umbral | 94509784f4e6bbe7ddcb00d09f2325cf9baec1cc80e14b5114987798aca3f191

Analysis

user interaction
yes
max time kernel
149s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bat To 0Exe.exe
Size 1005KB
Sample261113-nn71csty9n
SHA256 94509784f4e6bbe7ddcb00d09f2325cf9baec1cc80e14b5114987798aca3f191
MD5 6bf2d368d054aef36f8e083ce54c31de
SHA1 f417b5dcc2354408f20f71522d1d9ed9fa9ff1cd
SHA512 4c404a5369d35dbbb00ed58f0389f63e664b58295f0a12ca8e8bfbf29d53ef0612777ab9cb7acf5d7b74fc04d7655eae5763455d99a4b817d764c6858a28d56e
SSDEEP 12288:1oZZL+EP8pOpvcCFdWwj+ctBI4K4/ZrvIGS:HI8YpvcCFdWwj+ctBI4/Z9S
TLSH
T1E825184323688E12D52E47FD8172D9BE4773AE66A825E34E0CD8BCF73A337425805A53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution umbral spyware stealer

Malware Config

Extracted

Family

umbral

Version

v1.3

https://discord.com/api/webhooks/1570758573208768582/nGddHNMHIBlNIPILY45Ks6FoJQgV7Buy9G0Iyz9_TQpIJCuNut4Ev7R2HtXywOClM6LX

Signatures

Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral

Detects Umbral payload 4 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c520-18.dat	family_umbral
behavioral2/files/0x000e00000001c520-18.dat	family_umbral_obfuscated
behavioral2/memory/2760-27-0x0000029025370000-0x00000290253B0000-memory.dmp	family_umbral
behavioral2/memory/2760-27-0x0000029025370000-0x00000290253B0000-memory.dmp	family_umbral_obfuscated

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1604	powershell.exe
5272	powershell.exe
6000	powershell.exe
4496	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5272	powershell.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5272	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2760	Umbral.exe
5836	Bat to Exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
10	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
2340	wmic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Umbral.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Umbral.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bat to Exe.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4584	wmic.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1604	powershell.exe
1604	powershell.exe
1604	powershell.exe
5272	powershell.exe
5272	powershell.exe
5272	powershell.exe
6000	powershell.exe
6000	powershell.exe
6000	powershell.exe
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe
2228	wmic.exe
2228	wmic.exe
2228	wmic.exe
2228	wmic.exe
5964	wmic.exe
5964	wmic.exe
5964	wmic.exe
5964	wmic.exe
2340	wmic.exe
2340	wmic.exe
2340	wmic.exe
2340	wmic.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4584	wmic.exe
4584	wmic.exe
4584	wmic.exe
4584	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	Umbral.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeIncreaseQuotaPrivilege	1604	powershell.exe
Token: SeSecurityPrivilege	1604	powershell.exe
Token: SeTakeOwnershipPrivilege	1604	powershell.exe
Token: SeLoadDriverPrivilege	1604	powershell.exe
Token: SeSystemProfilePrivilege	1604	powershell.exe
Token: SeSystemtimePrivilege	1604	powershell.exe
Token: SeProfSingleProcessPrivilege	1604	powershell.exe
Token: SeIncBasePriorityPrivilege	1604	powershell.exe
Token: SeCreatePagefilePrivilege	1604	powershell.exe
Token: SeBackupPrivilege	1604	powershell.exe
Token: SeRestorePrivilege	1604	powershell.exe
Token: SeShutdownPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeSystemEnvironmentPrivilege	1604	powershell.exe
Token: SeRemoteShutdownPrivilege	1604	powershell.exe
Token: SeUndockPrivilege	1604	powershell.exe
Token: SeManageVolumePrivilege	1604	powershell.exe
Token: 33	1604	powershell.exe
Token: 34	1604	powershell.exe
Token: 35	1604	powershell.exe
Token: 36	1604	powershell.exe
Token: SeDebugPrivilege	5272	powershell.exe
Token: SeDebugPrivilege	6000	powershell.exe
Token: SeDebugPrivilege	3800	powershell.exe
Token: SeIncreaseQuotaPrivilege	2228	wmic.exe
Token: SeSecurityPrivilege	2228	wmic.exe
Token: SeTakeOwnershipPrivilege	2228	wmic.exe
Token: SeLoadDriverPrivilege	2228	wmic.exe
Token: SeSystemProfilePrivilege	2228	wmic.exe
Token: SeSystemtimePrivilege	2228	wmic.exe
Token: SeProfSingleProcessPrivilege	2228	wmic.exe
Token: SeIncBasePriorityPrivilege	2228	wmic.exe
Token: SeCreatePagefilePrivilege	2228	wmic.exe
Token: SeBackupPrivilege	2228	wmic.exe
Token: SeRestorePrivilege	2228	wmic.exe
Token: SeShutdownPrivilege	2228	wmic.exe
Token: SeDebugPrivilege	2228	wmic.exe
Token: SeSystemEnvironmentPrivilege	2228	wmic.exe
Token: SeRemoteShutdownPrivilege	2228	wmic.exe
Token: SeUndockPrivilege	2228	wmic.exe
Token: SeManageVolumePrivilege	2228	wmic.exe
Token: 33	2228	wmic.exe
Token: 34	2228	wmic.exe
Token: 35	2228	wmic.exe
Token: 36	2228	wmic.exe
Token: SeIncreaseQuotaPrivilege	2228	wmic.exe
Token: SeSecurityPrivilege	2228	wmic.exe
Token: SeTakeOwnershipPrivilege	2228	wmic.exe
Token: SeLoadDriverPrivilege	2228	wmic.exe
Token: SeSystemProfilePrivilege	2228	wmic.exe
Token: SeSystemtimePrivilege	2228	wmic.exe
Token: SeProfSingleProcessPrivilege	2228	wmic.exe
Token: SeIncBasePriorityPrivilege	2228	wmic.exe
Token: SeCreatePagefilePrivilege	2228	wmic.exe
Token: SeBackupPrivilege	2228	wmic.exe
Token: SeRestorePrivilege	2228	wmic.exe
Token: SeShutdownPrivilege	2228	wmic.exe
Token: SeDebugPrivilege	2228	wmic.exe
Token: SeSystemEnvironmentPrivilege	2228	wmic.exe
Token: SeRemoteShutdownPrivilege	2228	wmic.exe
Token: SeUndockPrivilege	2228	wmic.exe
Token: SeManageVolumePrivilege	2228	wmic.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 2760	4732	Bat To 0Exe.exe	89
PID 4732 wrote to memory of 5836	4732	Bat To 0Exe.exe	90
PID 2760 wrote to memory of 1604	2760	Umbral.exe	92
PID 2760 wrote to memory of 5272	2760	Umbral.exe	95
PID 2760 wrote to memory of 6000	2760	Umbral.exe	97
PID 2760 wrote to memory of 3800	2760	Umbral.exe	99
PID 2760 wrote to memory of 2228	2760	Umbral.exe	101
PID 2760 wrote to memory of 5964	2760	Umbral.exe	104
PID 2760 wrote to memory of 2340	2760	Umbral.exe	106
PID 2760 wrote to memory of 4496	2760	Umbral.exe	108
PID 2760 wrote to memory of 4584	2760	Umbral.exe	110

C:\Users\Admin\AppData\Local\Temp\Bat To 0Exe.exe
"C:\Users\Admin\AppData\Local\Temp\Bat To 0Exe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Users\Admin\AppData\Local\Temp\Umbral.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Disables automatic submission of suspicious files to Microsoft by Windows Defender
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3800
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2228
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5964
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4496
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:4584
- C:\Users\Admin\AppData\Local\Temp\Bat to Exe.exe
  "C:\Users\Admin\AppData\Local\Temp\Bat to Exe.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 070e2dc002fee5d6c6ae0611713bb24a9f01d741d964e7f1ece4f61789724a94
MD5 95e9928464a1f3425068f7e64a74060a
SHA1 9bdbd59bea34afd0aebf4d0c3d3cfe0317aa4d57
SHA512 a150525324ebe4a0dc28577f089c1f45ef0902355ecd9d5f10c91d45fe57d44d09c6d133a92c3f32dca0c73b97b259d5ad7ff4316edafa2cb00e38d64e043f06
TLSH
T1E9216833F3DD8654C899413A10CEAC1035B7C7DB40DECEDB6B84D559A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 c649ac7b9ec6d6f76b9d9569f4ec855674ca31bef16181e13d1ad1461213c663
MD5 266b2c2a6f176e0c62d949f15d22542e
SHA1 b98aba0884a6f97aec66c9fb42bfa0dccd39b3bb
SHA512 b1e7d140dbd68090081c4a8285245c9e3ea5b2b1cc412d97047b8d8734e53d7e7cff277ee6034a1d9b668b1ba3a1f458eec2337ec840112cc9a65f5f730478bb
TLSH
T1AE116633F3CC86A4DC59803650CEAD1136B78BCB40DFCEDB6B84C155A42F685CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b11ec5eeecac681bbcbb325a58485259a1f3e62f99d14d73847ea54a1a1655dd
MD5 37d86e69524afe02f24cddd46a920c0b
SHA1 f9819ef9bc734f750e10e789320a8280f6547b49
SHA512 5debdda209d6598e685521b208a5dc4fdd65b3ce3b583fd1086c8af3398e93883bc35d9d845c6c78c74cf87a5118d50b3ad2f15ed41b1c6c62097835c44ee729
TLSH
T188215733F3CC86A4C89A413650CEAC1036B7C7DB419EDE9BBB84D155A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

Bat to Exe.exe

Path C:\Users\Admin\AppData\Local\Temp\Bat to Exe.exe
Size 752KB
SHA256 f6f47c8fa80177328644c46370d39e1efdc49a6a9df2fa7afb4c4a72064e1459
MD5 7a907e93ae6fe3e6dd7ab7f2c4605325
SHA1 b3603193d48ecf4d7eb6c1149decc0c57a635242
SHA512 fad1099b52d242788e59795c4376da92e21edc05a18c1f1b926882417e140ff084d1e4bd9a3f2d90a5a22dd9010e3a7a263665e308359c489e472c29773ab70a
SSDEEP 1536:dc+9foYsW/hYorRaLfcwQPlyMJXfZxqx4ZVYWfZxqx4K:dc++W/hbrR2EJXfZd3YWfZdK
TLSH
T1BFF44C9396488D92D83017FD4133CEBE56636FB8A975D71A58FABC73BB732820C05582
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Umbral.exe

Path C:\Users\Admin\AppData\Local\Temp\Umbral.exe
Size 229KB
SHA256 c9d64fea7aa018c20b752e22269c08102aaa8db3b4e5e73ff4e86f19dea7c507
MD5 eee75685e3fd5c152c9827e117b10c7b
SHA1 eb49b14cd62e4c0ddbbf88e28df56b02a329dd9f
SHA512 696b4f624c762da0552166bb9ae06d3498c5e3c2607b8af44f972c93b6681e98f82d6014c3b60adf1bc26b708bd64ebbf28c2731c6f27ab306917d5ff000567a
SSDEEP 6144:tloZMCrIkd8g+EtXHkv/iD4pOpvcCFdWwj+ctBIfob8e1mrtji:voZZL+EP8pOpvcCFdWwj+ctBI4K4
TLSH
T130346C5933B88F17E25F8BBDD5B1158F87B1F143E80AF78E0C8895E82411B42E949E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_plz3mdan.nr1.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_plz3mdan.nr1.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1604-54-0x00000193ED010000-0x00000193ED01A000-memory.dmp

Download

memory/1604-47-0x00000193ECE60000-0x00000193ECE82000-memory.dmp

Download

memory/1604-53-0x00000193ED250000-0x00000193ED302000-memory.dmp

Download

memory/1604-52-0x00000193ED230000-0x00000193ED24E000-memory.dmp

Download

memory/2760-78-0x0000029025930000-0x000002902593A000-memory.dmp

Download

memory/2760-39-0x00007FFF83040000-0x00007FFF83041000-memory.dmp

Download

memory/2760-79-0x0000029027280000-0x0000029027292000-memory.dmp

Download

memory/2760-60-0x000002903FD00000-0x000002903FD76000-memory.dmp

Download

memory/2760-62-0x00000290258F0000-0x000002902590E000-memory.dmp

Download

memory/2760-27-0x0000029025370000-0x00000290253B0000-memory.dmp

Download

memory/2760-87-0x00007FFF82EB0000-0x00007FFF83854000-memory.dmp

Download

memory/2760-61-0x0000029025950000-0x00000290259A0000-memory.dmp

Download

memory/2760-46-0x00007FFF8303F000-0x00007FFF83040000-memory.dmp

Download

memory/2760-43-0x00007FFF82EB0000-0x00007FFF83854000-memory.dmp

Download

memory/2760-42-0x00007FFF82EB0000-0x00007FFF83854000-memory.dmp

Download

memory/2760-41-0x00007FFF82EB0000-0x00007FFF83854000-memory.dmp

Download

memory/2760-40-0x00007FFF82EB0000-0x00007FFF83854000-memory.dmp

Download

memory/4732-11-0x00007FFF86830000-0x00007FFF87268000-memory.dmp

Download

memory/4732-8-0x00007FFF86830000-0x00007FFF87268000-memory.dmp

Download

memory/4732-1-0x000000001B740000-0x000000001B7E6000-memory.dmp

Download

memory/4732-2-0x00007FFF86830000-0x00007FFF87268000-memory.dmp

Download

memory/4732-3-0x000000001BD00000-0x000000001C1CE000-memory.dmp

Download

memory/4732-4-0x000000001C300000-0x000000001C39C000-memory.dmp

Download

memory/4732-5-0x000000001B7F0000-0x000000001B7F8000-memory.dmp

Download

memory/4732-32-0x00007FFF86830000-0x00007FFF87268000-memory.dmp

Download

memory/4732-45-0x0000000001140000-0x0000000001150000-memory.dmp

Download

memory/4732-6-0x000000001C460000-0x000000001C4AC000-memory.dmp

Download

memory/4732-31-0x00007FFF86830000-0x00007FFF87268000-memory.dmp

Download

memory/4732-13-0x00007FFF86830000-0x00007FFF87268000-memory.dmp

Download

memory/4732-12-0x00007FFF86830000-0x00007FFF87268000-memory.dmp

Download

memory/4732-0-0x00007FFF86B2A000-0x00007FFF86B2B000-memory.dmp

Download

memory/4732-10-0x00007FFF86830000-0x00007FFF87268000-memory.dmp

Download

memory/4732-9-0x00007FFF86830000-0x00007FFF87268000-memory.dmp

Download

memory/4732-7-0x00007FFF86830000-0x00007FFF87268000-memory.dmp

Download

memory/5836-38-0x00000000056C0000-0x0000000005716000-memory.dmp

Download

memory/5836-44-0x00000000744E2000-0x00000000744E3000-memory.dmp

Download

memory/5836-34-0x0000000005480000-0x000000000551C000-memory.dmp

Download

memory/5836-35-0x0000000005AE0000-0x000000000609A000-memory.dmp

Download

memory/5836-36-0x00000000055C0000-0x0000000005652000-memory.dmp

Download

memory/5836-33-0x0000000000A20000-0x0000000000AE2000-memory.dmp

Download

memory/5836-37-0x0000000005570000-0x000000000557A000-memory.dmp

Download