Overview

overview

10

Static

static

10

setup.exe

windows7-x64

10

setup.exe

windows10-ltsc 2021-x64

10

setup.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    153s
  • max time network
    157s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    12/02/2025, 14:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup.exe
  • Size 697.3MB
  • Sample250212-rtbqwsvras
  • SHA256 62e6fc53e8a929fe7e8000e613bdd50917dd0ef303c5cace46a65ceb6a495b8b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
lummaadwarediscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Extracted

Family

  • lumma

C2

  • https://brixghtquest.cyou/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 13 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 35 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4852
    • C:\Users\Admin\AppData\Local\Temp\CY9H4VNXJRE7HWX6TSTI1L\vcpkgsrv.exe
      "C:\Users\Admin\AppData\Local\Temp\CY9H4VNXJRE7HWX6TSTI1L\vcpkgsrv.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\ProgramData\FNPLicensingService\vcpkgsrv.exe
        C:\ProgramData\FNPLicensingService\vcpkgsrv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:632
        • C:\Windows\SysWOW64\choice.exe
          C:\Windows\SysWOW64\choice.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:3076
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            5⤵
            • System Location Discovery: System Language Discovery
            PID:888
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDhFNDdFQkYtNzVCNi00QjQxLTk4NkYtQzlFMEY4ODBFNENDfSIgdXNlcmlkPSJ7RUUwMDJFREYtRTQ3Ni00NzcwLTlFNTAtRTJEMTQwRDI0OEVBfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RjI0NTYyNTAtRUU0Mi00RkJDLTkzNEItMzI2QkM2N0YwOUI4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMSIgaW5zdGFsbGRhdGV0aW1lPSIxNzM5MjcwNDg0IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODM3NDE5MzM1MTUwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTA5MDA5OTc0MiIvPjwvYXBwPjwvcmVxdWVzdD4
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:568
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B5B31730-7D2E-4B16-8064-F1AF1E146967}\MicrosoftEdge_X64_133.0.3065.59.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B5B31730-7D2E-4B16-8064-F1AF1E146967}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3348
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B5B31730-7D2E-4B16-8064-F1AF1E146967}\EDGEMITMP_22A07.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B5B31730-7D2E-4B16-8064-F1AF1E146967}\EDGEMITMP_22A07.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B5B31730-7D2E-4B16-8064-F1AF1E146967}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1932
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B5B31730-7D2E-4B16-8064-F1AF1E146967}\EDGEMITMP_22A07.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B5B31730-7D2E-4B16-8064-F1AF1E146967}\EDGEMITMP_22A07.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B5B31730-7D2E-4B16-8064-F1AF1E146967}\EDGEMITMP_22A07.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff761e76a68,0x7ff761e76a74,0x7ff761e76a80
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:1900
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B5B31730-7D2E-4B16-8064-F1AF1E146967}\EDGEMITMP_22A07.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B5B31730-7D2E-4B16-8064-F1AF1E146967}\EDGEMITMP_22A07.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:3852
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B5B31730-7D2E-4B16-8064-F1AF1E146967}\EDGEMITMP_22A07.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B5B31730-7D2E-4B16-8064-F1AF1E146967}\EDGEMITMP_22A07.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B5B31730-7D2E-4B16-8064-F1AF1E146967}\EDGEMITMP_22A07.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff761e76a68,0x7ff761e76a74,0x7ff761e76a80
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:412
      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:812
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6ec666a68,0x7ff6ec666a74,0x7ff6ec666a80
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:748
      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2708
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6ec666a68,0x7ff6ec666a74,0x7ff6ec666a80
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:1480
      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3108
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6ec666a68,0x7ff6ec666a74,0x7ff6ec666a80
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:1344
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
    1⤵
      PID:2200

    Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Browser Extensions

          1
          T1176

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Defense Evasion

          Modify Registry

          4
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          3
          T1552

          Credentials In Files

          3
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Query Registry

          2
          T1012

          System Information Discovery

          1
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Data from Local System

          3
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          setup.exe
          • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B5B31730-7D2E-4B16-8064-F1AF1E146967}\EDGEMITMP_22A07.tmp\setup.exe
          • Size 6.8MB
          • SHA256 ce78ccfb0c9cdb06ea61116bc57e50690650b6b5cf37c1aebfb30c19458ee4ae
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          8b900322
          • Path C:\Users\Admin\AppData\Local\Temp\8b900322
          • Size 6.3MB
          • SHA256 672700462c5d9fafef0a0d2ed5b46e65cd64e576c6ccd985500abe1f63459e76
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\CY9H4VNXJRE7HWX6TSTI1L\VCRUNTIME140.dll
          • Size 88KB
          • SHA256 e0850ad7c2431f822359e129c85b708373759a1aaadb70b3740642ea44345a04
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          airstrip.eps
          • Path C:\Users\Admin\AppData\Local\Temp\CY9H4VNXJRE7HWX6TSTI1L\airstrip.eps
          • Size 5.7MB
          • SHA256 dac4389e990c7238ba6ee08e0505cea5ddabaf4d8dc38354c47d18de1624f43d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cassoulet.pkg
          • Path C:\Users\Admin\AppData\Local\Temp\CY9H4VNXJRE7HWX6TSTI1L\cassoulet.pkg
          • Size 55KB
          • SHA256 e68bce3f61193576d743fcd7f4cf6ce98ca57b0e3db3ca2bc46d41ccf0d5b9a9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          concrt140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\CY9H4VNXJRE7HWX6TSTI1L\concrt140.dll
          • Size 254KB
          • SHA256 0a3894dd420ed6b4c7ebbde463dbbde69cdb032e290b1c86c21ccdaa4da95526
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msvcp140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\CY9H4VNXJRE7HWX6TSTI1L\msvcp140.dll
          • Size 438KB
          • SHA256 4ad3de3443d7658f74c978e7eb04730e3d812bc592fee47be4e6348d1fb4814e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          vcpkgsrv.exe
          • Path C:\Users\Admin\AppData\Local\Temp\CY9H4VNXJRE7HWX6TSTI1L\vcpkgsrv.exe
          • Size 1.4MB
          • SHA256 a5c5487194f761dac90e178c9c1753c0f47b041f3168b5c23a587f33f69e5089
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedge_installer.log
          • Path C:\Windows\SystemTemp\msedge_installer.log
          • Size 99KB
          • SHA256 a351e99f833c4580f567e9721abc5e3b8d736b6d3136c7973131edc6d634f7fc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedge_installer.log
          • Path C:\Windows\SystemTemp\msedge_installer.log
          • Size 103KB
          • SHA256 2a44dfb6ca2cb46ea32b9d2f21ac17657eec21e4348dfb804360481af51046d5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedge_installer.log
          • Path C:\Windows\SystemTemp\msedge_installer.log
          • Size 104KB
          • SHA256 2b3cf03c337086a6e0f97809e83b6670ae643a3109578c7d22917465b27689ad
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedge_installer.log
          • Path C:\Windows\SystemTemp\msedge_installer.log
          • Size 72KB
          • SHA256 75cb2241c9a21ebd4e967416f6b030bf456005d13f6f7f6fe067dda7667c2685
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/632-64-0x0000000074AB0000-0x0000000074C2B000-memory.dmp
          Download

          memory/632-65-0x00007FF990210000-0x00007FF990408000-memory.dmp
          Download

          memory/632-66-0x0000000074AB0000-0x0000000074C2B000-memory.dmp
          Download

          memory/888-131-0x0000000000600000-0x0000000000BBC000-memory.dmp
          Download

          memory/888-130-0x0000000000600000-0x0000000000BBC000-memory.dmp
          Download

          memory/888-88-0x00007FF990210000-0x00007FF990408000-memory.dmp
          Download

          memory/888-133-0x0000000000600000-0x0000000000BBC000-memory.dmp
          Download

          memory/888-86-0x0000000000600000-0x0000000000BBC000-memory.dmp
          Download

          memory/1944-55-0x00007FF990210000-0x00007FF990408000-memory.dmp
          Download

          memory/1944-54-0x0000000074E30000-0x0000000074FAB000-memory.dmp
          Download

          memory/3076-82-0x0000000074AB0000-0x0000000074C2B000-memory.dmp
          Download

          memory/3076-70-0x0000000074AB0000-0x0000000074C2B000-memory.dmp
          Download

          memory/3076-69-0x00007FF990210000-0x00007FF990408000-memory.dmp
          Download

          memory/4852-1-0x0000000002F30000-0x0000000002F8A000-memory.dmp
          Download

          memory/4852-3-0x0000000000400000-0x00000000014B2000-memory.dmp
          Download

          memory/4852-0-0x0000000002F30000-0x0000000002F8A000-memory.dmp
          Download