umbral | 28d78a8495ec4cb28c99572757058c74410c125e823ed9619ec6a7d54e34443d

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-19_45077556cb729da6ab48ac4fe44f97ba_glassworm_icedid_luca-stealer_njrat_stealc_xworm.exe
Size 5.3MB
Sample260920-dbccta1ame
SHA256 28d78a8495ec4cb28c99572757058c74410c125e823ed9619ec6a7d54e34443d
MD5 45077556cb729da6ab48ac4fe44f97ba
SHA1 15e58fe8bad90e0a3a757590a6f817549de6b6ab
SHA512 780986f039cd9dc2968426e5e96b18a23feb664c4a97f119e3cc489669a4b1b1d32f0ff1cd6e1f45a2e60fce646e75b0eea36576183c8b19e60412a3c08af69c
SSDEEP 49152:sssV/ut+pzwwk6Sf5cTXh8hMwSS5MhpCVjiVKr7emKa9z7wjsXCbftLGYVomqw6M:ecklljCVjY/Oz7wP7BGmqLQ9J1oPr09f
TLSH
T15E46BF5AE7A449A9C0B3C0FD45169423EB7238861335E6EB52F0C956EFA76D02E3D370
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery umbral xbinder loader stealer

Malware Config

Extracted

Family

xbinder

Mutex

9fXsu09FUS3eN3ntZ

Attributes

primary_drop_directory
%Temp%
primary_execute
true
primary_hidden_file
false
primary_resource_name
BatToExeConverter.exe
secondary_drop_directory
%Temp%
secondary_execute
true
secondary_hidden_file
false
secondary_resource_name
Umbral.exe

Extracted

Family

umbral

Version

v1.3

https://discord.com/api/webhooks/1538904578609909802/kaH1CRLZvvL2KuC4_udj7RYOxhugONV1um7XAVTtJj2Y1j1tuuDRTYfBKIJbVa7AlWxd

Signatures

Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral
Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
loader xbinder

Detects Umbral payload 4 IoCs

resource	yara_rule
behavioral2/files/0x001200000001c39b-27.dat	family_umbral
behavioral2/files/0x001200000001c39b-27.dat	family_umbral_obfuscated
behavioral2/memory/2776-31-0x000001D5185C0000-0x000001D518600000-memory.dmp	family_umbral
behavioral2/memory/2776-31-0x000001D5185C0000-0x000001D518600000-memory.dmp	family_umbral_obfuscated

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000016d03-18.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects binaries and memory artifacts referencing sandbox product IDs 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000016d03-18.dat	INDICATOR_SUSPICIOUS_EXE_SandboxProductID

Detects executables attemping to enumerate video devices using WMI 2 IoCs

resource	yara_rule
behavioral2/files/0x001200000001c39b-27.dat	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
behavioral2/memory/2776-31-0x000001D5185C0000-0x000001D518600000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice

Detects executables containing possible sandbox analysis VM names 2 IoCs

resource	yara_rule
behavioral2/files/0x001200000001c39b-27.dat	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames
behavioral2/memory/2776-31-0x000001D5185C0000-0x000001D518600000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames

Detects executables containing possible sandbox analysis VM usernames 2 IoCs

resource	yara_rule
behavioral2/files/0x001200000001c39b-27.dat	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral2/memory/2776-31-0x000001D5185C0000-0x000001D518600000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Detects executables containing possible sandbox system UUIDs 2 IoCs

resource	yara_rule
behavioral2/files/0x001200000001c39b-27.dat	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs
behavioral2/memory/2776-31-0x000001D5185C0000-0x000001D518600000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs

Executes dropped EXE 4 IoCs

pid	Process
1148	bndFD47.tmp.exe
988	BatToExeConverter.exe
2776	Umbral.exe
1732	bndAB4.tmp.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

ioc	Process
\??\VBoxMiniRdrDN	2026-09-19_45077556cb729da6ab48ac4fe44f97ba_glassworm_icedid_luca-stealer_njrat_stealc_xworm.exe
\??\VBoxMiniRdrDN	BatToExeConverter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-09-19_45077556cb729da6ab48ac4fe44f97ba_glassworm_icedid_luca-stealer_njrat_stealc_xworm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-09-19_45077556cb729da6ab48ac4fe44f97ba_glassworm_icedid_luca-stealer_njrat_stealc_xworm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-09-19_45077556cb729da6ab48ac4fe44f97ba_glassworm_icedid_luca-stealer_njrat_stealc_xworm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	BatToExeConverter.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	BatToExeConverter.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	BatToExeConverter.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Control Panel\Colors	bndAB4.tmp.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings	bndAB4.tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	bndAB4.tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	bndAB4.tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	bndAB4.tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	bndAB4.tmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	bndAB4.tmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	bndAB4.tmp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	bndAB4.tmp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	bndAB4.tmp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	bndAB4.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	bndAB4.tmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	bndAB4.tmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	bndAB4.tmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	bndAB4.tmp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	bndAB4.tmp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	bndAB4.tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	bndAB4.tmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	bndAB4.tmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	bndAB4.tmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	bndAB4.tmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	bndAB4.tmp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	bndAB4.tmp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	bndAB4.tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	bndAB4.tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\NotificationData	bndAB4.tmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	bndAB4.tmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	bndAB4.tmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	bndAB4.tmp.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2388	wmic.exe
2388	wmic.exe
2388	wmic.exe
2388	wmic.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	4544	2026-09-19_45077556cb729da6ab48ac4fe44f97ba_glassworm_icedid_luca-stealer_njrat_stealc_xworm.exe
Token: SeDebugPrivilege	2776	Umbral.exe
Token: SeSystemEnvironmentPrivilege	988	BatToExeConverter.exe
Token: SeIncreaseQuotaPrivilege	2388	wmic.exe
Token: SeSecurityPrivilege	2388	wmic.exe
Token: SeTakeOwnershipPrivilege	2388	wmic.exe
Token: SeLoadDriverPrivilege	2388	wmic.exe
Token: SeSystemProfilePrivilege	2388	wmic.exe
Token: SeSystemtimePrivilege	2388	wmic.exe
Token: SeProfSingleProcessPrivilege	2388	wmic.exe
Token: SeIncBasePriorityPrivilege	2388	wmic.exe
Token: SeCreatePagefilePrivilege	2388	wmic.exe
Token: SeBackupPrivilege	2388	wmic.exe
Token: SeRestorePrivilege	2388	wmic.exe
Token: SeShutdownPrivilege	2388	wmic.exe
Token: SeDebugPrivilege	2388	wmic.exe
Token: SeSystemEnvironmentPrivilege	2388	wmic.exe
Token: SeRemoteShutdownPrivilege	2388	wmic.exe
Token: SeUndockPrivilege	2388	wmic.exe
Token: SeManageVolumePrivilege	2388	wmic.exe
Token: 33	2388	wmic.exe
Token: 34	2388	wmic.exe
Token: 35	2388	wmic.exe
Token: 36	2388	wmic.exe
Token: SeIncreaseQuotaPrivilege	2388	wmic.exe
Token: SeSecurityPrivilege	2388	wmic.exe
Token: SeTakeOwnershipPrivilege	2388	wmic.exe
Token: SeLoadDriverPrivilege	2388	wmic.exe
Token: SeSystemProfilePrivilege	2388	wmic.exe
Token: SeSystemtimePrivilege	2388	wmic.exe
Token: SeProfSingleProcessPrivilege	2388	wmic.exe
Token: SeIncBasePriorityPrivilege	2388	wmic.exe
Token: SeCreatePagefilePrivilege	2388	wmic.exe
Token: SeBackupPrivilege	2388	wmic.exe
Token: SeRestorePrivilege	2388	wmic.exe
Token: SeShutdownPrivilege	2388	wmic.exe
Token: SeDebugPrivilege	2388	wmic.exe
Token: SeSystemEnvironmentPrivilege	2388	wmic.exe
Token: SeRemoteShutdownPrivilege	2388	wmic.exe
Token: SeUndockPrivilege	2388	wmic.exe
Token: SeManageVolumePrivilege	2388	wmic.exe
Token: 33	2388	wmic.exe
Token: 34	2388	wmic.exe
Token: 35	2388	wmic.exe
Token: 36	2388	wmic.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1732	bndAB4.tmp.exe
1732	bndAB4.tmp.exe
1732	bndAB4.tmp.exe
1732	bndAB4.tmp.exe
1732	bndAB4.tmp.exe
1732	bndAB4.tmp.exe
1732	bndAB4.tmp.exe
1732	bndAB4.tmp.exe
1732	bndAB4.tmp.exe
1732	bndAB4.tmp.exe
1732	bndAB4.tmp.exe
1732	bndAB4.tmp.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 1148	4544	2026-09-19_45077556cb729da6ab48ac4fe44f97ba_glassworm_icedid_luca-stealer_njrat_stealc_xworm.exe	89
PID 1148 wrote to memory of 988	1148	bndFD47.tmp.exe	90
PID 1148 wrote to memory of 2776	1148	bndFD47.tmp.exe	91
PID 988 wrote to memory of 1732	988	BatToExeConverter.exe	92
PID 2776 wrote to memory of 2388	2776	Umbral.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-09-19_45077556cb729da6ab48ac4fe44f97ba_glassworm_icedid_luca-stealer_njrat_stealc_xworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-19_45077556cb729da6ab48ac4fe44f97ba_glassworm_icedid_luca-stealer_njrat_stealc_xworm.exe"
1⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\AppData\Local\Temp\bndFD47.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\bndFD47.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Users\Admin\AppData\Local\Temp\BatToExeConverter.exe
    "C:\Users\Admin\AppData\Local\Temp\BatToExeConverter.exe"
    3⤵
    - Executes dropped EXE
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Users\Admin\AppData\Local\Temp\bndAB4.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\bndAB4.tmp.exe"
      4⤵
      Executes dropped EXE
      Modifies Control Panel
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:1732
- - C:\Users\Admin\AppData\Local\Temp\Umbral.exe
    "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BatToExeConverter.exe

Path C:\Users\Admin\AppData\Local\Temp\BatToExeConverter.exe
Size 3.6MB
SHA256 a2d7a1431866ac46e29f0b9baed2bc76708f789e5e7ecb6be52f1dd536ccf3c0
MD5 17badbd4502c68dd16f1681cd5a8180b
SHA1 c75baa36e28a93e8283f8151cebb245999f899f6
SHA512 5fa3141cb9ddb018f7fce5d3157860d992b953003ddae3631a40b609743e3628dff6d549df3599bda0c90d31f85a8868812f2d42c6eb94cc48beaa4dd940b43c
SSDEEP 49152:hssV/ut+pzwwk6Sf5cTXh8hMwSS5MhpCVjiVKr7Tk/kR:FcklljCVjYa
TLSH
T136065A5AABA84DA9C0B3C0F94516D433E77238821325D6E756F0C957FEE66D02E3E270
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Umbral.exe

Path C:\Users\Admin\AppData\Local\Temp\Umbral.exe
Size 229KB
SHA256 9225ea58f66a6da909e620e3d97080bc3c0d146ab80e3589b032cc7275445289
MD5 4ee4a5e25633b2ed4ac568c5fb87b2d0
SHA1 635d20ee3b488c159b6ac5efc700b36ace0433ea
SHA512 418a6b753d5125670f8f87b2c5b5d0fefe03d9f1d321afd1522adc19c08a11463630c0435803c3ddc1f142e74b3464627c016f9d8d8bafc632b31ffcd9fe7f71
SSDEEP 6144:LloZM+9EB1/SqctonEPfCqAZclDWg/3cVRQuTTmg7j8e1modC:JoZQdSqcwvZclDWg/3cVRQuTTmg3Jo
TLSH
T1DD346C4933B88F17E26F8BBDD5B1148F87B1F143E90AF78E0C8895E82421742E949E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bndAB4.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\bndAB4.tmp.exe
Size 225KB
SHA256 9bf4f4d15db066732e643b07b7a5c1715a8ef18a43914e6d3a59eb48fbac3be9
MD5 c472fb9cbc8a4315da61e571191a0195
SHA1 af690a297abfd45b0c1d1c0d9050f309a5ce15ee
SHA512 2e29213617e91808105c186170d5063a0b1a914e2cb30baf9844318e7bcc65b72c315d94930fe4c6eb547473ee296920d4102b108c3291cb73fcf47ebdf24d1d
SSDEEP 1536:BYKwLLZeA6fEMx5AKnAfUr4bEpqY8/A3iTBBk44vAB2EX5joG4hgL/YAiB495ILu:a35eAWzx5Ry0fABKw7OGewlKy
TLSH
T110344C523F48CD4BD27773FC5160EB79A7625ECA281AC2035CF2DC6BF8D868A1D69190
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bndFD47.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\bndFD47.tmp.exe
Size 1.9MB
SHA256 2d269c89271db1716d7c649fcadaf007f436da782811e05127a4112c96c0e492
MD5 7ddc7181b2f719f8592c973782d1aec2
SHA1 c1f884c080a2559cd7a7969157881c770d00d5dc
SHA512 d5cc52726e3c171fb9c18385fa3eb344ac2f10b9cd3aae5eb805389eb80b7c85e99fe11133582da800ad1f4e7efae809796d18b3fcf46249bb516e6648bdc53c
SSDEEP 49152:pKa9z7wjsXCbftLGYVomqw6zenL9J1DoPrif6m3:wOz7wP7BGmqLQ9J1oPr09
TLSH
T19C95332DD76C022AD3CB857B9ED2B46F1B651EDE1EFAF5649104E432B0CAE9D281C314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/988-39-0x000002A3118A0000-0x000002A3118A1000-memory.dmp

Download

memory/1148-12-0x00007FFE50350000-0x00007FFE50CF4000-memory.dmp

Download

memory/1148-10-0x00007FFE504DF000-0x00007FFE504E0000-memory.dmp

Download

memory/1148-14-0x00007FFE50350000-0x00007FFE50CF4000-memory.dmp

Download

memory/1148-11-0x00000000000E0000-0x00000000002D2000-memory.dmp

Download

memory/1148-36-0x00007FFE50350000-0x00007FFE50CF4000-memory.dmp

Download

memory/1732-43-0x000000001C7D0000-0x000000001C99A000-memory.dmp

Download

memory/1732-42-0x0000000000E10000-0x0000000000E4E000-memory.dmp

Download

memory/1732-44-0x000000001C7D0000-0x000000001C99A000-memory.dmp

Download

memory/1732-45-0x000000001C7D0000-0x000000001C99A000-memory.dmp

Download

memory/1732-46-0x000000001C7D0000-0x000000001C99A000-memory.dmp

Download

memory/1732-47-0x000000001C7D0000-0x000000001C99A000-memory.dmp

Download

memory/1732-48-0x000000001C7D0000-0x000000001C99A000-memory.dmp

Download

memory/1732-50-0x000000001C7D0000-0x000000001C99A000-memory.dmp

Download

memory/1732-51-0x000000001C7D0000-0x000000001C99A000-memory.dmp

Download

memory/2776-31-0x000001D5185C0000-0x000001D518600000-memory.dmp

Download

memory/4544-7-0x000001F7594B0000-0x000001F7594B1000-memory.dmp

Download

memory/4544-8-0x000001F7594B0000-0x000001F7594B1000-memory.dmp

Download