701000-memory.dmp

Filesize
4KB

Download
memory/2332-138-0x000001CE9D800000-0x000001CE9D801000-memory.dmp

Filesize
4KB

Download
memory/3132-139-0x00007FFDAB790000-0x00007FFDAB985000-memory.dmp

Filesize
2.0MB

Download
memory/3132-146-0x0000000073680000-0x00000000737FB000-memory.dmp

Filesize
1.5MB

Download
memory/3508-102-0x00000000028F0000-0x0000000002A30000-memory.dmp

Filesize
1.2MB

Download
memory/3508-104-0x00000000028F0000-0x0000000002A30000-memory.dmp

Filesize
1.2MB

Download
memory/3508-140-0x0000000073680000-0x00000000737FB000-memory.dmp

Filesize
1.5MB

Download
memory/3508-120-0x00007FFDAB790000-0x00007FFDAB985000-memory.dmp

Filesize
2.0MB

Download
memory/3508-123-0x0000000073680000-0x00000000737FB000-memory.dmp

Filesize
1.5MB

Download
memory/3508-119-0x0000000073680000-0x00000000737FB000-memory.dmp

Filesize
1.5MB

Download
memory/3508-100-0x00000000028F0000-0x0000000002A30000-memory.dmp

Filesize
1.2MB

Download
memory/3508-112-0x0000000000400000-0x0000000000D36000-memory.dmp

Filesize
9.2MB

Download
memory/3508-105-0x00000000028F0000-0x0000000002A30000-memory.dmp

Filesize
1.2MB

Download
memory/3508-108-0x00000000028F0000-0x0000000002A30000-memory.dmp

Filesize
1.2MB

Download
memory/3508-107-0x00000000028F0000-0x0000000002A30000-memory.dmp

Filesize
1.2MB

Download
memory/3508-103-0x00000000028F0000-0x0000000002A30000-memory.dmp

Filesize
1.2MB

Download
memory/3508-101-0x00000000028F0000-0x0000000002A30000-memory.dmp

Filesize
1.2MB

Download
memory/3508-99-0x00000000028F0000-0x0000000002A30000-memory.dmp

Filesize
1.2MB

Download
memory/3508-98-0x00000000028F0000-0x0000000002A30000-memory.dmp

Filesize
1.2MB

Download
memory/3508-111-0x00000000028F0000-0x0000000002A30000-memory.dmp

Filesize
1.2MB

Download
memory/3508-109-0x00000000028F0000-0x0000000002A30000-memory.dmp

Filesize
1.2MB

Download
memory/3508-106-0x00000000028F0000-0x0000000002A30000-memory.dmp

Filesize
1.2MB

Download
memory/3552-15-0x00007FFD8D673000-0x00007FFD8D675000-memory.dmp

Filesize
8KB

Download
memory/3552-19-0x000002143F920000-0x000002143F932000-memory.dmp

Filesize
72KB

Download
memory/3552-113-0x00007FFD8D670000-0x00007FFD8E131000-memory.dmp

Filesize
10.8MB

Download
memory/3552-10-0x000002143D230000-0x000002143D252000-memory.dmp

Filesize
136KB

Download
memory/3552-14-0x000002143D2F0000-0x000002143D304000-memory.dmp

Filesize
80KB

Download
memory/3552-18-0x00007FFD8D670000-0x00007FFD8E131000-memory.dmp

Filesize
10.8MB

Download
memory/3552-17-0x000002143F3A0000-0x000002143F5BC000-memory.dmp

Filesize
2.1MB

Download
memory/3552-76-0x00007FFD8D670000-0x00007FFD8E131000-memory.dmp

Filesize
10.8MB

Download
memory/3552-16-0x00007FFD8D670000-0x00007FFD8E131000-memory.dmp

Filesize
10.8MB

Download
memory/3552-75-0x00007FFD8D670000-0x00007FFD8E131000-memory.dmp

Filesize
10.8MB

Download
memory/3552-0-0x00007FFD8D673000-0x00007FFD8D675000-memory.dmp

Filesize
8KB

Download
memory/3552-21-0x00007FFD8D670000-0x00007FFD8E131000-memory.dmp

Filesize
10.8MB

Download
memory/3552-20-0x000002143D310000-0x000002143D31A000-memory.dmp

Filesize
40KB

Download
memory/3552-11-0x00007FFD8D670000-0x00007FFD8E131000-memory.dmp

Filesize
10.8MB

Download
memory/3552-12-0x00007FFD8D670000-0x00007FFD8E131000-memory.dmp

Filesize
10.8MB

Download
memory/3552-13-0x000002143D260000-0x000002143D286000-memory.dmp

Filesize
152KB

Download
memory/3608-152-0x0000000000140000-0x00000000001B8000-memory.dmp

Filesize
480KB

Download
memory/3608-153-0x0000000000410000-0x000000000042C000-memory.dmp

Filesize
112KB

Download
memory/3608-151-0x00007FFDAB790000-0x00007FFDAB985000-memory.dmp

Filesize
2.0MB

Download
memory/3608-163-0x0000000000140000-0x00000000001B8000-memory.dmp

Filesize
480KB

Download
memory/5032-147-0x00007FFDAB790000-0x00007FFDAB985000-memory.dmp

Filesize
2.0MB

Download