lumma | f667c428b522dde24c5524da99fdf375e3fed0ca92977f0890eb72e21e2178fb

Analysis

max time kernel
104s
max time network
141s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250619-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250619-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
20/08/2025, 12:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
⊳🔸 𝐒𝐄𝐓𝐔𝐏2.exe
Size 1.4MB
Sample250820-n9hbtseq6v
SHA256 f667c428b522dde24c5524da99fdf375e3fed0ca92977f0890eb72e21e2178fb
MD5 2af5068f57164b15ab2da10f956f243c
SHA1 81a299a54ba003b307d84a220c697907bd960b54
SHA512 da761bb422af4fa8df32eaaeacb1b3d14fd0024aeb9bdb68b19a672f38168c65b34e6ae39411fb9cc61f538a16871f8e565f4e4e539cff982de9c0c3b2f33cbf
SSDEEP 24576:RVDATV2yrKLfFBWVMSiZxkHGhSPAFvF9um0rhikQWbkC146dRn3sxVCL2Q:R2luLfTDAGsPdBrEkQWt146Uo2Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma defense_evasion discovery spyware stealer

Malware Config

Extracted

Family

lumma

https://runmgov.ru/tixd
https://mastwin.in/qsaz
https://tiltyufaz.ru/tlxa
https://semipervaz.ru/xued
https://capitalior.ru/akts
https://retrofik.ru/jgur
https://shagkeg.ru/xkzd
https://copulardi.ru/xhza

Attributes

build_id
4a5944b09bbb50e25bc1bd7ed4989a048f3d4843bdf96f8c

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	Officer.pif
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	Officer.pif

Executes dropped EXE 1 IoCs

pid	Process
1136	Officer.pif

Loads dropped DLL 1 IoCs

pid	Process
2652	⊳🔸 𝐒𝐄𝐓𝐔𝐏2.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5144	tasklist.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\TroutBoy	⊳🔸 𝐒𝐄𝐓𝐔𝐏2.exe
File opened for modification	C:\Windows\ThursdaySatin	⊳🔸 𝐒𝐄𝐓𝐔𝐏2.exe
File opened for modification	C:\Windows\SuccessGuided	⊳🔸 𝐒𝐄𝐓𝐔𝐏2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Officer.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	⊳🔸 𝐒𝐄𝐓𝐔𝐏2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1136	Officer.pif
1136	Officer.pif
1136	Officer.pif
1136	Officer.pif
1136	Officer.pif
1136	Officer.pif
1136	Officer.pif
1136	Officer.pif
1136	Officer.pif
1136	Officer.pif
1136	Officer.pif
1136	Officer.pif
1136	Officer.pif
1136	Officer.pif
1136	Officer.pif
1136	Officer.pif
1136	Officer.pif
1136	Officer.pif

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5144	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1136	Officer.pif
1136	Officer.pif
1136	Officer.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1136	Officer.pif
1136	Officer.pif
1136	Officer.pif

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 1772	2652	⊳🔸 𝐒𝐄𝐓𝐔𝐏2.exe	81
PID 2652 wrote to memory of 1772	2652	⊳🔸 𝐒𝐄𝐓𝐔𝐏2.exe	81
PID 2652 wrote to memory of 1772	2652	⊳🔸 𝐒𝐄𝐓𝐔𝐏2.exe	81
PID 1772 wrote to memory of 4400	1772	cmd.exe	83
PID 1772 wrote to memory of 4400	1772	cmd.exe	83
PID 1772 wrote to memory of 4400	1772	cmd.exe	83
PID 4400 wrote to memory of 5144	4400	cmd.exe	85
PID 4400 wrote to memory of 5144	4400	cmd.exe	85
PID 4400 wrote to memory of 5144	4400	cmd.exe	85
PID 4400 wrote to memory of 5180	4400	cmd.exe	86
PID 4400 wrote to memory of 5180	4400	cmd.exe	86
PID 4400 wrote to memory of 5180	4400	cmd.exe	86
PID 4400 wrote to memory of 1180	4400	cmd.exe	88
PID 4400 wrote to memory of 1180	4400	cmd.exe	88
PID 4400 wrote to memory of 1180	4400	cmd.exe	88
PID 4400 wrote to memory of 4452	4400	cmd.exe	89
PID 4400 wrote to memory of 4452	4400	cmd.exe	89
PID 4400 wrote to memory of 4452	4400	cmd.exe	89
PID 4400 wrote to memory of 1136	4400	cmd.exe	90
PID 4400 wrote to memory of 1136	4400	cmd.exe	90
PID 4400 wrote to memory of 1136	4400	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\⊳🔸 𝐒𝐄𝐓𝐔𝐏2.exe
"C:\Users\Admin\AppData\Local\Temp\⊳🔸 𝐒𝐄𝐓𝐔𝐏2.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd < Subscriber.wp5
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5144
  - - C:\Windows\SysWOW64\findstr.exe
      findstr "SophosHealth nsWscSvc ekrn bdservicehost AvastUI AVGUI & if not errorlevel 1 Set UylZinWCjopXazWTjUmCIuvOsjEkBESSyur=AutoIt3.exe & Set wxNSJFrUVzDNndHTFlsLmuLbucGHEdHxKVrfjkN=.a3x & Set GRYXGxAAWK=300
      4⤵
      System Location Discovery: System Language Discovery
      PID:5180
  - - C:\Windows\SysWOW64\extrac32.exe
      extrac32 /Y Warned.wp5 *.*
      4⤵
      System Location Discovery: System Language Discovery
      PID:1180
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "GUITARS" Allen
      4⤵
      System Location Discovery: System Language Discovery
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\571310\Officer.pif
      Officer.pif R
      4⤵
      Modifies trusted root certificate store through registry
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Officer.pif

Path C:\Users\Admin\AppData\Local\Temp\571310\Officer.pif
Size 957KB
SHA256 3ec9740bedc683021cc3e94e4a33b3a9d3d6f9b9e96b1f04cc6534f551dd58c1
MD5 f589c1095824c52a5ed3625d0d851b22
SHA1 2eac026b394548268cc8ee783de99c88cfb1e408
SHA512 f47f3bf4930191eb0d01b1a1bd737ccbe368266c99d5ee1c22d7db49125d7b3ca0685fb2c057f891e9240d215ddb96209db2e971c640592e1d487e794cc93e46
SSDEEP 24576:hMd+PsPy8Fv7yw56uX4Nw1ImcY3a2hrbBz:hzPsPy8Yw5EN62srb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\571310\R
Size 540KB
SHA256 8ff9bfd3dfb361ec6ea93f1c33e11be2a03a2bf57afb6bc0739b1b7e1fb6998d
MD5 c965d02938680e21fa6840151967772f
SHA1 b1223a71360a1e5aa7f6948cd6422cee781198db
SHA512 74d324ff9dfd9f7e2ecd4f313122e4121f43aa4aabfc610f178a11215beef585bb377357d4274a8590414ecce9d22a34e8b4c7f6197a1730b8daeabeff1d0a21
SSDEEP 12288:yC147uZwsRrWU6gmOVCJ72d5BWVRrTx8tIvxbQrRazoxNo+1KQN4TRrKLk:yC146JRaUsOVC12/BWVRriQxbXGhsQOp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Allen

Path C:\Users\Admin\AppData\Local\Temp\Allen
Size 2KB
SHA256 39cecc9cff24358ada56f2286d4ca32c6e7ee6f6915905b14dcba54058dea76e
MD5 a39e31ced8162a48558c41595366cddf
SHA1 1534f7fdba85e045051f121c64230ff3954c905a
SHA512 817ee372b5f3acba27626b1257f3845347c01086d3e17ed60f057781fe6093f0f31a748b45c7b920d7d651e612f2e9306b3fa3d88e6cc714b41018f6fcace6ba
MD5 SHA1 SHA512

Submit Download

Breed

Path C:\Users\Admin\AppData\Local\Temp\Breed
Size 127KB
SHA256 8a41fc6476174ef89754e7be819435d0015e0ec9bb74ad6b1b37b9888c6060e8
MD5 a234248b8919d9c70c39b40d72cb36bd
SHA1 95cd9833f3b0c76c12c07f1c42075da00c2704d3
SHA512 f9b1b40ba829945f8f717bb98f33851bca5cfb6116cfeb2983faf7c01e63dc58b601eb6c13e1784aacc7bcb488439e75625bd76083c832104648459cb0ee7a7e
SSDEEP 1536:h1PdJaGloaj6bs8jcd/TcI3s+uXkrfhrRj3:h1Pfam6OzmkrJrRj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Custom

Path C:\Users\Admin\AppData\Local\Temp\Custom
Size 111KB
SHA256 a045e996857ddd2c63a213678bc49bd71c8df89e388263035274d01784b97231
MD5 2762f1fc1b32835f43f0ac9d627a787c
SHA1 45f630bf614073cae4f29f558de156bb5a1adfde
SHA512 4e4fd607a2408ce492c97026a09230246f1756f0c904b60b0000b03ec10161020ea8b2bcfa3f14697f93d35559f627814eac999aa73767396363530eb1a0b158
SSDEEP 1536:E0YwYwTkNJ3Rpref3ghV1SKOxqNdunCMfpfpJKgMPdkdux84SbL8R571Nf0xeY:PeVzOqD1IGuTpMgKYbwR5ExeY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Her

Path C:\Users\Admin\AppData\Local\Temp\Her
Size 109KB
SHA256 7b3ac71b704435c09421400b38ceb669daf4df8bc268f30c066009e7b36f06ca
MD5 a4fa1c88c0867230ef1aaacbc6a472db
SHA1 863b4c0ebe664d9d9f4bbd42b8149b481310d533
SHA512 1936f906df997600ae0a6f7eb4c68279048a71794977fedf8bc7a2cf8bcfb030cf984461d755bf3e72089cc903616b49ac9ed17db883cd6db47d2b75f3d90b83
SSDEEP 3072:cMBwvqXQGYlawwBonasL9jC0O2iSW4QlXUxPrCtTRVB4V:clXuww8x1WUyB4V
MD5 SHA1 SHA512 SSDEEP

Submit Download

Inspection

Path C:\Users\Admin\AppData\Local\Temp\Inspection
Size 129KB
SHA256 933b18bbaf3d2e7baeb076025dec75d8cb6372483f22f85ba95ae0b2a9ed31fc
MD5 b3184ff15e58b4fa08542b32576a2e83
SHA1 76a2b94c9b95f40535b59dcce3083d26eb0c4524
SHA512 cf0a3e2dc834653bca4c2c98790f4d2027879ca2a8a311a166ce0b0afd4082b139c684ca2b5eb5275b51a1a568091af3ef8e775adbfdb3f2ded4125c506e43ca
SSDEEP 3072:J/RTX/4gxRuNkdKF0vYNyet+JQ+HcnkL8xCSVYvlhx6vA3MD8Q:J/RTggXuN2KFIyt+8ZUlhxb8n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Labels

Path C:\Users\Admin\AppData\Local\Temp\Labels
Size 112KB
SHA256 d229e5bae4a97a88c9d647b3c5467b0d58f767119f43d5bff2bdcc77793490ae
MD5 196a79ba2d8b4ed70dda9ca087b081c6
SHA1 f653b7694386d195c466401a6b9e5c83c081f36f
SHA512 73789376acda9bd0839559322363f773a8e68b52f9d6c3d35e4cd030c4a7a5679849a8bcf4b2c74ef5dde4b473d921de04e16f273e8264fe942b0588a3b266ad
SSDEEP 3072:e3I09JwCIj4BPb1XuE/gc0Ag0Fuz08XvBN3vaAte:e3IW5Iuh0AOz04p1dw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nhs.wp5

Path C:\Users\Admin\AppData\Local\Temp\Nhs.wp5
Size 273KB
SHA256 b633515629a8672efa92f339d4110c366e4dae0bf24fe64d823f921a160c8049
MD5 92fd8dcc89353634fc6c3fc61c810ce9
SHA1 c80938a517f455c99063393469111ce134c15028
SHA512 017573c97e7696d5c6c3eed5624deb4c99674d71d3e247cb03321d9c4dea04790b640254f68cf41495dbc9fb34103e5e5af95a02e12edd42b06cfb092f193763
SSDEEP 6144:eX5U8BWVRGF8ToyT3oXRHIvdnuihPSGeRiXzoxNBW+1nvCQA:m5BWVRrTx8tIvxbQrRazoxNo+1KQA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Raleigh

Path C:\Users\Admin\AppData\Local\Temp\Raleigh
Size 143KB
SHA256 58b811f4ff3b3a472d8a2caf8efc2fbeaee0bdb8777b90f5a8b49f27528adf55
MD5 1d9bab936e9021c4f582b31250dda57d
SHA1 69ce16f89be76debb885ff9a7f0067835a1c34a1
SHA512 79afb2cc772f513881338b90758aca7d1d7022150809ed35cb919f151bc7d2b0998eaab162ff79043c7f89f57fe78f2fac7c15c8700f2e135c19077830b2fd96
SSDEEP 3072:W/CfXib+tSijpcVMFXD5ypAXoegz8StjOrOJI:MCf/1jpcuX0pAI8StQO2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Shit

Path C:\Users\Admin\AppData\Local\Temp\Shit
Size 122KB
SHA256 bed0754c0c5c5ca337f78490d353417fa633ed3effa2272ccc2a7416461b5e1b
MD5 2b2e19972b195eb9966f493a08362085
SHA1 acbe137052ce8a9493dba3c34f870e6c2fb336f8
SHA512 9b94478d69c998a7591f46a7496d3e451eb52b5ee953d10eec0eccd025ce90b5e380ee703e6caf804a45de11f6083696235a73bd660f1223cfcba4d3fd7cefbf
SSDEEP 1536:lbxY/jJHcUoNghHeqSkV4T2ubSWJKWNJELHW/EJlrZlYR+68cNk3smxUsb1yAwsq:AjJ8lghHzJi2ubSW4wC2mYR+HUDXOXO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sluts

Path C:\Users\Admin\AppData\Local\Temp\Sluts
Size 101KB
SHA256 6095ed8a6c91e5e368740ade40a6df6c579762f66aed65a5a99e8dfe00c4cd71
MD5 e21a0e3047f3f937dba7943b41c5394b
SHA1 7e071ddd5d421ba8842ca43541997babef12e7a8
SHA512 e495960ac1285c38f538320f6f5796d7cfa0d0390bdb82775d57bf3d565ac707bb44e6f84a7e501710f462274e73777977b9451c42c1c7ab15527bb786517a5b
SSDEEP 1536:Ch63EYrDWyu0uZo2+9Br+DATG62rt4dP+iX7DjfvSSuyxiQ:Ch6DWy4ZNor+D62rqd2iXbvSS7iQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Subscriber.wp5

Path C:\Users\Admin\AppData\Local\Temp\Subscriber.wp5
Size 10KB
SHA256 bbf7d94cef70ef3fb0b7f65c6c2129009d4ac22f2648cbe2e4d8e45eac7b5663
MD5 24513f81ded7ae5c36f6bd0b9358d45a
SHA1 4388aa29fab5e5b74297f434161109fc9d5533c5
SHA512 d46160aec3b2639dc51f813664359722b35069008ff9b473342b9fe594720a2bcb1e3bfe6c0c58172780b4637a53ab291efbce4c5430cf505fe96ef84c207cf5
SSDEEP 192:zrDYEADVfRlFs4R8jQurBj3ZRXjAaeCStCRUlTzm3Ad/nw8:zOnIO8jQmj3ZRcThtJTIn8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Trustees.wp5

Path C:\Users\Admin\AppData\Local\Temp\Trustees.wp5
Size 201KB
SHA256 58035267c5e6be06cba15a406b8b8d3a21cea58b867db08dbf98c662aa2ade9c
MD5 d235e8b0d886dd7aef636c81e9f10f5e
SHA1 ee222452626bd53f4e16afd3fa46d204ffecf156
SHA512 8eac00359101191991779c255794d0cf7477c0aab9778693627b7bb960a424b3769fcf24cdf41ea7161a7b636118c9d15872e37ece3c7eef7e3ef67effa20d33
SSDEEP 6144:yOB14A4uO+wSDRiJyxu2qU6gaxpUFVC0872Pcl:yC147uZwsRrWU6gmOVCJ72O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Universal.wp5

Path C:\Users\Admin\AppData\Local\Temp\Universal.wp5
Size 66KB
SHA256 2a637464de5ca5797cbad613eaaf03f4542a22d0704874b82e37db73df96b715
MD5 8151ce4ba7fabda446870064e874728a
SHA1 a44328ffe2fc2df4ca1238b7d816d08672f9bdf5
SHA512 a2381a231242de44b9608aaab287496d141ecfe05a8aa24bfab1d3c6d9ee19eafb0e688e52b15f139c399b8f558dfe085ea6162a8c84abc70e89dac6d9b6e460
SSDEEP 1536:O2st//cAPq/pdeuDlMh4jGerA0p8rUWvShJ2Vh/IyVUb:O2GxPApdeOJGOp8/qe7/Dw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Warned.wp5

Path C:\Users\Admin\AppData\Local\Temp\Warned.wp5
Size 492KB
SHA256 6ef3e509da049ce7402dfede199a6acba993925b29019f63b6ca014bb1f4d8f3
MD5 fe8c2d6652af0790a1722d9594ba47c7
SHA1 b2d02fa27470b539c3ae1a238aacd6f95ad9a554
SHA512 4c03ab71e27e749821a92e697c2071447df78c3854b9c1c816e49f6631b9d350c5f6cb87bfd2a586451b75dcf2c375ffacc5735625eb72a6f64368efb15484b8
SSDEEP 12288:NbJCqN409AX3UKCz4g7PrM8Q2W12jbmDAZj19jwiz+1iT0H:7C3DYw4hR1+iikT0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa7B9A.tmp\nsExec.dll
Size 6KB
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1136-59-0x0000000000AD0000-0x0000000000B2F000-memory.dmp

Download

memory/1136-61-0x0000000000AD0000-0x0000000000B2F000-memory.dmp

Download

memory/1136-60-0x0000000000AD0000-0x0000000000B2F000-memory.dmp

Download

memory/1136-63-0x0000000000AD0000-0x0000000000B2F000-memory.dmp

Download

memory/1136-62-0x0000000000AD0000-0x0000000000B2F000-memory.dmp

Download