lokibot | 34f9dfcc766eaba14087b30209c5eb8856f7cbea2600f71f4e31eaab85d3db0b

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe
Size

2.2MB
MD5

eeaa7f99337e043d590cc21b4e24eece
SHA1

a517be28d8fbc2a5c4c91ef27c55bff3fa9e6baa
SHA256

34f9dfcc766eaba14087b30209c5eb8856f7cbea2600f71f4e31eaab85d3db0b
SHA512

66270f0fd598b38227697198cd2d33eb9fd2f07aa9e5ee8b07554d9ec4b90f6886985b5f3a1beef634efb4fd25379d161e1974a529f3dfcc79454dc4fe9a1b55
SSDEEP

24576:fadJQrQVLRMYZJk9kFvk+6mADR8To1Vzh3KFHtqneNrzjzfA5a5pU9aOXUP2brPy:f3rqUK8dDjh3QN8ic4+UOb4RueGlWOBS

Score

10^/10

lokibot xtremerat collection credential_access discovery persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xtremerat

frigetraassse3.net

Extracted

Family

lokibot

http://lagenceengineering.com/wp-includes/fonts/app/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Detect XtremeRAT payload 6 IoCs

resource	yara_rule
behavioral2/memory/4952-4-0x0000000004D30000-0x0000000004DEC000-memory.dmp	family_xtremerat
behavioral2/memory/2572-6-0x0000000000C80000-0x0000000000D3C000-memory.dmp	family_xtremerat
behavioral2/memory/2572-8-0x0000000000C80000-0x0000000000D3C000-memory.dmp	family_xtremerat
behavioral2/memory/2572-9-0x0000000000C80000-0x0000000000D3C000-memory.dmp	family_xtremerat
behavioral2/memory/2572-10-0x0000000000C80000-0x0000000000D3C000-memory.dmp	family_xtremerat
behavioral2/memory/2572-34-0x0000000000C80000-0x0000000000D3C000-memory.dmp	family_xtremerat

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{4QGI7678-00JC-E7DQ-T0Y1-70UK63HV761N}	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4QGI7678-00JC-E7DQ-T0Y1-70UK63HV761N}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	vbc.exe

Executes dropped EXE 1 IoCs

pid	Process
800	876lkk.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	vbc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	vbc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4952 set thread context of 2572	4952	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	82
PID 800 set thread context of 5020	800	876lkk.exe	119

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	vbc.exe
File created	C:\Windows\InstallDir\Server.exe	vbc.exe
File opened for modification	C:\Windows\InstallDir\	vbc.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	876lkk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4952	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe
4952	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe
800	876lkk.exe
800	876lkk.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe
Token: SeDebugPrivilege	800	876lkk.exe
Token: SeDebugPrivilege	5020	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2572	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 2572	4952	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	82
PID 4952 wrote to memory of 2572	4952	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	82
PID 4952 wrote to memory of 2572	4952	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	82
PID 4952 wrote to memory of 2572	4952	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	82
PID 4952 wrote to memory of 2572	4952	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	82
PID 4952 wrote to memory of 2572	4952	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	82
PID 4952 wrote to memory of 2572	4952	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	82
PID 4952 wrote to memory of 2572	4952	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	82
PID 4952 wrote to memory of 2572	4952	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	82
PID 4952 wrote to memory of 2572	4952	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	82
PID 4952 wrote to memory of 2572	4952	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	82
PID 2572 wrote to memory of 1848	2572	vbc.exe	83
PID 2572 wrote to memory of 1848	2572	vbc.exe	83
PID 2572 wrote to memory of 1848	2572	vbc.exe	83
PID 2572 wrote to memory of 448	2572	vbc.exe	84
PID 2572 wrote to memory of 448	2572	vbc.exe	84
PID 2572 wrote to memory of 2292	2572	vbc.exe	85
PID 2572 wrote to memory of 2292	2572	vbc.exe	85
PID 2572 wrote to memory of 2292	2572	vbc.exe	85
PID 2572 wrote to memory of 3832	2572	vbc.exe	86
PID 2572 wrote to memory of 3832	2572	vbc.exe	86
PID 2572 wrote to memory of 640	2572	vbc.exe	87
PID 2572 wrote to memory of 640	2572	vbc.exe	87
PID 2572 wrote to memory of 640	2572	vbc.exe	87
PID 2572 wrote to memory of 4756	2572	vbc.exe	88
PID 2572 wrote to memory of 4756	2572	vbc.exe	88
PID 2572 wrote to memory of 2360	2572	vbc.exe	89
PID 2572 wrote to memory of 2360	2572	vbc.exe	89
PID 2572 wrote to memory of 2360	2572	vbc.exe	89
PID 2572 wrote to memory of 3460	2572	vbc.exe	90
PID 2572 wrote to memory of 3460	2572	vbc.exe	90
PID 2572 wrote to memory of 4248	2572	vbc.exe	91
PID 2572 wrote to memory of 4248	2572	vbc.exe	91
PID 2572 wrote to memory of 4248	2572	vbc.exe	91
PID 2572 wrote to memory of 1044	2572	vbc.exe	92
PID 2572 wrote to memory of 1044	2572	vbc.exe	92
PID 2572 wrote to memory of 3688	2572	vbc.exe	93
PID 2572 wrote to memory of 3688	2572	vbc.exe	93
PID 2572 wrote to memory of 3688	2572	vbc.exe	93
PID 2572 wrote to memory of 4004	2572	vbc.exe	94
PID 2572 wrote to memory of 4004	2572	vbc.exe	94
PID 2572 wrote to memory of 4172	2572	vbc.exe	95
PID 2572 wrote to memory of 4172	2572	vbc.exe	95
PID 2572 wrote to memory of 4172	2572	vbc.exe	95
PID 2572 wrote to memory of 4840	2572	vbc.exe	98
PID 2572 wrote to memory of 4840	2572	vbc.exe	98
PID 2572 wrote to memory of 2536	2572	vbc.exe	99
PID 2572 wrote to memory of 2536	2572	vbc.exe	99
PID 2572 wrote to memory of 2536	2572	vbc.exe	99
PID 2572 wrote to memory of 1732	2572	vbc.exe	100
PID 2572 wrote to memory of 1732	2572	vbc.exe	100
PID 2572 wrote to memory of 1096	2572	vbc.exe	101
PID 2572 wrote to memory of 1096	2572	vbc.exe	101
PID 2572 wrote to memory of 1096	2572	vbc.exe	101
PID 2572 wrote to memory of 1832	2572	vbc.exe	102
PID 2572 wrote to memory of 1832	2572	vbc.exe	102
PID 2572 wrote to memory of 1228	2572	vbc.exe	103
PID 2572 wrote to memory of 1228	2572	vbc.exe	103
PID 2572 wrote to memory of 1228	2572	vbc.exe	103
PID 2572 wrote to memory of 116	2572	vbc.exe	106
PID 2572 wrote to memory of 116	2572	vbc.exe	106
PID 2572 wrote to memory of 2012	2572	vbc.exe	107
PID 2572 wrote to memory of 2012	2572	vbc.exe	107
PID 2572 wrote to memory of 2012	2572	vbc.exe	107

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	vbc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vbc.exe

C:\Users\Admin\AppData\Local\Temp\eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:448
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:2292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3832
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4756
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3460
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1044
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4004
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4840
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1832
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:116
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3232
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2384
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4028
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3896
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4588
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:2136
- - C:\Users\Admin\AppData\Local\Temp\876lkk.exe
    "C:\Users\Admin\AppData\Local\Temp\876lkk.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:800
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:5020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\876lkk.exe

Filesize
655KB

MD5
a27864f20c8a30f578f06e329187726c

SHA1
0ed25fa987698b65ecd280eee2b84b9f8abe98a7

SHA256
ac14b5cdad4964d720eb02bea586821d82997d281a1aad5bb4f70a8a460873c8

SHA512
d9c794b173cd1629d936cf4d67f5184848e7b6f56ed25ec6093419aed675e3b06957f50260781afa33818938d80a7def7cc663237d8433d44b441b86bdab07b3

Download Submit
C:\Users\Admin\AppData\Roaming\D7CF12\2C2127.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-786284298-625481688-3210388970-1000\0f5007522459c86e95ffcc62f32308f1_1b74ca46-c49b-4c52-a57d-8cd1ff70c625

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-786284298-625481688-3210388970-1000\0f5007522459c86e95ffcc62f32308f1_1b74ca46-c49b-4c52-a57d-8cd1ff70c625

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
memory/800-31-0x0000000005450000-0x00000000054F2000-memory.dmp

Filesize
648KB

Download
memory/800-30-0x0000000001620000-0x000000000164A000-memory.dmp

Filesize
168KB

Download
memory/800-29-0x0000000000BC0000-0x0000000000C52000-memory.dmp

Filesize
584KB

Download
memory/2572-34-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/2572-9-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/2572-10-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/2572-8-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/2572-6-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/4952-3-0x0000000002700000-0x000000000270C000-memory.dmp

Filesize
48KB

Download
memory/4952-4-0x0000000004D30000-0x0000000004DEC000-memory.dmp

Filesize
752KB

Download
memory/4952-0-0x000000007528E000-0x000000007528F000-memory.dmp

Filesize
4KB

Download
memory/4952-5-0x0000000004FA0000-0x000000000503C000-memory.dmp

Filesize
624KB

Download
memory/4952-2-0x0000000004C00000-0x0000000004CC2000-memory.dmp

Filesize
776KB

Download
memory/4952-1-0x0000000000120000-0x0000000000346000-memory.dmp

Filesize
2.1MB

Download
memory/5020-32-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/5020-36-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/5020-57-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/5020-71-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download