Resubmissions

03/01/2025, 21:12 UTC

250103-z2cl6atlfy 10

03/01/2025, 20:40 UTC

250103-zgabassmaw 10

03/01/2025, 20:37 UTC

250103-zelljsvndk 10

03/01/2025, 19:29 UTC

250103-x7cg8sslen 10

Analysis

  • max time kernel
    57s
  • max time network
    59s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/01/2025, 20:37 UTC

General

  • Target

    14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe

  • Size

    1.1MB

  • MD5

    79972f296cb418a20b17d2440850d790

  • SHA1

    3a096f7084a15176a30bb69126468059846c30ed

  • SHA256

    14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0

  • SHA512

    9d0632eeb7c6907b70fe2dce984b20b0e83c1c4c9b0a2cc17c01f7b2be53171c5beb5c9fb5994ba51ebd2e83d3d8579e732535097b85681a3305914c3d89d38e

  • SSDEEP

    24576:Rz/BfKdNZHQMtptCohxX+8Fn90yIJKQ0lTF0D3+kyOdsa1:hZE/HQM4ohxXz95IJKlJ0ypOdR

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3228
      • C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        "C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1336
      • C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        "C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2964
      • C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        "C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:444
      • C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        "C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:7304
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3048

      Network

      • flag-us
        DNS
        imbibelubmbe.click
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        Remote address:
        8.8.8.8:53
        Request
        imbibelubmbe.click
        IN A
        Response
        imbibelubmbe.click
        IN A
        172.67.165.144
        imbibelubmbe.click
        IN A
        104.21.42.198
      • flag-us
        DNS
        nearycrepso.shop
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        Remote address:
        8.8.8.8:53
        Request
        nearycrepso.shop
        IN A
        Response
      • flag-us
        DNS
        abruptyopsn.shop
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        Remote address:
        8.8.8.8:53
        Request
        abruptyopsn.shop
        IN A
        Response
        abruptyopsn.shop
        IN A
        104.21.64.1
        abruptyopsn.shop
        IN A
        104.21.48.1
        abruptyopsn.shop
        IN A
        104.21.96.1
        abruptyopsn.shop
        IN A
        104.21.80.1
        abruptyopsn.shop
        IN A
        104.21.32.1
        abruptyopsn.shop
        IN A
        104.21.112.1
        abruptyopsn.shop
        IN A
        104.21.16.1
      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        wholersorie.shop
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        Remote address:
        8.8.8.8:53
        Request
        wholersorie.shop
        IN A
        Response
        wholersorie.shop
        IN A
        172.67.160.114
        wholersorie.shop
        IN A
        104.21.41.51
      • flag-us
        DNS
        tirepublicerj.shop
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        Remote address:
        8.8.8.8:53
        Request
        tirepublicerj.shop
        IN A
        Response
        tirepublicerj.shop
        IN A
        104.21.64.1
        tirepublicerj.shop
        IN A
        104.21.80.1
        tirepublicerj.shop
        IN A
        104.21.112.1
        tirepublicerj.shop
        IN A
        104.21.16.1
        tirepublicerj.shop
        IN A
        104.21.96.1
        tirepublicerj.shop
        IN A
        104.21.48.1
        tirepublicerj.shop
        IN A
        104.21.32.1
      • flag-us
        DNS
        114.160.67.172.in-addr.arpa
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        Remote address:
        8.8.8.8:53
        Request
        114.160.67.172.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        cloudewahsj.shop
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        Remote address:
        8.8.8.8:53
        Request
        cloudewahsj.shop
        IN A
        Response
        cloudewahsj.shop
        IN A
        104.21.96.1
        cloudewahsj.shop
        IN A
        104.21.32.1
        cloudewahsj.shop
        IN A
        104.21.112.1
        cloudewahsj.shop
        IN A
        104.21.48.1
        cloudewahsj.shop
        IN A
        104.21.64.1
        cloudewahsj.shop
        IN A
        104.21.80.1
        cloudewahsj.shop
        IN A
        104.21.16.1
      • flag-us
        DNS
        127.156.67.172.in-addr.arpa
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        Remote address:
        8.8.8.8:53
        Request
        127.156.67.172.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        86.66.21.104.in-addr.arpa
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        Remote address:
        8.8.8.8:53
        Request
        86.66.21.104.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        tirepublicerj.shop
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        Remote address:
        8.8.8.8:53
        Request
        tirepublicerj.shop
        IN A
        Response
        tirepublicerj.shop
        IN A
        104.21.96.1
        tirepublicerj.shop
        IN A
        104.21.112.1
        tirepublicerj.shop
        IN A
        104.21.80.1
        tirepublicerj.shop
        IN A
        104.21.32.1
        tirepublicerj.shop
        IN A
        104.21.16.1
        tirepublicerj.shop
        IN A
        104.21.48.1
        tirepublicerj.shop
        IN A
        104.21.64.1
      • flag-us
        DNS
        steamcommunity.com
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        Remote address:
        8.8.8.8:53
        Request
        steamcommunity.com
        IN A
        Response
        steamcommunity.com
        IN A
        104.82.131.75
      • flag-us
        DNS
        144.165.67.172.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        144.165.67.172.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        framekgirus.shop
        Remote address:
        8.8.8.8:53
        Request
        framekgirus.shop
        IN A
        Response
        framekgirus.shop
        IN A
        104.21.18.19
        framekgirus.shop
        IN A
        172.67.179.160
      • flag-us
        DNS
        1.64.21.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        1.64.21.104.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        noisycuttej.shop
        Remote address:
        8.8.8.8:53
        Request
        noisycuttej.shop
        IN A
        Response
        noisycuttej.shop
        IN A
        104.21.71.146
        noisycuttej.shop
        IN A
        172.67.170.178
      • flag-us
        DNS
        146.71.21.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        146.71.21.104.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        1.96.21.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        1.96.21.104.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        136.63.122.92.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        136.63.122.92.in-addr.arpa
        IN PTR
        Response
        136.63.122.92.in-addr.arpa
        IN PTR
        a92-122-63-136deploystaticakamaitechnologiescom
      • flag-us
        DNS
        framekgirus.shop
        Remote address:
        8.8.8.8:53
        Request
        framekgirus.shop
        IN A
        Response
        framekgirus.shop
        IN A
        172.67.179.160
        framekgirus.shop
        IN A
        104.21.18.19
      • flag-us
        DNS
        noisycuttej.shop
        Remote address:
        8.8.8.8:53
        Request
        noisycuttej.shop
        IN A
        Response
        noisycuttej.shop
        IN A
        172.67.170.178
        noisycuttej.shop
        IN A
        104.21.71.146
      • flag-us
        DNS
        75.131.82.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        75.131.82.104.in-addr.arpa
        IN PTR
        Response
        75.131.82.104.in-addr.arpa
        IN PTR
        a104-82-131-75deploystaticakamaitechnologiescom
      • flag-us
        DNS
        19.18.21.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        19.18.21.104.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        rabidcowse.shop
        Remote address:
        8.8.8.8:53
        Request
        rabidcowse.shop
        IN A
        Response
        rabidcowse.shop
        IN A
        172.67.156.127
        rabidcowse.shop
        IN A
        104.21.7.224
      • flag-us
        DNS
        steamcommunity.com
        Remote address:
        8.8.8.8:53
        Request
        steamcommunity.com
        IN A
        Response
        steamcommunity.com
        IN A
        92.122.63.136
      • flag-us
        DNS
        lev-tolstoi.com
        Remote address:
        8.8.8.8:53
        Request
        lev-tolstoi.com
        IN A
        Response
        lev-tolstoi.com
        IN A
        104.21.66.86
        lev-tolstoi.com
        IN A
        172.67.157.254
      • flag-us
        DNS
        nearycrepso.shop
        Remote address:
        8.8.8.8:53
        Request
        nearycrepso.shop
        IN A
        Response
      • flag-us
        DNS
        160.179.67.172.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        160.179.67.172.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        178.170.67.172.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        178.170.67.172.in-addr.arpa
        IN PTR
        Response
      • 172.67.165.144:443
        imbibelubmbe.click
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.1kB
        5.2kB
        10
        9
      • 104.21.64.1:443
        abruptyopsn.shop
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.1kB
        5.4kB
        10
        10
      • 172.67.160.114:443
        wholersorie.shop
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.1kB
        5.2kB
        10
        10
      • 104.21.18.19:443
        framekgirus.shop
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.1kB
        5.2kB
        10
        9
      • 104.21.64.1:443
        tirepublicerj.shop
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.1kB
        5.2kB
        10
        9
      • 104.21.71.146:443
        noisycuttej.shop
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.1kB
        5.1kB
        10
        9
      • 172.67.156.127:443
        rabidcowse.shop
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.1kB
        5.2kB
        10
        10
      • 104.21.96.1:443
        cloudewahsj.shop
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.1kB
        5.2kB
        10
        10
      • 92.122.63.136:443
        steamcommunity.com
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.6kB
        43.6kB
        22
        37
      • 104.21.66.86:443
        lev-tolstoi.com
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.1kB
        5.2kB
        9
        10
      • 172.67.165.144:443
        imbibelubmbe.click
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.1kB
        5.2kB
        10
        9
      • 104.21.64.1:443
        abruptyopsn.shop
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.2kB
        5.4kB
        11
        10
      • 172.67.160.114:443
        wholersorie.shop
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.1kB
        5.2kB
        10
        10
      • 172.67.179.160:443
        framekgirus.shop
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.1kB
        5.2kB
        10
        10
      • 104.21.96.1:443
        tirepublicerj.shop
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.1kB
        5.2kB
        10
        9
      • 172.67.170.178:443
        noisycuttej.shop
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.1kB
        5.2kB
        10
        10
      • 172.67.156.127:443
        rabidcowse.shop
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.1kB
        5.1kB
        10
        9
      • 104.21.96.1:443
        cloudewahsj.shop
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.1kB
        5.1kB
        10
        9
      • 104.82.131.75:443
        steamcommunity.com
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.6kB
        43.6kB
        23
        37
      • 104.21.66.86:443
        lev-tolstoi.com
        tls
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        1.1kB
        5.1kB
        9
        9
      • 8.8.8.8:53
        imbibelubmbe.click
        dns
        14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
        787 B
        1.6kB
        12
        12

        DNS Request

        imbibelubmbe.click

        DNS Response

        172.67.165.144
        104.21.42.198

        DNS Request

        nearycrepso.shop

        DNS Request

        abruptyopsn.shop

        DNS Response

        104.21.64.1
        104.21.48.1
        104.21.96.1
        104.21.80.1
        104.21.32.1
        104.21.112.1
        104.21.16.1

        DNS Request

        8.8.8.8.in-addr.arpa

        DNS Request

        wholersorie.shop

        DNS Response

        172.67.160.114
        104.21.41.51

        DNS Request

        tirepublicerj.shop

        DNS Response

        104.21.64.1
        104.21.80.1
        104.21.112.1
        104.21.16.1
        104.21.96.1
        104.21.48.1
        104.21.32.1

        DNS Request

        114.160.67.172.in-addr.arpa

        DNS Request

        cloudewahsj.shop

        DNS Response

        104.21.96.1
        104.21.32.1
        104.21.112.1
        104.21.48.1
        104.21.64.1
        104.21.80.1
        104.21.16.1

        DNS Request

        127.156.67.172.in-addr.arpa

        DNS Request

        86.66.21.104.in-addr.arpa

        DNS Request

        tirepublicerj.shop

        DNS Response

        104.21.96.1
        104.21.112.1
        104.21.80.1
        104.21.32.1
        104.21.16.1
        104.21.48.1
        104.21.64.1

        DNS Request

        steamcommunity.com

        DNS Response

        104.82.131.75

      • 8.8.8.8:53
        144.165.67.172.in-addr.arpa
        dns
        677 B
        1.2kB
        10
        10

        DNS Request

        144.165.67.172.in-addr.arpa

        DNS Request

        framekgirus.shop

        DNS Response

        104.21.18.19
        172.67.179.160

        DNS Request

        1.64.21.104.in-addr.arpa

        DNS Request

        noisycuttej.shop

        DNS Response

        104.21.71.146
        172.67.170.178

        DNS Request

        146.71.21.104.in-addr.arpa

        DNS Request

        1.96.21.104.in-addr.arpa

        DNS Request

        136.63.122.92.in-addr.arpa

        DNS Request

        framekgirus.shop

        DNS Response

        172.67.179.160
        104.21.18.19

        DNS Request

        noisycuttej.shop

        DNS Response

        172.67.170.178
        104.21.71.146

        DNS Request

        75.131.82.104.in-addr.arpa

      • 8.8.8.8:53
        19.18.21.104.in-addr.arpa
        dns
        465 B
        788 B
        7
        7

        DNS Request

        19.18.21.104.in-addr.arpa

        DNS Request

        rabidcowse.shop

        DNS Response

        172.67.156.127
        104.21.7.224

        DNS Request

        steamcommunity.com

        DNS Response

        92.122.63.136

        DNS Request

        lev-tolstoi.com

        DNS Response

        104.21.66.86
        172.67.157.254

        DNS Request

        nearycrepso.shop

        DNS Request

        160.179.67.172.in-addr.arpa

        DNS Request

        178.170.67.172.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/444-2379-0x0000000075110000-0x00000000758C1000-memory.dmp

        Filesize

        7.7MB

      • memory/444-2376-0x0000000075110000-0x00000000758C1000-memory.dmp

        Filesize

        7.7MB

      • memory/1336-4-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-20-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-10-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-62-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-52-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-42-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-40-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-38-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-36-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-34-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-32-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-30-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-28-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-24-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-22-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-3-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-18-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-16-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-12-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-8-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-26-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-14-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-6-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-0-0x000000007511E000-0x000000007511F000-memory.dmp

        Filesize

        4KB

      • memory/1336-1183-0x0000000006070000-0x0000000006616000-memory.dmp

        Filesize

        5.6MB

      • memory/1336-65-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-60-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-58-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-56-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-54-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-50-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-48-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-46-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-44-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-1179-0x0000000075110000-0x00000000758C1000-memory.dmp

        Filesize

        7.7MB

      • memory/1336-1180-0x0000000075110000-0x00000000758C1000-memory.dmp

        Filesize

        7.7MB

      • memory/1336-1181-0x00000000056D0000-0x0000000005750000-memory.dmp

        Filesize

        512KB

      • memory/1336-1182-0x0000000002F80000-0x0000000002FCC000-memory.dmp

        Filesize

        304KB

      • memory/1336-66-0x0000000005540000-0x0000000005649000-memory.dmp

        Filesize

        1.0MB

      • memory/1336-1184-0x00000000058C0000-0x0000000005914000-memory.dmp

        Filesize

        336KB

      • memory/1336-1189-0x0000000075110000-0x00000000758C1000-memory.dmp

        Filesize

        7.7MB

      • memory/1336-1193-0x0000000075110000-0x00000000758C1000-memory.dmp

        Filesize

        7.7MB

      • memory/1336-1194-0x0000000075110000-0x00000000758C1000-memory.dmp

        Filesize

        7.7MB

      • memory/1336-1-0x00000000008F0000-0x0000000000A0C000-memory.dmp

        Filesize

        1.1MB

      • memory/1336-2-0x0000000005540000-0x000000000564E000-memory.dmp

        Filesize

        1.1MB

      • memory/2964-1195-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.