lokibot | e0901ef3e5ebff335dffe5f654159c85f35345ccd93f1a72cce1866a93af0fda

Analysis

max time kernel
147s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

183d893845a51e01418992483191c9a2_JaffaCakes118.exe
Size

476KB
MD5

183d893845a51e01418992483191c9a2
SHA1

4ee5c62db9d70074b2d6a15953e21667706e1f33
SHA256

e0901ef3e5ebff335dffe5f654159c85f35345ccd93f1a72cce1866a93af0fda
SHA512

708e0b90c6e20f64387d2ea3377bd4f827b269cdc9a921e20e1334b975c5d2d5b3fab19eb1033767a6868ef10e5edd536d518f724ad538a3bc05f94017b092af
SSDEEP

12288:qFAsaKa799jzLck72I7TxmMYQMHaOHUmqlcluG:eTa7jzck72IxTl6jHcG

Score

10^/10

lokibot sality backdoor collection evasion spyware stealer trojan upx

Malware Config

Extracted

Family

lokibot

http://mclhk-net.com/hiswounds/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	AppLaunch.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

AppLaunch.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	AppLaunch.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	AppLaunch.exe

Deletes itself 1 IoCs

Processes:

AppLaunch.exe

pid process

2360 AppLaunch.exe

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2360-16-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-17-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-15-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-18-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-12-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-21-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-14-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-20-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-19-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-13-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-57-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-58-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-59-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-61-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-60-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-69-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-78-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-79-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-87-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-90-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-112-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-113-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-114-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-116-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-125-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-126-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-129-0x0000000002060000-0x000000000311A000-memory.dmp	upx
behavioral1/memory/2360-152-0x0000000002060000-0x000000000311A000-memory.dmp	upx

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	AppLaunch.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

AppLaunch.exe

description	ioc	process
File opened (read-only)	\??\Y:	AppLaunch.exe
File opened (read-only)	\??\S:	AppLaunch.exe
File opened (read-only)	\??\V:	AppLaunch.exe
File opened (read-only)	\??\K:	AppLaunch.exe
File opened (read-only)	\??\N:	AppLaunch.exe
File opened (read-only)	\??\P:	AppLaunch.exe
File opened (read-only)	\??\Q:	AppLaunch.exe
File opened (read-only)	\??\W:	AppLaunch.exe
File opened (read-only)	\??\E:	AppLaunch.exe
File opened (read-only)	\??\J:	AppLaunch.exe
File opened (read-only)	\??\L:	AppLaunch.exe
File opened (read-only)	\??\M:	AppLaunch.exe
File opened (read-only)	\??\O:	AppLaunch.exe
File opened (read-only)	\??\T:	AppLaunch.exe
File opened (read-only)	\??\U:	AppLaunch.exe
File opened (read-only)	\??\X:	AppLaunch.exe
File opened (read-only)	\??\G:	AppLaunch.exe
File opened (read-only)	\??\H:	AppLaunch.exe
File opened (read-only)	\??\Z:	AppLaunch.exe
File opened (read-only)	\??\I:	AppLaunch.exe
File opened (read-only)	\??\R:	AppLaunch.exe

Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

AppLaunch.exe

description ioc process

File opened for modification F:\autorun.inf AppLaunch.exe
File opened for modification C:\autorun.inf AppLaunch.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

183d893845a51e01418992483191c9a2_JaffaCakes118.exe

description pid process target process

PID 3048 set thread context of 2360 3048 183d893845a51e01418992483191c9a2_JaffaCakes118.exe AppLaunch.exe

description	ioc	process
File opened for modification	F:\autorun.inf	AppLaunch.exe
File opened for modification	C:\autorun.inf	AppLaunch.exe

description	pid	process	target process
PID 3048 set thread context of 2360	3048	183d893845a51e01418992483191c9a2_JaffaCakes118.exe	AppLaunch.exe

Drops file in Program Files directory 5 IoCs

Processes:

AppLaunch.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	AppLaunch.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	AppLaunch.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	AppLaunch.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	AppLaunch.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	AppLaunch.exe

Drops file in Windows directory 4 IoCs

Processes:

AppLaunch.exe183d893845a51e01418992483191c9a2_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\f76c320	AppLaunch.exe
File opened for modification	C:\Windows\SYSTEM.INI	AppLaunch.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	183d893845a51e01418992483191c9a2_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	183d893845a51e01418992483191c9a2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

AppLaunch.exe

pid	process
2360	AppLaunch.exe
2360	AppLaunch.exe
2360	AppLaunch.exe
2360	AppLaunch.exe
2360	AppLaunch.exe
2360	AppLaunch.exe
2360	AppLaunch.exe
2360	AppLaunch.exe
2360	AppLaunch.exe
2360	AppLaunch.exe
2360	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

183d893845a51e01418992483191c9a2_JaffaCakes118.exeAppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	3048	183d893845a51e01418992483191c9a2_JaffaCakes118.exe
Token: SeDebugPrivilege	2360	AppLaunch.exe
Token: SeDebugPrivilege	2360	AppLaunch.exe
Token: SeDebugPrivilege	2360	AppLaunch.exe
Token: SeDebugPrivilege	2360	AppLaunch.exe
Token: SeDebugPrivilege	2360	AppLaunch.exe
Token: SeDebugPrivilege	2360	AppLaunch.exe
Token: SeDebugPrivilege	2360	AppLaunch.exe
Token: SeDebugPrivilege	2360	AppLaunch.exe

Suspicious use of WriteProcessMemory 58 IoCs

Processes:

183d893845a51e01418992483191c9a2_JaffaCakes118.exeAppLaunch.exe

description	pid	process	target process
PID 3048 wrote to memory of 2360	3048	183d893845a51e01418992483191c9a2_JaffaCakes118.exe	AppLaunch.exe
PID 3048 wrote to memory of 2360	3048	183d893845a51e01418992483191c9a2_JaffaCakes118.exe	AppLaunch.exe
PID 3048 wrote to memory of 2360	3048	183d893845a51e01418992483191c9a2_JaffaCakes118.exe	AppLaunch.exe
PID 3048 wrote to memory of 2360	3048	183d893845a51e01418992483191c9a2_JaffaCakes118.exe	AppLaunch.exe
PID 3048 wrote to memory of 2360	3048	183d893845a51e01418992483191c9a2_JaffaCakes118.exe	AppLaunch.exe
PID 3048 wrote to memory of 2360	3048	183d893845a51e01418992483191c9a2_JaffaCakes118.exe	AppLaunch.exe
PID 3048 wrote to memory of 2360	3048	183d893845a51e01418992483191c9a2_JaffaCakes118.exe	AppLaunch.exe
PID 3048 wrote to memory of 2360	3048	183d893845a51e01418992483191c9a2_JaffaCakes118.exe	AppLaunch.exe
PID 3048 wrote to memory of 2360	3048	183d893845a51e01418992483191c9a2_JaffaCakes118.exe	AppLaunch.exe
PID 3048 wrote to memory of 2360	3048	183d893845a51e01418992483191c9a2_JaffaCakes118.exe	AppLaunch.exe
PID 3048 wrote to memory of 2360	3048	183d893845a51e01418992483191c9a2_JaffaCakes118.exe	AppLaunch.exe
PID 3048 wrote to memory of 2360	3048	183d893845a51e01418992483191c9a2_JaffaCakes118.exe	AppLaunch.exe
PID 3048 wrote to memory of 2360	3048	183d893845a51e01418992483191c9a2_JaffaCakes118.exe	AppLaunch.exe
PID 2360 wrote to memory of 1260	2360	AppLaunch.exe	taskhost.exe
PID 2360 wrote to memory of 1332	2360	AppLaunch.exe	Dwm.exe
PID 2360 wrote to memory of 1368	2360	AppLaunch.exe	Explorer.EXE
PID 2360 wrote to memory of 3048	2360	AppLaunch.exe	183d893845a51e01418992483191c9a2_JaffaCakes118.exe
PID 2360 wrote to memory of 3048	2360	AppLaunch.exe	183d893845a51e01418992483191c9a2_JaffaCakes118.exe
PID 2360 wrote to memory of 1260	2360	AppLaunch.exe	taskhost.exe
PID 2360 wrote to memory of 1332	2360	AppLaunch.exe	Dwm.exe
PID 2360 wrote to memory of 1368	2360	AppLaunch.exe	Explorer.EXE
PID 2360 wrote to memory of 3020	2360	AppLaunch.exe	DllHost.exe
PID 2360 wrote to memory of 1260	2360	AppLaunch.exe	taskhost.exe
PID 2360 wrote to memory of 1332	2360	AppLaunch.exe	Dwm.exe
PID 2360 wrote to memory of 1368	2360	AppLaunch.exe	Explorer.EXE
PID 2360 wrote to memory of 3020	2360	AppLaunch.exe	DllHost.exe
PID 2360 wrote to memory of 1260	2360	AppLaunch.exe	taskhost.exe
PID 2360 wrote to memory of 1332	2360	AppLaunch.exe	Dwm.exe
PID 2360 wrote to memory of 1368	2360	AppLaunch.exe	Explorer.EXE
PID 2360 wrote to memory of 3020	2360	AppLaunch.exe	DllHost.exe
PID 2360 wrote to memory of 1260	2360	AppLaunch.exe	taskhost.exe
PID 2360 wrote to memory of 1332	2360	AppLaunch.exe	Dwm.exe
PID 2360 wrote to memory of 1368	2360	AppLaunch.exe	Explorer.EXE
PID 2360 wrote to memory of 3020	2360	AppLaunch.exe	DllHost.exe
PID 2360 wrote to memory of 1260	2360	AppLaunch.exe	taskhost.exe
PID 2360 wrote to memory of 1332	2360	AppLaunch.exe	Dwm.exe
PID 2360 wrote to memory of 1368	2360	AppLaunch.exe	Explorer.EXE
PID 2360 wrote to memory of 3020	2360	AppLaunch.exe	DllHost.exe
PID 2360 wrote to memory of 1260	2360	AppLaunch.exe	taskhost.exe
PID 2360 wrote to memory of 1332	2360	AppLaunch.exe	Dwm.exe
PID 2360 wrote to memory of 1368	2360	AppLaunch.exe	Explorer.EXE
PID 2360 wrote to memory of 3020	2360	AppLaunch.exe	DllHost.exe
PID 2360 wrote to memory of 1260	2360	AppLaunch.exe	taskhost.exe
PID 2360 wrote to memory of 1332	2360	AppLaunch.exe	Dwm.exe
PID 2360 wrote to memory of 1368	2360	AppLaunch.exe	Explorer.EXE
PID 2360 wrote to memory of 3020	2360	AppLaunch.exe	DllHost.exe
PID 2360 wrote to memory of 1260	2360	AppLaunch.exe	taskhost.exe
PID 2360 wrote to memory of 1332	2360	AppLaunch.exe	Dwm.exe
PID 2360 wrote to memory of 1368	2360	AppLaunch.exe	Explorer.EXE
PID 2360 wrote to memory of 3020	2360	AppLaunch.exe	DllHost.exe
PID 2360 wrote to memory of 1260	2360	AppLaunch.exe	taskhost.exe
PID 2360 wrote to memory of 1332	2360	AppLaunch.exe	Dwm.exe
PID 2360 wrote to memory of 1368	2360	AppLaunch.exe	Explorer.EXE
PID 2360 wrote to memory of 3020	2360	AppLaunch.exe	DllHost.exe
PID 2360 wrote to memory of 1260	2360	AppLaunch.exe	taskhost.exe
PID 2360 wrote to memory of 1332	2360	AppLaunch.exe	Dwm.exe
PID 2360 wrote to memory of 1368	2360	AppLaunch.exe	Explorer.EXE
PID 2360 wrote to memory of 3020	2360	AppLaunch.exe	DllHost.exe

outlook_office_path 1 IoCs

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	AppLaunch.exe

outlook_win_path 1 IoCs

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	AppLaunch.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1260

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1332

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1368
- C:\Users\Admin\AppData\Local\Temp\183d893845a51e01418992483191c9a2_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\183d893845a51e01418992483191c9a2_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
    3⤵
    - Modifies firewall policy service
    - UAC bypass
    - Windows security bypass
    - Deletes itself
    - Accesses Microsoft Outlook profiles
    - Enumerates connected drives
    - Drops autorun.inf file
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:2360

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3627615824-4061627003-3019543961-1000\0f5007522459c86e95ffcc62f32308f1_12cce00e-511f-47e5-8588-7df67886da42

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3627615824-4061627003-3019543961-1000\0f5007522459c86e95ffcc62f32308f1_12cce00e-511f-47e5-8588-7df67886da42

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
F:\vqrbko.exe

Filesize
97KB

MD5
a6db66fa259d70f7b96fd723e9a14a11

SHA1
97d897d9e19682886b1fede567f8ce22d32ed148

SHA256
1328e6817535499c77b1edd9c741d22c3907987cd592131393aff6cb14bd6368

SHA512
fbad04fbc347c673b2ee21c66150d73e8b1e8a11b57b0c100fe00c0c04644bd6eda8b874c46104905ab2cd09e02174a7e351ab9ede3b352ec58f1f0c503cfcdf

Download Submit
memory/1260-23-0x0000000000320000-0x0000000000322000-memory.dmp

Filesize
8KB

Download
memory/2360-45-0x0000000004800000-0x0000000004802000-memory.dmp

Filesize
8KB

Download
memory/2360-8-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2360-18-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-12-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-21-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-14-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-20-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-19-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-13-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-7-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2360-162-0x0000000004800000-0x0000000004802000-memory.dmp

Filesize
8KB

Download
memory/2360-152-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-135-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2360-129-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-5-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2360-37-0x0000000004850000-0x0000000004851000-memory.dmp

Filesize
4KB

Download
memory/2360-43-0x0000000004800000-0x0000000004802000-memory.dmp

Filesize
8KB

Download
memory/2360-125-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-116-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-114-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-17-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-10-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2360-113-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-126-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-78-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-57-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-58-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-59-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-61-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-60-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-69-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-16-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-112-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-79-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-15-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-87-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/2360-90-0x0000000002060000-0x000000000311A000-memory.dmp

Filesize
16.7MB

Download
memory/3048-53-0x0000000074D30000-0x00000000752DB000-memory.dmp

Filesize
5.7MB

Download
memory/3048-38-0x0000000000A20000-0x0000000000A22000-memory.dmp

Filesize
8KB

Download
memory/3048-29-0x0000000000A20000-0x0000000000A22000-memory.dmp

Filesize
8KB

Download
memory/3048-30-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Filesize
4KB

Download
memory/3048-31-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Filesize
4KB

Download
memory/3048-44-0x0000000000A20000-0x0000000000A22000-memory.dmp

Filesize
8KB

Download
memory/3048-4-0x0000000074D30000-0x00000000752DB000-memory.dmp

Filesize
5.7MB

Download
memory/3048-3-0x0000000074D30000-0x00000000752DB000-memory.dmp

Filesize
5.7MB

Download
memory/3048-2-0x0000000074D30000-0x00000000752DB000-memory.dmp

Filesize
5.7MB

Download
memory/3048-1-0x0000000074D30000-0x00000000752DB000-memory.dmp

Filesize
5.7MB

Download
memory/3048-0-0x0000000074D31000-0x0000000074D32000-memory.dmp

Filesize
4KB

Download