lumma | c7258d057f5072211b50e9edcda0bf1d63b8285c4a463ff81ebbe036aa850862

Analysis

max time kernel
93s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New folder (6)/BoostrappersSv.exe
Size

1.1MB
MD5

363a51e95adbad71753bcb5674316536
SHA1

0e45bc776c0447c348ecd6764c04ecf14a3c6602
SHA256

50053689dc55232b8df6601c03021b8fd62696bdcae3fcc4ab412ff730f24eb2
SHA512

a2c7b3bcc8abf08ed96b5295a17f04c947f01a1b665f016d2a1ff053bce0a366871b687fd9f541f58095ad749f4854db412f4f8fe7c7e5e40e51390a270a38f4
SSDEEP

24576:qwhppQXcyjToPPlBmna4rs+fUfgehHoe02NVO6:LppQMyAPPl0rs+MIehHpnl

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://uprootquincju.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	BoostrappersSv.exe

Executes dropped EXE 1 IoCs

pid	Process
3480	A.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
1736	tasklist.exe
2668	tasklist.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PpcBytes	BoostrappersSv.exe
File opened for modification	C:\Windows\HourRack	BoostrappersSv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BoostrappersSv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3480	A.com
3480	A.com
3480	A.com
3480	A.com
3480	A.com
3480	A.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2668	tasklist.exe
Token: SeDebugPrivilege	1736	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3480	A.com
3480	A.com
3480	A.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3480	A.com
3480	A.com
3480	A.com

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 2700	3456	BoostrappersSv.exe	82
PID 3456 wrote to memory of 2700	3456	BoostrappersSv.exe	82
PID 3456 wrote to memory of 2700	3456	BoostrappersSv.exe	82
PID 2700 wrote to memory of 2668	2700	cmd.exe	84
PID 2700 wrote to memory of 2668	2700	cmd.exe	84
PID 2700 wrote to memory of 2668	2700	cmd.exe	84
PID 2700 wrote to memory of 3916	2700	cmd.exe	85
PID 2700 wrote to memory of 3916	2700	cmd.exe	85
PID 2700 wrote to memory of 3916	2700	cmd.exe	85
PID 2700 wrote to memory of 1736	2700	cmd.exe	87
PID 2700 wrote to memory of 1736	2700	cmd.exe	87
PID 2700 wrote to memory of 1736	2700	cmd.exe	87
PID 2700 wrote to memory of 2868	2700	cmd.exe	88
PID 2700 wrote to memory of 2868	2700	cmd.exe	88
PID 2700 wrote to memory of 2868	2700	cmd.exe	88
PID 2700 wrote to memory of 3260	2700	cmd.exe	89
PID 2700 wrote to memory of 3260	2700	cmd.exe	89
PID 2700 wrote to memory of 3260	2700	cmd.exe	89
PID 2700 wrote to memory of 3208	2700	cmd.exe	90
PID 2700 wrote to memory of 3208	2700	cmd.exe	90
PID 2700 wrote to memory of 3208	2700	cmd.exe	90
PID 2700 wrote to memory of 1048	2700	cmd.exe	91
PID 2700 wrote to memory of 1048	2700	cmd.exe	91
PID 2700 wrote to memory of 1048	2700	cmd.exe	91
PID 2700 wrote to memory of 4944	2700	cmd.exe	92
PID 2700 wrote to memory of 4944	2700	cmd.exe	92
PID 2700 wrote to memory of 4944	2700	cmd.exe	92
PID 2700 wrote to memory of 4144	2700	cmd.exe	93
PID 2700 wrote to memory of 4144	2700	cmd.exe	93
PID 2700 wrote to memory of 4144	2700	cmd.exe	93
PID 2700 wrote to memory of 3480	2700	cmd.exe	94
PID 2700 wrote to memory of 3480	2700	cmd.exe	94
PID 2700 wrote to memory of 3480	2700	cmd.exe	94
PID 2700 wrote to memory of 1636	2700	cmd.exe	95
PID 2700 wrote to memory of 1636	2700	cmd.exe	95
PID 2700 wrote to memory of 1636	2700	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\New folder (6)\BoostrappersSv.exe
"C:\Users\Admin\AppData\Local\Temp\New folder (6)\BoostrappersSv.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Sherman Sherman.cmd & Sherman.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2668
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3916
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1736
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2868
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 775095
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3260
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Wells
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3208
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Unity" Parker
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1048
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 775095\A.com + Isolation + Gaming + Just + Restaurants + Lined + Cisco + Memorabilia + Javascript + Till + Copied 775095\A.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4944
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Minute + ..\Troubleshooting + ..\Adopt + ..\Ng + ..\Junior + ..\Dome + ..\Hardcover D
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4144
- - C:\Users\Admin\AppData\Local\Temp\775095\A.com
    A.com D
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3480
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\775095\A.com

Filesize
1KB

MD5
ed86c91978e0e5544197f3357f2e0b86

SHA1
551f390618497646144128c0e526ddb4c0fb3aa4

SHA256
6752be492926d7f2aaef195b41ee827fff3aa072e81fb5354a0e210cfd274d28

SHA512
5546f85af2fbc0d075eac9b4b6ac55d734bf15ab41d6f49a38c084dcaee7c206ced91af39b8c911d78083a2a153f1d8485b8f525217f8950f841cc008e32772a

Download Submit
C:\Users\Admin\AppData\Local\Temp\775095\A.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\775095\D

Filesize
484KB

MD5
101d2c136ecb5eae9e2227fbd135e0a0

SHA1
f7aee294ea6f373a2b68d2e026f8b3d3e0534a13

SHA256
e53c04ac34b0555dc18e6f54c76cb89a8da454db1395088a6ae2b4d60c501d5f

SHA512
0ee219f476acde0659b0403814f37c2d6d2c8231795429b12595d7e44620fa826ee91d8bd95bd83d0b50ab268599cf70267421111b2b085b8f58b425c7282f4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Adopt

Filesize
79KB

MD5
6886393beba38c97b27d8d410e134cb2

SHA1
b75691e8212f1ca5a85553d6f478e0b392f2f470

SHA256
5c31646d53f90cbfe38dbe77efdefd5a502fb59cf507b3aec2d14abeb2343371

SHA512
b1cedade0e55c9b6ea1440ed603d3a2aff741af1332b8602e6563b463741c4f937ab918bfde7bc64de406a99dd7be871a12863d8d6659e060c38d8a93a43fe43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cisco

Filesize
148KB

MD5
eee05379e23f6e331e15b9d2fde3c144

SHA1
d2bcc1e4125ae79589c7a2f0c972136af5f7e29a

SHA256
cd74f7e02a5f11c189511903cada1da73765d3eae7da789654d59f63864c80f3

SHA512
f757ae548979f679b7d1f3c472e10545bb88b894593d99fa0845c62949ddbb0197cf6e11900ca5800682b180212d24eb397f417ae80576301a3ef5548f1839ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Copied

Filesize
3KB

MD5
e9cf3188318dcae0f4e26c3ab6d40dfe

SHA1
d349eb704fd4e36108046e31572bbcbd486f00f2

SHA256
aa3f703259f1901e8614031dd85eae67813e2d5c45d5ade80258677419d45e43

SHA512
7627f779d60827c6d946c71f3731c8c905b2ba0f5049c242f2f15c0191ef7430b7f3fc14bdb1314fda964be94d88c3fc1089d2ca3c17aad62525b735c90d2407

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dome

Filesize
82KB

MD5
e9dc6ae91b63467a414d7341ff4bd3de

SHA1
5d2c0a6a9138f01e347697b7dae668c6059e25c9

SHA256
5a39f3de169fcc32ff697dbaf9ae7c02aefc043313627394c1c900ad53d904a3

SHA512
10685b5fa93d96734990a6a17380149f9733efc49f98ef43ec1ee7e861518057e6c70118c1f4791da9f54435910455e145283ff6ac90ca2b2adadf0e7b78c9d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gaming

Filesize
95KB

MD5
6e0620d62576848bb6aa925488f163a7

SHA1
dbf3b470e7bce8ca4dcc3776683f2f65d0bfb679

SHA256
5bd48ec4e3f92fb5dd323ea694ac2468763e68e4b2600c7329a1a7cc4776ffbe

SHA512
6aa3bc0a2d427a9a325cab94b09301c41272d9b3e6177c356b8695ce6e6d935bb49ea5c398b0393171f07e0455f698c5d2d95a190bedf01af79f7e59034a2efe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hardcover

Filesize
19KB

MD5
81bf0ed2db7a09fbf8c49fbb59083d44

SHA1
12200e7d89dae29b220c8820ed5ad56969a83c91

SHA256
639e5cf9dc34e768c546f955d0ea1e2f59b29b9721182dd53e5d55ae7ee05d59

SHA512
bc372e9d4884a817666121038512635c2bc6cf13ab3fc41d37acc0991aa9722f4cb3b3bf9ee1bfdf329ea9c037e996acec5870ec633595838f5ed7324fe4da91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Isolation

Filesize
140KB

MD5
6b340fec1d71e862795bb9d96d018cb1

SHA1
204de0f7face77ef39f566cb56028babeb40ee1d

SHA256
f0a6bb524f3a0f3dca62cd393b41d7fb7c1c712c2391beb93943178d62c94e45

SHA512
55a257d7e3d926907ce2c6fbe1ea722b29658c745f54f7c7673d7286c07492e0b9c4af8648bd8f9637b68ade7b5fb77a73021dbcd968f0d6df9e2ed8a3e065ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Javascript

Filesize
78KB

MD5
99ea837b76cc1361ac98423e62ff5c58

SHA1
43ecd105d28d71dce31b040435f325345b815a3a

SHA256
7ce72f7349c1715ed8f850fbe3a5844219c1d4888a5f0b87793ab17b7e67f736

SHA512
ee6ac90caff2d3e1f1d8d5b9013e8b9b049f8e23b5c526b61b3ca954de6f301afd0c349ab58d54ac69d19f3eef64ebfe00c501c52c45f923288b0389aee3e74f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Junior

Filesize
97KB

MD5
2cfcb1382cecb6d66a4b231536a28ef7

SHA1
db3ebeaea4fee05acfb12ceacbd7a24379d25e87

SHA256
133d44f9b2395b44eecf0ea8dac869d182c29c06a4b30dab936e39c201a3bac9

SHA512
803b63433bbfd307db8156558da95628ce85fdcaa5ec100caa63ef27fb47f4219f35e083de2e4a0ae08be2997a484e4441cefacc5b5f61cafb1081a851672fb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Just

Filesize
128KB

MD5
c8c42e4cbd2cda70f079cf87bd2cbaf3

SHA1
18867297d36885bb065e6193b9ef1e253e10af69

SHA256
be05352eb9d45c5840c6d33e34706987146d05f11c027b4f36fc4e8beae3ee71

SHA512
cc59f5bf0e5d5435b6f9885d7aecc14ace50ff244708f88996b9fcc6650a66fb877f621bc1728df8eeba6da42dcca2f45024bfe9d9237efa5c434c93d9fde53e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lined

Filesize
128KB

MD5
905ba3bbfe600c71f027efdd4953f41c

SHA1
a1f2b35b91332e0b26f0f041b5638437b8cd9f3d

SHA256
3769eb3a46cf3e08d3a79c4ae30f32e2a7bef4453efabef464f0ce62f33f550f

SHA512
4351e6af2ec7e03b7b94e9f3dc8cfcdff39f2d7d99c0ac3a6feafa28e341f9ca29430998f43bf8ee518911e7ab9cd864ff18f64ea8231be4943f3e2aff0b6785

Download Submit
C:\Users\Admin\AppData\Local\Temp\Memorabilia

Filesize
52KB

MD5
2ee47e01fe660de289e570d562393859

SHA1
772298e3844575d494cde79363fa184377b7e25a

SHA256
5f7d99fd4cd7a13fe80535d0fd4ffbf22abf0c4c758a73dd3b528739b3a663fb

SHA512
9709831bdce0307a37cd008a14dea878fbb3d5a8480e03bc07d0696c4c097e5262c7cd9993517c2eb1fb2e12ca24752a446e833430a2a3cef1e004f212057f96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Minute

Filesize
57KB

MD5
5a3a9d9dcd7cd202af170e8e52b58dca

SHA1
dbd658f67516c5021fdb28148fd511709257a7af

SHA256
9334e3680b23140fd03ab549f67803aa7871cfb5c085e382d8a3409c79565ec9

SHA512
c7be33389f321026b3fb135b7fc4c2508dc78f886c47cca9efb2a54f043e16fa1ef6fdf469921000078426715de079630e2d9019aa3cf4bbd7553a9d07088c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ng

Filesize
54KB

MD5
6d8a4a18e4ebb415b52e2e4b2592bc3c

SHA1
9bcf73b0375cd03de465df3b1b5c08d54003714b

SHA256
8d5c3831d73f764fcfc3a79f3a0f267d8e9e726e1bdbde8ea58532c9acf582de

SHA512
7b112cfc31f6b3887abba9fe688fa07ef36993fad029b475d5e88be9e142ff37064f357bf8d96fce353980c572760b71709b5994ccabda9eaf38cdfed229fb5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Parker

Filesize
1KB

MD5
d980d64fc5f52b97519a8ce53f6c54f9

SHA1
ecbee164f486ea81f47c53bed8b39a4ca00f7e6b

SHA256
d6d9ee986cde98ee50c50191a075be722e167238f174252b9815eefb34bc1644

SHA512
af872b11c83d5757837fdadca9df9d9838379a951b415b782031ba0cbc2972e79db5ba876c9e1701f23fd6139ea6729447d5c645cc0f18a350a9a1f574061d64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Restaurants

Filesize
77KB

MD5
4d97881927e91cc1eeeebcd8d7b104e1

SHA1
a4ec4c8d6b64bf25b0611c2ffcf005ae72cffc09

SHA256
739e9cc3745e7185401ea4e9fb35884d3ce84ad695a774374f7953fc30b7e6ad

SHA512
70dc03087de0aa8aa43bc2502e8e6129c9227222110f53af9f6e4b338a8194b7e865463703301609c107e8a8dd59acb69364473fb8b9ebd01fb12790a79b5ffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sherman

Filesize
7KB

MD5
97c077ea716cc45ff64b68216c02e8fb

SHA1
4a1778a49b03e0f3d45e7d7293d2fb3c108bf2d5

SHA256
6a13f44b6f192ab95e2e4fa627657324957fe2c08c6b27c3581834d9c08777f8

SHA512
52f123c834ce22aa14550833000dfb4b8704ca004b89eb48be69fd6058880296d21db2b9ba0ed00a96a06fbf60ab12d9e623b280771afe97bc0f213b93eb778b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Till

Filesize
74KB

MD5
f823040a3b2660852675a063ee899f4f

SHA1
35df1dd2cd0747da889dea0a769edcb15bcb6885

SHA256
386ed12c899287c3ecc80cf73114cff9ec7241e1c53798d7d70a5604add8a7bb

SHA512
6a1544bc29fe48f2c5a11c524edf2baba2a5688d1b9e2f0695770e8b677581d8a2c9ab5cbf8a6606804dfa7505ca762c50966f1fea44f7ffec90964da69ecdf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Troubleshooting

Filesize
96KB

MD5
58f30bcd78c6fc5fc497628918c6d31c

SHA1
ba424ad8ef20ac53bcad0b23945d86d1a86c037f

SHA256
ecf0b6b07b45980e73f2e83bac8c123c994e1838f85750b866b21d2ecc4742d2

SHA512
5d58cc4c3c6ef34f32e377ddd1099c17f1bfa1825b4c1c15eed5f66f5430461774285c63cbeba60623261d8fc5006a516eea0580e119ce04dcb565334e957ccd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wells

Filesize
478KB

MD5
d39e97cc0e0be786d253646af368ef73

SHA1
ab915406f71fc7bfd6b409d1301131225335c381

SHA256
9c1f28beb5f9c45089e965fc4bee65f13a64a9e201cb079d5a1d5bcd9847dfe8

SHA512
7ede66f72deeafc0a0500392461c3b2ce37d7eb2b760ad0f5f141e00c2d1de5bb54b222360bab92e62a2d83853f8a1aa4322b695ba9746baba9ffd649f7f6a6e

Download Submit
memory/3480-249-0x0000000004730000-0x000000000478B000-memory.dmp

Filesize
364KB

Download
memory/3480-251-0x0000000004730000-0x000000000478B000-memory.dmp

Filesize
364KB

Download
memory/3480-248-0x0000000004730000-0x000000000478B000-memory.dmp

Filesize
364KB

Download
memory/3480-252-0x0000000004730000-0x000000000478B000-memory.dmp

Filesize
364KB

Download
memory/3480-250-0x0000000004730000-0x000000000478B000-memory.dmp

Filesize
364KB

Download