lokibot | ccbcbbf0c8ab0e133382d476d1836596502dea3a459923e3b7b8462fa0ff4782

Analysis

max time kernel
143s
max time network
130s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
30-08-2024 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbb16e4e4e08c92f71f92912ee89d99f_JaffaCakes118.msi
Size

496KB
MD5

cbb16e4e4e08c92f71f92912ee89d99f
SHA1

837c8f172b6a8e1af9d906bfe9e2910c37af4159
SHA256

ccbcbbf0c8ab0e133382d476d1836596502dea3a459923e3b7b8462fa0ff4782
SHA512

591ee2940ab8c6a53fc824db1fbf6300677430d9b39eb6437d67e8640fa7454c428b20098323e7663de8baaec11a12392b7b6224e6f6cac9c442ccb439561269
SSDEEP

3072:ZEwLwjDHoRQoE/dVEZYIt+R9pna+10ez2kWYj67n0sN0o2ibcH0qwrUm1tEfaK:ZEwLUoOoEsZYIU3nIeYYjftwn1ty

Score

10^/10

lokibot collection credential_access discovery persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://185.148.146.193/~agroinovate/foreducational/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notty.url	MSIF0F6.tmp
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notty.url	msbuild.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notty.url	msbuild.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	vbc.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2780 set thread context of 552	2780	MSIF0F6.tmp	43
PID 1376 set thread context of 952	1376	msbuild.exe	51
PID 1960 set thread context of 1032	1960	msbuild.exe	58

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\f76ef32.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF0F6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76ef32.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f76ef2f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76ef2f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF086.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe

Executes dropped EXE 3 IoCs

pid	Process
2780	MSIF0F6.tmp
1376	msbuild.exe
1960	msbuild.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2516	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIF0F6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1696	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2556	msiexec.exe
2556	msiexec.exe
2780	MSIF0F6.tmp
2780	MSIF0F6.tmp
1376	msbuild.exe
1376	msbuild.exe
1960	msbuild.exe
1960	msbuild.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2516	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2516	msiexec.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeSecurityPrivilege	2556	msiexec.exe
Token: SeCreateTokenPrivilege	2516	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2516	msiexec.exe
Token: SeLockMemoryPrivilege	2516	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2516	msiexec.exe
Token: SeMachineAccountPrivilege	2516	msiexec.exe
Token: SeTcbPrivilege	2516	msiexec.exe
Token: SeSecurityPrivilege	2516	msiexec.exe
Token: SeTakeOwnershipPrivilege	2516	msiexec.exe
Token: SeLoadDriverPrivilege	2516	msiexec.exe
Token: SeSystemProfilePrivilege	2516	msiexec.exe
Token: SeSystemtimePrivilege	2516	msiexec.exe
Token: SeProfSingleProcessPrivilege	2516	msiexec.exe
Token: SeIncBasePriorityPrivilege	2516	msiexec.exe
Token: SeCreatePagefilePrivilege	2516	msiexec.exe
Token: SeCreatePermanentPrivilege	2516	msiexec.exe
Token: SeBackupPrivilege	2516	msiexec.exe
Token: SeRestorePrivilege	2516	msiexec.exe
Token: SeShutdownPrivilege	2516	msiexec.exe
Token: SeDebugPrivilege	2516	msiexec.exe
Token: SeAuditPrivilege	2516	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2516	msiexec.exe
Token: SeChangeNotifyPrivilege	2516	msiexec.exe
Token: SeRemoteShutdownPrivilege	2516	msiexec.exe
Token: SeUndockPrivilege	2516	msiexec.exe
Token: SeSyncAgentPrivilege	2516	msiexec.exe
Token: SeEnableDelegationPrivilege	2516	msiexec.exe
Token: SeManageVolumePrivilege	2516	msiexec.exe
Token: SeImpersonatePrivilege	2516	msiexec.exe
Token: SeCreateGlobalPrivilege	2516	msiexec.exe
Token: SeBackupPrivilege	3028	vssvc.exe
Token: SeRestorePrivilege	3028	vssvc.exe
Token: SeAuditPrivilege	3028	vssvc.exe
Token: SeBackupPrivilege	2556	msiexec.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeRestorePrivilege	2632	DrvInst.exe
Token: SeRestorePrivilege	2632	DrvInst.exe
Token: SeRestorePrivilege	2632	DrvInst.exe
Token: SeRestorePrivilege	2632	DrvInst.exe
Token: SeRestorePrivilege	2632	DrvInst.exe
Token: SeRestorePrivilege	2632	DrvInst.exe
Token: SeRestorePrivilege	2632	DrvInst.exe
Token: SeLoadDriverPrivilege	2632	DrvInst.exe
Token: SeLoadDriverPrivilege	2632	DrvInst.exe
Token: SeLoadDriverPrivilege	2632	DrvInst.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeDebugPrivilege	2780	MSIF0F6.tmp
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeDebugPrivilege	1376	msbuild.exe
Token: SeDebugPrivilege	552	vbc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2516	msiexec.exe
2516	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2780	2556	msiexec.exe	35
PID 2556 wrote to memory of 2780	2556	msiexec.exe	35
PID 2556 wrote to memory of 2780	2556	msiexec.exe	35
PID 2556 wrote to memory of 2780	2556	msiexec.exe	35
PID 2780 wrote to memory of 584	2780	MSIF0F6.tmp	36
PID 2780 wrote to memory of 584	2780	MSIF0F6.tmp	36
PID 2780 wrote to memory of 584	2780	MSIF0F6.tmp	36
PID 2780 wrote to memory of 584	2780	MSIF0F6.tmp	36
PID 584 wrote to memory of 1484	584	csc.exe	38
PID 584 wrote to memory of 1484	584	csc.exe	38
PID 584 wrote to memory of 1484	584	csc.exe	38
PID 584 wrote to memory of 1484	584	csc.exe	38
PID 2780 wrote to memory of 1296	2780	MSIF0F6.tmp	39
PID 2780 wrote to memory of 1296	2780	MSIF0F6.tmp	39
PID 2780 wrote to memory of 1296	2780	MSIF0F6.tmp	39
PID 2780 wrote to memory of 1296	2780	MSIF0F6.tmp	39
PID 2780 wrote to memory of 1696	2780	MSIF0F6.tmp	41
PID 2780 wrote to memory of 1696	2780	MSIF0F6.tmp	41
PID 2780 wrote to memory of 1696	2780	MSIF0F6.tmp	41
PID 2780 wrote to memory of 1696	2780	MSIF0F6.tmp	41
PID 2780 wrote to memory of 552	2780	MSIF0F6.tmp	43
PID 2780 wrote to memory of 552	2780	MSIF0F6.tmp	43
PID 2780 wrote to memory of 552	2780	MSIF0F6.tmp	43
PID 2780 wrote to memory of 552	2780	MSIF0F6.tmp	43
PID 2780 wrote to memory of 552	2780	MSIF0F6.tmp	43
PID 2780 wrote to memory of 552	2780	MSIF0F6.tmp	43
PID 2780 wrote to memory of 552	2780	MSIF0F6.tmp	43
PID 2780 wrote to memory of 552	2780	MSIF0F6.tmp	43
PID 2780 wrote to memory of 552	2780	MSIF0F6.tmp	43
PID 2780 wrote to memory of 552	2780	MSIF0F6.tmp	43
PID 1124 wrote to memory of 1376	1124	taskeng.exe	45
PID 1124 wrote to memory of 1376	1124	taskeng.exe	45
PID 1124 wrote to memory of 1376	1124	taskeng.exe	45
PID 1124 wrote to memory of 1376	1124	taskeng.exe	45
PID 1376 wrote to memory of 2032	1376	msbuild.exe	46
PID 1376 wrote to memory of 2032	1376	msbuild.exe	46
PID 1376 wrote to memory of 2032	1376	msbuild.exe	46
PID 1376 wrote to memory of 2032	1376	msbuild.exe	46
PID 2032 wrote to memory of 2456	2032	csc.exe	48
PID 2032 wrote to memory of 2456	2032	csc.exe	48
PID 2032 wrote to memory of 2456	2032	csc.exe	48
PID 2032 wrote to memory of 2456	2032	csc.exe	48
PID 1376 wrote to memory of 1528	1376	msbuild.exe	49
PID 1376 wrote to memory of 1528	1376	msbuild.exe	49
PID 1376 wrote to memory of 1528	1376	msbuild.exe	49
PID 1376 wrote to memory of 1528	1376	msbuild.exe	49
PID 1376 wrote to memory of 952	1376	msbuild.exe	51
PID 1376 wrote to memory of 952	1376	msbuild.exe	51
PID 1376 wrote to memory of 952	1376	msbuild.exe	51
PID 1376 wrote to memory of 952	1376	msbuild.exe	51
PID 1376 wrote to memory of 952	1376	msbuild.exe	51
PID 1376 wrote to memory of 952	1376	msbuild.exe	51
PID 1376 wrote to memory of 952	1376	msbuild.exe	51
PID 1376 wrote to memory of 952	1376	msbuild.exe	51
PID 1376 wrote to memory of 952	1376	msbuild.exe	51
PID 1376 wrote to memory of 952	1376	msbuild.exe	51
PID 1124 wrote to memory of 1960	1124	taskeng.exe	52
PID 1124 wrote to memory of 1960	1124	taskeng.exe	52
PID 1124 wrote to memory of 1960	1124	taskeng.exe	52
PID 1124 wrote to memory of 1960	1124	taskeng.exe	52
PID 1960 wrote to memory of 2856	1960	msbuild.exe	53
PID 1960 wrote to memory of 2856	1960	msbuild.exe	53
PID 1960 wrote to memory of 2856	1960	msbuild.exe	53
PID 1960 wrote to memory of 2856	1960	msbuild.exe	53

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	vbc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vbc.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cbb16e4e4e08c92f71f92912ee89d99f_JaffaCakes118.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2516

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\Installer\MSIF0F6.tmp
  "C:\Windows\Installer\MSIF0F6.tmp"
  2⤵
  - Drops startup file
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v2hicsi3\v2hicsi3.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:584
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF44E.tmp" "c:\Users\Admin\AppData\Local\Temp\v2hicsi3\CSC3B730601FE542F1839FE2C920A59581.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1484
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /query
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1296
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /sc MINUTE /tn Notty /MO 1 /tr "C:\Users\Admin\AppData\Roaming\skipe\msbuild.exe\
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1696
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:552

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3028

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004A0" "00000000000005E4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Windows\system32\taskeng.exe
taskeng.exe {BC88C5B2-230F-47FF-81CB-6CEE89E57649} S-1-5-21-2257386474-3982792636-3902186748-1000:CTBHAMHL\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Roaming\skipe\msbuild.exe
  C:\Users\Admin\AppData\Roaming\skipe\msbuild.exe "C:\Users\Admin\AppData\Roaming\skipe\msbuild.exe\"
  2⤵
  - Drops startup file
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pj1asqxy\pj1asqxy.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES63F1.tmp" "c:\Users\Admin\AppData\Local\Temp\pj1asqxy\CSC597DD098A4DE49C28C6746F6A53EDB.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2456
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /query
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1528
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
    3⤵
    PID:952
- C:\Users\Admin\AppData\Roaming\skipe\msbuild.exe
  C:\Users\Admin\AppData\Roaming\skipe\msbuild.exe "C:\Users\Admin\AppData\Roaming\skipe\msbuild.exe\"
  2⤵
  - Drops startup file
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yfvdnlef\yfvdnlef.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2856
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D75.tmp" "c:\Users\Admin\AppData\Local\Temp\yfvdnlef\CSC8E67101ED9CA40D4A15BCA3D7EDE2096.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1308
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /query
    3⤵
    - System Location Discovery: System Language Discovery
    PID:112
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
    3⤵
    PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Scripting

T1064

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Scripting

T1064

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76ef33.rbs

Filesize
663B

MD5
88b4292859acb7deb66aa48b8c78f745

SHA1
26a5250d661300b8fe598c513e9f4fcaa7ec05d2

SHA256
ce74b3268254867f0a12f7793ded9ce7a9c335841c2fc17d1a65c81fde5f4df9

SHA512
710595f93a3ec60b6a9676e3a8cd6baaaff86c3181a205af7cb86f97ea420c5cdf78b99b71697cd7d7b68fa61c2e949b589e00c03ccd5dce6452613e0520864c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4D75.tmp

Filesize
1KB

MD5
2a87aba17937ba73a9919683df2a54f0

SHA1
326673659cab42329ca9a27cb41f34abf5934bf8

SHA256
93358e4e8a97933c03a842b0c9faa699b9fe723cac26b90978143d8d96269e53

SHA512
8ec122fa6d7059d97ad12949b30acc5ed9890e9d4c5771f39dcc85170adc54a24418fb45fc4e26f5adc87bdb9460dafefb152fb3cf5cf84d98b6e8b91e74285a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES63F1.tmp

Filesize
1KB

MD5
4d857531fbad0543fc91e0353142ad13

SHA1
f3d346d20dcb5a8a022ffde7c34088de26c29288

SHA256
132398140cdcc392395295fc916418f44febde5e2c982dd48916cc32a5fde4f3

SHA512
2573d329d4c5c410ce9ed3271d7f3fadd10ae4e5a1a5aa4697a9528995f58fb3d19c322b3eb2d44cfd957485a6ea99b2fb7c168570e125b4a83aa7136c603866

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESF44E.tmp

Filesize
1KB

MD5
35c4da21c4fe802c8d5791ca46fb715b

SHA1
0adfd54c1a8fd03b757468f4aca2b26f7f7e2cf4

SHA256
b7ee00b31bdf001feb63750b8d693d308688453fb19a9c419bc81b65ee40492a

SHA512
b001908389bf918b45fd821e7fbe78eec9036abc32c5461dfed31af358a19f984d6b14cbc7c642c3065ba6a049bfdb496991fcac9f1c2d048bc92a04b3344f85

Download Submit
C:\Users\Admin\AppData\Local\Temp\pj1asqxy\pj1asqxy.dll

Filesize
6KB

MD5
3a181443549f53560997a16d8971fcfb

SHA1
d36ad7a98badcd216b35bdbf7ad65e220bdf49da

SHA256
73862e755d079d6c4e6bd133d00c096a912ce5620f29587613f9e3e604070d71

SHA512
bf7aa07902593558935b25dbb281648115b46791477745e133a2ecbbcfb6cd457b926cad35e002bc8694ff090d26501ce07ac9b0f254144908f6f50d9c3be3f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\pj1asqxy\pj1asqxy.pdb

Filesize
15KB

MD5
4fe5a43e9cae389eed149f0e44f283b3

SHA1
f364e2c40e387b5fb133c66f0af85e8675d78e23

SHA256
77040dcb5ee13b40a8fdcf179d70e36999a3af7602a6acbbb4bcfd9d76997713

SHA512
a226d592cd6f51575fcfc4a34017cade2fff6ae2e5b135b70290e9094fcd96dbb4357dea0d8ec8b692dcf976757f7a36faaf8edb5b48a3a962b8dcea60265d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\v2hicsi3\v2hicsi3.dll

Filesize
6KB

MD5
323bd7b70c3d07b94cc363722cfe3834

SHA1
ed00825b37d7e9fd9f401ebf9fb59c4130eb8c28

SHA256
3667f1e20274e7ecff207e2fa811466b11554effc0312f1c2898e676dfdd57ea

SHA512
8fde2f666ed074f53644fba8aeb08cf9da7760034260bf94c29b209d8e1fbb725dc9960536976c272b7e15704451089b7be6c6d9ca9e6c36b6d83f105acd5117

Download Submit
C:\Users\Admin\AppData\Local\Temp\v2hicsi3\v2hicsi3.pdb

Filesize
15KB

MD5
1fbcbcc5c61dcf36bcd29e2759f72c99

SHA1
03372512985901c7aa0db642c362eec147c6246d

SHA256
9439fb5af76788f5ebf1ad93530dbf48f70fd814203e48f0aeba371602e50d6d

SHA512
6aa48c1143fd018f3dd16f1488f278e8a3ea02404d860c18b803e72949ead5966c69de73f07dbfe6c9c3e4eda62e8e9357849de464812745cbef313accf98e00

Download Submit
C:\Users\Admin\AppData\Local\Temp\yfvdnlef\yfvdnlef.dll

Filesize
6KB

MD5
f85710755a4906dd9b79e77ff921a429

SHA1
0114f9c2ca274d8593587d41ee08f1780850e1ec

SHA256
50466b67acb4263acbcbd268cfece75d4964e78a242e521384e7822560c30e0d

SHA512
1079d169a4bef35c5068021dca5c55f9846f678f1d2b16c7b7493d1db5e2755af8ff2b86e2535e1732ce294d42751ad35dd6fa38b156caf14f523885bea0d5dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\yfvdnlef\yfvdnlef.pdb

Filesize
15KB

MD5
bc115fb05e47d9b7df311b43adb90f39

SHA1
37cd4aadc10d8b4db31b45b117e93f015be56456

SHA256
1515af00b6131d1949160bd9c4b238beee53127d1fa35cdfa84d0a8abb89b70f

SHA512
aeddd2ad07929b7de4ede47dfc143b5b46d3918639dce1a4742531e5e93e9b56e5dc8870185c155325313c25302b3efb10284574727ffa07fb5ac1e60eb3b482

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2257386474-3982792636-3902186748-1000\0f5007522459c86e95ffcc62f32308f1_1b224b15-1c83-42a0-a69a-d14ffe2f8138

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2257386474-3982792636-3902186748-1000\0f5007522459c86e95ffcc62f32308f1_1b224b15-1c83-42a0-a69a-d14ffe2f8138

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notty.url

Filesize
82B

MD5
cb6a4efa344cbb3599e0debe5f231bc8

SHA1
e399b165a943c82fd2999d4d39ca7c967009b4ca

SHA256
df5973403e499e4c8d39af1a4232de2a9737d9394b5be5f3ae82fc2881b71bd0

SHA512
075a28d76d656f8e287da1d6c5317f3e1f5717cd6e1fef9fc094042ebf9727516106149e2fee43a546bc2972c924d07f611a86f34cc222657b71ff0ff2db436f

Download Submit
C:\Windows\Installer\MSIF0F6.tmp

Filesize
470KB

MD5
567ff04d8da26338664b393e83a07287

SHA1
dc848a25dc90b7d90a51cd8fbe3d9abddd5f5b1b

SHA256
10abc3ea92644e7f4b9445f400bad387b94f28820cd9eb5bfa1849330dcc6691

SHA512
89225e97e735e9cba09d377c358aa59b8135181cfbb6ce704eb4448ad20732a57dce7624dd1849e3ef3995c630ff89816051f3c5bc4976f8257cc390aa48728a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\pj1asqxy\CSC597DD098A4DE49C28C6746F6A53EDB.TMP

Filesize
1KB

MD5
680b6dc048d813be6c1130a9ed8af884

SHA1
359e154113115999e6addc9e7cbeca67d0f1f0d8

SHA256
ff760db7803b4800972db6aee67a2d7feb29bb8c2766b89bbc42aec7c9144a30

SHA512
3971b6d78b2c21d315f612aa353564274cee1ec6767c722ee5b4349fb006a707fdbbae5596c4ed6d05775c6322a0ad94c595688df55531bfdeb118a3370b21ec

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\pj1asqxy\pj1asqxy.cmdline

Filesize
312B

MD5
5432ae14d39d1bbb58bbebf594a8b091

SHA1
59f1fc437c15aaaba416ecca25fb0a55d8fae716

SHA256
67e3b7d6dd086a073ee2b095cabff9568538cbc50d22d4b6997c69dd8ec2f912

SHA512
fab0db23f09fba9bbd06e9306eb5e40efff044b3a1a323ba505a4cfd3d4cc00a572b23ea6317a00989fc818db91a88f72e90132e7ad5c25e7c98768c8eef70b8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\v2hicsi3\CSC3B730601FE542F1839FE2C920A59581.TMP

Filesize
1KB

MD5
7a7b53a6ce94de848f2a5e29dd158168

SHA1
e7fd6ffb1f997c5477b7c8fad3c31e2f0cd136a4

SHA256
1ce92e4e77c45b35b1fcfba72829f6f710088e6512670c9ba3622fd895485a49

SHA512
38f47163d0a6de603be17c2fe6d75189c0f380aaec58ff665e64a0e98c77ebc1d6fc19e45bcea01d5e66e3154430cd62b0164667a4bd9baa3d55d130cb4ece76

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\v2hicsi3\v2hicsi3.0.cs

Filesize
3KB

MD5
4e1095c7e8dbb0c68bc9bf829eef13b6

SHA1
f2b98be89910c93c5169e82d248c57500e59b698

SHA256
9107abced02db522cfb88d1d15faa4117c665c855d3f5fbef054cce42f855ea1

SHA512
f9d77f5da96b93bdc09ff508c64d3f1f7f3f5a719f5309a548a3d5e2661d05f0032de2fcc4506d978e12a440310fee3db26ec8c6f560925aea127565d32105e7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\v2hicsi3\v2hicsi3.cmdline

Filesize
312B

MD5
a3d3f5b3819f2f70f91796d9fb68edd3

SHA1
355cc6aa9cd4ff8bbcf2f465a8cd42533740e006

SHA256
fb17c551b62defc587a6d0dad3182b49bf2ab0e335f805d2f64d439a53d0d39b

SHA512
0c45a4dabb7489e1d7a187b7757bffc24916217389be4030aac7ed2c4dfb83851d0d5fe456dca18e907852523eb40a12a1ecf0bc5a26ad356339619de4a09d27

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yfvdnlef\CSC8E67101ED9CA40D4A15BCA3D7EDE2096.TMP

Filesize
1KB

MD5
a1d1169da5a15dd667864fff1c6231b2

SHA1
470ff9350da142da72b8a9d80d71411acbb2fc08

SHA256
bf5c0e3bc4e482be78a82a12f55025a066210bf1f15dd03bd1cc26d36aa3d81b

SHA512
5117fac3b81d7919f8a96f7e3b5782dbfd6d58c17397285a69df300dd6aac0ff86000b87838a073ea8caf9b247631146d5989d9b3bb61d68323a5bdd95a4780b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yfvdnlef\yfvdnlef.cmdline

Filesize
312B

MD5
950f755d4ecb9096fb81911bcd08dc6f

SHA1
87c2bd8ddf1997d8010c60ee1ebe623136942b68

SHA256
59e1a2854ad11c5fb3b0a2b42663bb1dc2ef47ebe1cb5a859500fce1b73c2c8b

SHA512
5c396007d35a11b0341407e3564a7b89c6d05c86d027b3e5a02748336eca0375b823046dfc85c3b235b31899fe996158e2e108be1092c54640926c2d8ce2a840

Download Submit
memory/552-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/552-39-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/552-184-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/552-48-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/552-41-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/552-43-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/552-45-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/552-47-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/552-198-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/552-129-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/552-49-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/552-37-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/952-106-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1032-182-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1376-92-0x0000000001F40000-0x0000000001FE2000-memory.dmp

Filesize
648KB

Download
memory/1376-88-0x0000000000270000-0x0000000000278000-memory.dmp

Filesize
32KB

Download
memory/1376-73-0x00000000000D0000-0x0000000000122000-memory.dmp

Filesize
328KB

Download
memory/1960-164-0x0000000000330000-0x0000000000338000-memory.dmp

Filesize
32KB

Download
memory/1960-149-0x00000000011B0000-0x0000000001202000-memory.dmp

Filesize
328KB

Download
memory/1960-168-0x0000000000A00000-0x0000000000AA2000-memory.dmp

Filesize
648KB

Download
memory/2780-36-0x0000000000B10000-0x0000000000BB2000-memory.dmp

Filesize
648KB

Download
memory/2780-14-0x0000000000B80000-0x0000000000BD2000-memory.dmp

Filesize
328KB

Download
memory/2780-15-0x0000000000320000-0x0000000000328000-memory.dmp

Filesize
32KB

Download
memory/2780-30-0x0000000000340000-0x0000000000348000-memory.dmp

Filesize
32KB

Download
memory/2780-32-0x00000000020C0000-0x00000000020EA000-memory.dmp

Filesize
168KB

Download
memory/2780-33-0x0000000000510000-0x000000000051C000-memory.dmp

Filesize
48KB

Download