lumma | 54138039e021c6c40952b557bf9e6268367126d6c5e6855e44cc946d55a3b65d

Analysis

max time kernel
103s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
13/09/2025, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 95.0MB
Sample250913-2vb36awks5
SHA256 54138039e021c6c40952b557bf9e6268367126d6c5e6855e44cc946d55a3b65d
MD5 391be6906d336f599a8abcfeb8cee549
SHA1 51c30ce4b0a01250e2ca92dfcd9f3f782d4e812a
SHA512 1340cc0ee460595ae84b496cb7ef0c13265e24046c822fbec6587c75441b55476d6baf2b832d11fe1314193e8be2fa37a5d5812f2dd22ee290b2ac3fdf8f6032
SSDEEP 24576:YVDRfVI5XGq46ASN1GwNQIBoD8f/ajQylkN8DrXPqncbUab:YhINGq4ZwGcoD8gtY8DrXy5ab
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery lumma spyware stealer

Malware Config

Extracted

Family

lumma

https://rhussois.su/tatr
https://lexenorf.org/zdhs
https://sirhirssg.su/xzde
https://prebwle.su/xazd
https://newflux75.xyz/xkzp
https://acrislegt.su/tazd
https://averiryvx.su/zadr
https://cerasatvf.su/qtpd

Attributes

build_id
a68f482418dcb0d63279ccfc5843052e76d2750e7079a4d7

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 1 IoCs

pid	Process
4324	Centres.pif

Loads dropped DLL 1 IoCs

pid	Process
5864	Setup.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
1676	tasklist.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\VegetableGi	Setup.exe
File opened for modification	C:\Windows\PmidMagnetic	Setup.exe
File opened for modification	C:\Windows\WidescreenScholarships	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Centres.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4324	Centres.pif
4324	Centres.pif
4324	Centres.pif
4324	Centres.pif
4324	Centres.pif
4324	Centres.pif
4324	Centres.pif
4324	Centres.pif
4324	Centres.pif
4324	Centres.pif
4324	Centres.pif
4324	Centres.pif
4324	Centres.pif
4324	Centres.pif
4324	Centres.pif
4324	Centres.pif
4324	Centres.pif
4324	Centres.pif

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1676	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4324	Centres.pif
4324	Centres.pif
4324	Centres.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4324	Centres.pif
4324	Centres.pif
4324	Centres.pif

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5864 wrote to memory of 4204	5864	Setup.exe	78
PID 5864 wrote to memory of 4204	5864	Setup.exe	78
PID 5864 wrote to memory of 4204	5864	Setup.exe	78
PID 4204 wrote to memory of 2004	4204	cmd.exe	80
PID 4204 wrote to memory of 2004	4204	cmd.exe	80
PID 4204 wrote to memory of 2004	4204	cmd.exe	80
PID 2004 wrote to memory of 1676	2004	cmd.exe	81
PID 2004 wrote to memory of 1676	2004	cmd.exe	81
PID 2004 wrote to memory of 1676	2004	cmd.exe	81
PID 2004 wrote to memory of 664	2004	cmd.exe	82
PID 2004 wrote to memory of 664	2004	cmd.exe	82
PID 2004 wrote to memory of 664	2004	cmd.exe	82
PID 2004 wrote to memory of 5684	2004	cmd.exe	84
PID 2004 wrote to memory of 5684	2004	cmd.exe	84
PID 2004 wrote to memory of 5684	2004	cmd.exe	84
PID 2004 wrote to memory of 4924	2004	cmd.exe	85
PID 2004 wrote to memory of 4924	2004	cmd.exe	85
PID 2004 wrote to memory of 4924	2004	cmd.exe	85
PID 2004 wrote to memory of 4324	2004	cmd.exe	86
PID 2004 wrote to memory of 4324	2004	cmd.exe	86
PID 2004 wrote to memory of 4324	2004	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd < Dennis.gif
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1676
  - - C:\Windows\SysWOW64\findstr.exe
      findstr "SophosHealth nsWscSvc ekrn bdservicehost AvastUI AVGUI & if not errorlevel 1 Set zvVUJHiGbvwoDIZXMdUJBbL=AutoIt3.exe & Set rZpVfySXLUitSPkRqeaPvodhJtU=.a3x & Set erVWNVqSJLmO=300
      4⤵
      System Location Discovery: System Language Discovery
      PID:664
  - - C:\Windows\SysWOW64\extrac32.exe
      extrac32 /Y Mars.gif *.*
      4⤵
      System Location Discovery: System Language Discovery
      PID:5684
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "OPINION" Korea
      4⤵
      System Location Discovery: System Language Discovery
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\24103\Centres.pif
      Centres.pif N
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Centres.pif

Path C:\Users\Admin\AppData\Local\Temp\24103\Centres.pif
Size 957KB
SHA256 3ec9740bedc683021cc3e94e4a33b3a9d3d6f9b9e96b1f04cc6534f551dd58c1
MD5 f589c1095824c52a5ed3625d0d851b22
SHA1 2eac026b394548268cc8ee783de99c88cfb1e408
SHA512 f47f3bf4930191eb0d01b1a1bd737ccbe368266c99d5ee1c22d7db49125d7b3ca0685fb2c057f891e9240d215ddb96209db2e971c640592e1d487e794cc93e46
SSDEEP 24576:hMd+PsPy8Fv7yw56uX4Nw1ImcY3a2hrbBz:hzPsPy8Yw5EN62srb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\24103\N
Size 515KB
SHA256 ca01a5d969c5828c347d38c5412027d30c330d8a1ef67ac790f4b1e58a6b0bf6
MD5 dfae9302d31a7323bb5b9e013b285e7a
SHA1 146f90b4a1652cdec643e337b701bd80a61057d8
SHA512 f56691cfc720f8ee093e6c9813e1ed1e95df99770d8e93f1e886492174f5db3d2d3fe27e995b43416820bf555e338c8dbb8662cd33168a959e9953d77cdc84d8
SSDEEP 12288:FCsUBfFQX5wyXKFnxoJZbk3sYAykncKXG2u5gkzZM3W:FCsU3qrXQnQZbiCpHXGAgyW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aquarium.gif

Path C:\Users\Admin\AppData\Local\Temp\Aquarium.gif
Size 293KB
SHA256 83604a0fd0dc8ce53e3b80a21ff13d25e92795e774f6afe0ed8622496ee9fe7d
MD5 142db06b2d4d100bb59ff871eb5388d5
SHA1 2ef25d91237caca01882c2e55feb748efde344c0
SHA512 e046aea173fbe17c2905f89715746630a21e7fe5c772ffba24d85833c0fdfce0a358c7572f7ff20a075d2f2342a44d7150d0ded39ea360e2c35d9e5d160dae57
SSDEEP 6144:R3CkkGUZrPj+3krgSkCDphb8X5w9gcGA1FTANgvqooJFegL2hQFG3y:FCsUBfFQX5wyXKFnxoJZbk3y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Butts.gif

Path C:\Users\Admin\AppData\Local\Temp\Butts.gif
Size 28KB
SHA256 d4596086338e0eceb262c4d483d615becd9619138891c59e9351f394d695dd8c
MD5 06c3937e4f7873ac9007a7a3bc9a4538
SHA1 18ceefcd8acfad11cbcfe5425f5cdae7b88dc3c9
SHA512 81349297c3d332ada0ae4778116f020ec1dacd064dbd05a81e1afd1e85bdd886d4df8e154896d14de1aba1ac06d24c51a3812ef6f2a2de578c79e9d227dda412
SSDEEP 768:Z2znxCE+Nq9KEpDBn347SCO4ELRSOBut2sI4W:ozn3+0PpRCpO4X7t2QW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Crash

Path C:\Users\Admin\AppData\Local\Temp\Crash
Size 96KB
SHA256 0a1baa1182cb7b312a7189f781f3e575d656485a3c6777b74076445960d376cc
MD5 01de375fe28909c883b4dc003210a3db
SHA1 9ad1ca13e61709e338839c77e71a5d1d5e015180
SHA512 343b22e42f481738dc176159f65068986f27db54f7ce6f5560037812db6d578a1917fe09112ae7ddc08951db635151dee9f223b7bb396423db8bc54411ee6751
SSDEEP 1536:c63EYrDWyu0uZo2+9Br+DATG62rt4dP+iX7DjfvSSuyxiQ:c6DWy4ZNor+D62rqd2iXbvSS7iQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dennis.gif

Path C:\Users\Admin\AppData\Local\Temp\Dennis.gif
Size 19KB
SHA256 46ab0ebfa850e42c792b673956ac5ed5536ef92a26c95eb4bbdc0dd8f9198f48
MD5 88cd64b32ad0c5f605e9910758ff2f54
SHA1 85fd64649e5a34601adb36aec02c005afb091865
SHA512 47cf221ffdf43e6c84c8735b009ce66c11a11ce5583eb30aa5ff685a9d8c76979c44e085a62c17a6b10888dc1eff09017f811e8a760f5aa8e3862a1f30cd8f08
SSDEEP 384:l7s74bPAsBJmWLTwNiu+vnJyJywbzAm3bZh+o6rlcf4M:jJmWm+srzLGyl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gap

Path C:\Users\Admin\AppData\Local\Temp\Gap
Size 89KB
SHA256 f89c3f730d96e73cdb9248421b2958477ee0b2366d5e6180c4789d269dcc7ffb
MD5 99b4ac069f3935112ff41635541f157a
SHA1 c6bc2bcb5aec82a65fd747a2f2bad85da94fe8b5
SHA512 4686768552eb7d5362e283ff3a3793754ce4b50168b49bc65e901b9b5b664779179cb6e6981703d9aa04aceb357e389b129e05b36712554f8cb12cf7b844e958
SSDEEP 1536:KJaGloaj6bs8jcd/TcI3s+uXkrfhrRj3o:Oam6OzmkrJrRj4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gps

Path C:\Users\Admin\AppData\Local\Temp\Gps
Size 71KB
SHA256 6b669e5b94e31c2d9488bfb7f2be13a205c40bd407d0b6fc7d1e04e65a90de54
MD5 90e8342b08acaf85812df9a3fe203374
SHA1 c19b2c694a28853782fe2b04e5d481ffd659565c
SHA512 b87371796b6aef38ea9e7cb748e5770fe8e891bbf0b985b967384ec406d1de4d1e9c29a8cc736240be400f893be412f4d0f92bcffef2ce444e7831d60f4eed2e
SSDEEP 1536:J8JsdVCsESNvmtpAi6JvAeInT3VCLIsLS4:JFXD5ypAXoegz8S4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Human

Path C:\Users\Admin\AppData\Local\Temp\Human
Size 144KB
SHA256 6b1b1865875c7d568e9613961be8f08f4f5b4dba78707117b3a9b448fbf29c15
MD5 13623e515c9abd6ec5a0fe964f318208
SHA1 e26ef4d75f82e440974998646ed441506530887a
SHA512 1465c706d1fbc356caa329f024d4b12b15ac7e91c7908980427fbeb143512c31d9450b672a8586c8ee3a82b1aeeac562222e4b71054350511cc9b95d32a7e9f2
SSDEEP 3072:UjOrOJGGMBwvqXQGYlawwBonasL9jC0O2iSW4QlXUxPrCtTRVB4Y3I09Jwf:UQOAGlXuww8x1WUyB4Y3IWO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Indexed

Path C:\Users\Admin\AppData\Local\Temp\Indexed
Size 104KB
SHA256 a0d1c441bacfb8098539d8e6e6993886d32957e179aab3e1488676b877e17977
MD5 4f6479004fb7d3823ea56f4474e5c70d
SHA1 c570fa2956271f96bba7d90c99fafcb41ebcc252
SHA512 d1859bf15d6f21854eb9f859e05037a761e5c197725faeeab4aff49a8d3cef82669bdd4b6e2ae234e7c59851ba7512472fac83ba61d1bb912d6bd688f6511661
SSDEEP 1536:1t0YwYwTkNJ3Rpref3ghV1SKOxqNdunCMfpfpJKgMPdkdux84SbL8R571Nf0xP:MeVzOqD1IGuTpMgKYbwR5ExP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Korea

Path C:\Users\Admin\AppData\Local\Temp\Korea
Size 1KB
SHA256 aca1cda044d4c4bf1b4079ed5118579800a6744a70f7f150ca72d38e35910a70
MD5 ca7285e487d141180bb640f46db84d0c
SHA1 61ea617a8f5ef4804bc84bc0b4f225aa3a209338
SHA512 94e2004b36183ecdfb79f441c948a9ae3264c977f1a781b92773ffd34cba86f5293fc02dc6abaf0a360d1e1872c909240a212421091133e5b1e7c461f36fd7aa
MD5 SHA1 SHA512

Submit Download

Looks

Path C:\Users\Admin\AppData\Local\Temp\Looks
Size 120KB
SHA256 bc4af999515b76729cbdeaa435e23bf3888f9bb48d6c0de599172817a8888a63
MD5 4a7c7a605213d4de390c2da4d8f22c72
SHA1 1a08abedfbfb97f1f355c4439df7ee4ffb1af2c0
SHA512 e99e7f28eebb7c23ac0de4e96bffee5299ca4b7d8717c26cb456eafba425f6eb571c264412ef8f0240ee2dd75502827553017162afade663dc691ded075a112c
SSDEEP 1536:HYR+68cNk3smxUsb1yAwsc8MxqVbD61HOyU/CX2CdXibOT0EdQGQ9EtSijtNOKcw:HYR+HUDXOXT/CfXib+tSijpcVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mars.gif

Path C:\Users\Admin\AppData\Local\Temp\Mars.gif
Size 493KB
SHA256 6087a254155d4e075a50462ef9959e6f0d786d904feafda35e49aa27972f6f54
MD5 3dd611e6a445645e4132a482cf0c27ca
SHA1 761fec85e5e6a38004fc8ce21f46fcc2bcd038c1
SHA512 3d610351cbcb4856627777ba8cfe6d03969402898b16c5f361b1d9ebd24a844126e5dfec58cfedefe55fab69e2c2e3c4bc3edba73cd83d2ae24e3d53e3721462
SSDEEP 12288:rOsoRSQr6Yx1lWcFYVZDFBG7UD3MWZojY:fKSq6Y/zEFBtD8rjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Planet

Path C:\Users\Admin\AppData\Local\Temp\Planet
Size 84KB
SHA256 b0ea1c83820a8442dbf2d6f1dee71098e770f18aed070f3c31c767f8e4e93c9f
MD5 da662df239e5cb72245cfada772c5382
SHA1 8a3a5624f40106b860db5c96275497673445dbda
SHA512 11fc25538a225933926a7855fe61d56565b5985e99b4372a2fe119a2e53b3e91a12c9185c0aec6cea785983154126b078dc091c53ffe196aa0c10de15466a9a3
SSDEEP 1536:vCIj4BZKaTb1nXu4uuVGHj1vtKsevk+goJqvtmgMbFuz08QuklMBNIWr:aIj4BPb1XuE/gc0Ag0Fuz08XvBN3r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Premiere

Path C:\Users\Admin\AppData\Local\Temp\Premiere
Size 118KB
SHA256 ef96ed2a9c296f41d43d022d1eccfadc10c93b801f1653bf70c7be43139eb27b
MD5 5765d3fe9f5d24622bc9578d9c71ea5f
SHA1 ef6fb66d66978bd9037830e156986c3ecb4837d3
SHA512 bf105060067451510d43e1aef845ce8aa9640e3a12c7ae17780ca0ecdca48aad1f441c44cbe059c1e9d4ce7766be2388107dca33c207aa85a2b396a0f8af8f56
SSDEEP 3072:m2/RTX/4gxRuNkdKF0vYNyet+JQ+HcnkL8xCSVYvlhx6vA3I:R/RTggXuN2KFIyt+8ZUlhxb4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Studios

Path C:\Users\Admin\AppData\Local\Temp\Studios
Size 51KB
SHA256 dd3058342fc254d9765066987fbe2703a414c36808ce580bb91f03f9c5642d41
MD5 922b0e72e72996ac0efe6147a69b36b0
SHA1 2ca12b0a7b12df50b3a5709653bed92885439a6d
SHA512 9effd6c58056698ddd69689c5992ae38c8b26dbf9b3ba3e060ee201ac5b2848285e5dced75387f2de5d505f791a41910bfbe717aa6ae5e18f5819d7dff0e7acb
SSDEEP 384:zupi09PrOa3HwwuBceiWjc/mwftIQXoSpu888888888888888888888888888882:zupxhSaAwu+2c/mex/s
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tables.gif

Path C:\Users\Admin\AppData\Local\Temp\Tables.gif
Size 194KB
SHA256 7a819eafe2c6b6be29a0e985859e1bd106980a854a2f5026e1dc203b8758fcb9
MD5 95b5cbdeb958f692c092478a5f12a078
SHA1 4b3c2d465074304a8961c70785fd81189a1fd2d1
SHA512 0da9b70106eed38d5a2005a2acdf387348bd4f9d69a5ab5e653724eaeadab131309618621f304c91acbc15eea34758c5ae1a91543e33d155890943016419059a
SSDEEP 3072:BLE4ZZYvocOAYzcG/EGN49Xn4ncE1CytGNI/2ktyL23nG0ugcATknzof:iUYvAiPj4ncKXGNI/2YcmGLOTkzof
MD5 SHA1 SHA512 SSDEEP

Submit Download

Timer

Path C:\Users\Admin\AppData\Local\Temp\Timer
Size 78KB
SHA256 9bc25a55f8bf66947e6dc7be41667b072a753048af22671e03406dce716b3557
MD5 3a1e81f992a067913c48faaf6625b29c
SHA1 71448d6db8a86bd02e048d9124b61741257154bf
SHA512 1b3a056253b9be53806e4f52a396cbcc11f6eb9ad4496c8f36d589756620f4c5f22f2ffc670edf86be3ede776c87afcbf61a904d520e40fb5894714266ba291b
SSDEEP 1536:RHDS661CZxbxY/jJHcUoNghHeqSkV4T2ubSWJKWNJELHW/EJlrZ5:xD8jjJ8lghHzJi2ubSW4wC2U
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7409.tmp\nsExec.dll
Size 6KB
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4324-71-0x00000000049F0000-0x0000000004A51000-memory.dmp

Download

memory/4324-70-0x00000000049F0000-0x0000000004A51000-memory.dmp

Download

memory/4324-72-0x00000000049F0000-0x0000000004A51000-memory.dmp

Download

memory/4324-74-0x00000000049F0000-0x0000000004A51000-memory.dmp

Download

memory/4324-73-0x00000000049F0000-0x0000000004A51000-memory.dmp

Download