Overview

overview

8

Static

static

3

LuaTools-w...up.exe

windows10-2004-x64

7

LuaTools-w...up.exe

windows11-ltsc_2024-x64

8

Analysis

  • geolocation tags

    asiadelhiinindia
  • max time kernel
    900s
  • max time network
    536s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/07/2026, 10:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    LuaTools-win-Setup.exe
  • Size 11.0MB
  • Sample260717-mx91msds2z
  • SHA256 c66586a7a7cd18f4804a8273cfa7987050344e70c599ce75a4c9c67ce422f92d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 45 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\LuaTools-win-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\LuaTools-win-Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe
      "C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe" --veloapp-install 1.2.5
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4204
    • C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe
      "C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe"
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:3928
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:5800
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4532
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:5184
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4056
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4040
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:1124

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            CommunityToolkit.Mvvm.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\CommunityToolkit.Mvvm.dll
            • Size 143KB
            • SHA256 19b2144fed9600d58a742a5a4a5fd7b10d4d0d2c2e79f5d8019307cf5657044f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LuaTools.deps.json
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.deps.json
            • Size 36KB
            • SHA256 37902fa9097bee14b2db7a5741b110d3c8a34372ba592cb725884af84a516f60
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LuaTools.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.dll
            • Size 922KB
            • SHA256 510cd340bf44c328c8d86a99dfc6e465ad6a43b328fd56e3f85812358d143f73
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LuaTools.exe
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe
            • Size 254KB
            • SHA256 d3d142cddc3775b74d685cc9a00697fb1fe718cdc5316d98b06c7bc43292febd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LuaTools.runtimeconfig.json
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.runtimeconfig.json
            • Size 496B
            • SHA256 b7ab6a0ad18cf1280ad75c8e6d0df62d06c84d62dc69351e49c04afd3e218eb2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft.Extensions.Configuration.Abstractions.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.Abstractions.dll
            • Size 26KB
            • SHA256 3700bf75d75ceef47ebd6df7df9bafb9f7b7dcf22fc537f227db72ccf74c476d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Configuration.Binder.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.Binder.dll
            • Size 41KB
            • SHA256 efc13893ebfa02cc7e49ac13cfef68517c4441a33210d67956e7488b8e6b277d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Configuration.CommandLine.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.CommandLine.dll
            • Size 23KB
            • SHA256 a1c8c9728b0dc64dcd975f82d013a1b7bc0c0133e46a94f29044f16cad6072b6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Configuration.EnvironmentVariables.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.EnvironmentVariables.dll
            • Size 21KB
            • SHA256 bbb26aacd4ba67351d3740106bbcc5544827d98d91b48109362988147ae7963e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Configuration.FileExtensions.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.FileExtensions.dll
            • Size 26KB
            • SHA256 1830c601c1b155c54fbd3a6844453dae87af14eafe763942939d06905035130f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Configuration.Json.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.Json.dll
            • Size 25KB
            • SHA256 e106f8bc13df7168294b95a6cdbceaba47b8eb7e562940eb4ef038db6fb1f2d0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Configuration.UserSecrets.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.UserSecrets.dll
            • Size 24KB
            • SHA256 a310bcdd868dafc0efce5b03a68cd7af5d4fa0d06509ed4b5c51ddc1758e9791
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Configuration.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.dll
            • Size 42KB
            • SHA256 7a883c57d00808ca9b5d11bfaa2c5d21f714ed7560e781d7313d65b09b88b6c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.DependencyInjection.Abstractions.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.DependencyInjection.Abstractions.dll
            • Size 63KB
            • SHA256 c2a34d5259e6d6c0af43d9b926454105e80e7657dfed901d845100db254de89b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.DependencyInjection.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.DependencyInjection.dll
            • Size 92KB
            • SHA256 4d7fb7b6a171047984a8316b1a355c65e33350c343f4e0ea2f1233be457eb7e5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Diagnostics.Abstractions.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Diagnostics.Abstractions.dll
            • Size 29KB
            • SHA256 0a9e51f2d4861367908fa058da82b4a0deb6f85f6ba11d3c90b01c848b1fcdac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Diagnostics.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Diagnostics.dll
            • Size 34KB
            • SHA256 0842e20c25240aca53809e005776eb88f53a61128c632c4c6fa8685b9f66c4b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.FileProviders.Abstractions.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.FileProviders.Abstractions.dll
            • Size 21KB
            • SHA256 02f38beb848fa01fcc55f0cf3982ca01e1a5aeba95933131a197ef602a130763
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.FileProviders.Physical.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.FileProviders.Physical.dll
            • Size 43KB
            • SHA256 e6073f96262a3c468c5024564fa02df0f36234242b392c8b658b81bb1b9d968a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.FileSystemGlobbing.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.FileSystemGlobbing.dll
            • Size 45KB
            • SHA256 965a5347b125d232361dd08027ab263ed1d042b0240ec4a4f29b7a0bfd74bb28
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Hosting.Abstractions.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Hosting.Abstractions.dll
            • Size 51KB
            • SHA256 57c2528e1f2b3872976661686af9bcbd0612de7ee6b4ef4cfe92b746b27aa1b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Hosting.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Hosting.dll
            • Size 69KB
            • SHA256 ca135e4b48abc2effdb6fdf085837966c35f3a8a305744429009dde946d633c8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Logging.Abstractions.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Abstractions.dll
            • Size 64KB
            • SHA256 4ad4a3b2bed7f5f293f83cc2c46169b93a9863b89428f693a4f17863704f47aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Logging.Configuration.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Configuration.dll
            • Size 26KB
            • SHA256 ed0a70f939dc8779ee85802e926f138e284828ac14d44831ca68fdcd14450b5b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Logging.Console.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Console.dll
            • Size 73KB
            • SHA256 84ca5528a45074f18ae4234956de55d238a65be39f914f88293732dfd3889a35
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Logging.Debug.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Debug.dll
            • Size 19KB
            • SHA256 ec47584ec7344dbe9b3ec5740cf493a8dbf346e467d6855e24be33555db11983
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Logging.EventLog.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.EventLog.dll
            • Size 24KB
            • SHA256 f70b8392447817a4d44acd5785e0bc029a2844d5445e05b98d95b237443339db
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Logging.EventSource.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.EventSource.dll
            • Size 33KB
            • SHA256 665d5316f601ed6dd9daa6d7534610ca3a7aa40e4d117c079ffb118ea2179b2d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Logging.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.dll
            • Size 49KB
            • SHA256 48bd4a0d323e0ae85fa0469779bb13e92c4600b0a49dad6bcb891047c5e17caf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Options.ConfigurationExtensions.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Options.ConfigurationExtensions.dll
            • Size 21KB
            • SHA256 3057894505e37852ac77ba70007a6b075980be4da9c3afcdb7a37e62750bda1b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Options.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Options.dll
            • Size 62KB
            • SHA256 4e767f3c0bf37199a83b8697fc9431d907fe39b5f2763f83381865c89ea6545d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Primitives.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Primitives.dll
            • Size 42KB
            • SHA256 b5e8630df19605fec639873b86bdff6f9d424db88d181bb36a0bd641558c18ca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Diagnostics.DiagnosticSource.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Diagnostics.DiagnosticSource.dll
            • Size 187KB
            • SHA256 d28e247dc8b6af02968b65fe6aae25c2ee689d2007268375d63347aeac0bea6b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.IO.Pipelines.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\System.IO.Pipelines.dll
            • Size 75KB
            • SHA256 a3c80d0bb52e0f5afc73638cfe5dc25e3470e5fdc0311745aebc8a4d4cfcba35
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Security.Cryptography.ProtectedData.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Security.Cryptography.ProtectedData.dll
            • Size 37KB
            • SHA256 ce7f4b80de12f227ac637915470c5b6b6a5d716456835caaa0b1600c3cbdcb6c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Text.Encodings.Web.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Text.Encodings.Web.dll
            • Size 64KB
            • SHA256 8839f3cdeabd22f5952c4673367ea41c921aeb0ea26e18fb23906e2cac08298b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Text.Json.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Text.Json.dll
            • Size 660KB
            • SHA256 bb53577c13ab01f397585e4bb642a1a89f1af91b70eb385c7c05b82b9b912605
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Velopack.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Velopack.dll
            • Size 261KB
            • SHA256 b35698f5f66978d7bfd0ab12a2a2899f05912d9a1890d5e64c2dce9bacf2662f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Wpf.Ui.Abstractions.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Wpf.Ui.Abstractions.dll
            • Size 7KB
            • SHA256 f504e30e37a74936ac14f14de4ac43c291cb3964eda71cdcdd61f27cf15cb9cf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Wpf.Ui.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\Wpf.Ui.dll
            • Size 6.3MB
            • SHA256 3466432f74d1d1224a55f71b8dec7b2913039e01ee32b7304fd9668fb76b797d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Diagnostics.EventLog.dll
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\runtimes\win\lib\net8.0\System.Diagnostics.EventLog.dll
            • Size 171KB
            • SHA256 59fb8f95e34b4dbc41422e801ca9456da5ab70508d773e42e2ce1c60de38a88f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sq.version
            • Path C:\Users\Admin\AppData\Local\LuaTools\current\sq.version
            • Size 534B
            • SHA256 5b5692647635d67dbb98804245d0ad6b5ffa4ca1e54616250c5b2426694891eb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            LuaTools-1.2.5-full.nupkg
            • Path C:\Users\Admin\AppData\Local\LuaTools\packages\LuaTools-1.2.5-full.nupkg
            • Size 6.6MB
            • SHA256 e584e5620f7a8e806e08199582b33f1e21eebbe96f68a421bf044eb99cd80823
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 595B
            • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            velopack_LuaTools.log
            • Path C:\Users\Admin\AppData\Local\velopack\velopack_LuaTools.log
            • Size 871B
            • SHA256 bfd4cf97d3dccd995e62bbb9413ca6fc91d1ed3b26e09b85f98d5eef3e495a53
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            LuaTools.lnk
            • Path C:\Users\Admin\Desktop\LuaTools.lnk
            • Size 2KB
            • SHA256 64dbec851c6bdf37994e2cf1e1c85722c84c4850dc8d3bf24db348114f5db43e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/4056-168-0x000001BF04210000-0x000001BF04230000-memory.dmp
            Download

            memory/4056-197-0x000001BF14790000-0x000001BF147B0000-memory.dmp
            Download

            memory/4056-142-0x000001BF001E0000-0x000001BF002E0000-memory.dmp
            Download

            memory/4056-141-0x000001BF001E0000-0x000001BF002E0000-memory.dmp
            Download

            memory/4056-160-0x000001BF14410000-0x000001BF14510000-memory.dmp
            Download

            memory/4056-143-0x000001BF001E0000-0x000001BF002E0000-memory.dmp
            Download

            memory/4056-158-0x000001BF02FB0000-0x000001BF02FD0000-memory.dmp
            Download

            memory/5184-334-0x000000000F7F0000-0x000000000F870000-memory.dmp
            Download