lokibot | ce8bb22be29d0043943e2a2a0516d6138aae58dafcd9ad76236a4510e693d9f0

Analysis

max time kernel
149s
max time network
139s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
24/11/2025, 05:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LHK0987656678800.exe
Size 492KB
Sample251124-gjthvatphm
SHA256 ce8bb22be29d0043943e2a2a0516d6138aae58dafcd9ad76236a4510e693d9f0
MD5 fbcac38f851d6cb0718395382c854a80
SHA1 0f08258eaba6ad30ddd6a06ee55006d0e8c192b1
SHA512 bf5ee08f6c47a6b7af512049fd7069ad0e55f47e3231c1ce9345f74b67bc34ecfdcc1f6f95ff240e54f378a5b505ac9af59e2d44dd07195fbc99576d36476909
SSDEEP 6144:E9LoQZkJEMP4a0hOSJ6e+4wmVY2tDA5U5t5ULWmhAWpRsSvV7lpJcupktbR8Zl0b:S1kyaXmi4wmts5U5t5UtVxE98Zl053h
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery execution lokibot persistence spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://198.23.177.219/siu/pin.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Lokibot family
lokibot

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5912	powershell.exe
6012	powershell.exe
4760	powershell.exe
4868	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5324	oQrYcDBYVW.exe
2092	oQrYcDBYVW.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-954806191-3584048385-2656851463-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	LHK0987656678800.exe
Key opened	\REGISTRY\USER\S-1-5-21-954806191-3584048385-2656851463-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	LHK0987656678800.exe
Key opened	\REGISTRY\USER\S-1-5-21-954806191-3584048385-2656851463-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	LHK0987656678800.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2848 set thread context of 5160	2848	LHK0987656678800.exe	84
PID 5324 set thread context of 2092	5324	oQrYcDBYVW.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oQrYcDBYVW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LHK0987656678800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5616	schtasks.exe
5460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2848	LHK0987656678800.exe
5912	powershell.exe
6012	powershell.exe
2848	LHK0987656678800.exe
5912	powershell.exe
6012	powershell.exe
5324	oQrYcDBYVW.exe
4760	powershell.exe
4868	powershell.exe
5324	oQrYcDBYVW.exe
4760	powershell.exe
4868	powershell.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5160	LHK0987656678800.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	LHK0987656678800.exe
Token: SeDebugPrivilege	5912	powershell.exe
Token: SeDebugPrivilege	6012	powershell.exe
Token: SeDebugPrivilege	5160	LHK0987656678800.exe
Token: SeDebugPrivilege	5324	oQrYcDBYVW.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	4868	powershell.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 5912	2848	LHK0987656678800.exe	78
PID 2848 wrote to memory of 5912	2848	LHK0987656678800.exe	78
PID 2848 wrote to memory of 5912	2848	LHK0987656678800.exe	78
PID 2848 wrote to memory of 6012	2848	LHK0987656678800.exe	80
PID 2848 wrote to memory of 6012	2848	LHK0987656678800.exe	80
PID 2848 wrote to memory of 6012	2848	LHK0987656678800.exe	80
PID 2848 wrote to memory of 5616	2848	LHK0987656678800.exe	82
PID 2848 wrote to memory of 5616	2848	LHK0987656678800.exe	82
PID 2848 wrote to memory of 5616	2848	LHK0987656678800.exe	82
PID 2848 wrote to memory of 5160	2848	LHK0987656678800.exe	84
PID 2848 wrote to memory of 5160	2848	LHK0987656678800.exe	84
PID 2848 wrote to memory of 5160	2848	LHK0987656678800.exe	84
PID 2848 wrote to memory of 5160	2848	LHK0987656678800.exe	84
PID 2848 wrote to memory of 5160	2848	LHK0987656678800.exe	84
PID 2848 wrote to memory of 5160	2848	LHK0987656678800.exe	84
PID 2848 wrote to memory of 5160	2848	LHK0987656678800.exe	84
PID 2848 wrote to memory of 5160	2848	LHK0987656678800.exe	84
PID 2848 wrote to memory of 5160	2848	LHK0987656678800.exe	84
PID 5324 wrote to memory of 4760	5324	oQrYcDBYVW.exe	87
PID 5324 wrote to memory of 4760	5324	oQrYcDBYVW.exe	87
PID 5324 wrote to memory of 4760	5324	oQrYcDBYVW.exe	87
PID 5324 wrote to memory of 4868	5324	oQrYcDBYVW.exe	89
PID 5324 wrote to memory of 4868	5324	oQrYcDBYVW.exe	89
PID 5324 wrote to memory of 4868	5324	oQrYcDBYVW.exe	89
PID 5324 wrote to memory of 5460	5324	oQrYcDBYVW.exe	91
PID 5324 wrote to memory of 5460	5324	oQrYcDBYVW.exe	91
PID 5324 wrote to memory of 5460	5324	oQrYcDBYVW.exe	91
PID 5324 wrote to memory of 2092	5324	oQrYcDBYVW.exe	93
PID 5324 wrote to memory of 2092	5324	oQrYcDBYVW.exe	93
PID 5324 wrote to memory of 2092	5324	oQrYcDBYVW.exe	93
PID 5324 wrote to memory of 2092	5324	oQrYcDBYVW.exe	93
PID 5324 wrote to memory of 2092	5324	oQrYcDBYVW.exe	93
PID 5324 wrote to memory of 2092	5324	oQrYcDBYVW.exe	93
PID 5324 wrote to memory of 2092	5324	oQrYcDBYVW.exe	93
PID 5324 wrote to memory of 2092	5324	oQrYcDBYVW.exe	93
PID 5324 wrote to memory of 2092	5324	oQrYcDBYVW.exe	93

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-954806191-3584048385-2656851463-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	LHK0987656678800.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-954806191-3584048385-2656851463-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	LHK0987656678800.exe

C:\Users\Admin\AppData\Local\Temp\LHK0987656678800.exe
"C:\Users\Admin\AppData\Local\Temp\LHK0987656678800.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\LHK0987656678800.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oQrYcDBYVW.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6012
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oQrYcDBYVW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAB72.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5616
- C:\Users\Admin\AppData\Local\Temp\LHK0987656678800.exe
  "C:\Users\Admin\AppData\Local\Temp\LHK0987656678800.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:5160

C:\Users\Admin\AppData\Roaming\oQrYcDBYVW.exe
C:\Users\Admin\AppData\Roaming\oQrYcDBYVW.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5324
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oQrYcDBYVW.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4760
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oQrYcDBYVW.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oQrYcDBYVW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF32A.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5460
- C:\Users\Admin\AppData\Roaming\oQrYcDBYVW.exe
  "C:\Users\Admin\AppData\Roaming\oQrYcDBYVW.exe"
  2⤵
  - Executes dropped EXE
  PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 4911272625016872a4a101965d6a59fb384cfac824b2ca2aaf1464c7e62c826f
MD5 86922a36e5edec0ff3cd8983a62e4d87
SHA1 d4fbf2c542d2fa29397c99cbff13428a83c95dc2
SHA512 b4251f0fcaa3fe096b8e1730f7ecc810b6dd228976746cdb3e0a519978d3490334f07448466713899e9c5a67c96e0eaf7db69d744863cec0bb6466e3f24dc164
SSDEEP 384:hTHhY1SS1Uj5fvFRHEMEj1VSLUniaa8bNineZnS4REZ+5nYEZpDU1C:MSSC9dRPEb26ZnrEZ+m2UM
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 755a8021ab10e99433c3aff55485b58464b7b001577cbd7c4c41115d97948ece
MD5 a0643ae80eb18bb71598095eb996a367
SHA1 d90fbcbab1df816414dbbc44f5902fb97d7f7205
SHA512 ba753b450c889626f855ff209eed77894ac3ce5e4c757ee2dced28d1ba43d5c426928deb74837d816ac709c4256e0fd02befdc7260493f815fe4885aac0b5774
SSDEEP 384:EL3HhRjS14vaTjgqlqHEnNjjs2xtgTNmhw5919Esu0iFpX:qrjSaKUo6ajj7xtghmhy19Esu0M
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_z0v03tpz.yd2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z0v03tpz.yd2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmpAB72.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpAB72.tmp
Size 1KB
SHA256 17b3e7d8cad164f301776fd2c8d0c55b2e4c66faf50eb976c12bb3f9cf17bdb3
MD5 ee5eb3a55900a516c4cb8536b5f76a6e
SHA1 fb6ca096325beb67394e15715298125a0c2af818
SHA512 2eaf4a9a61fe62b32b204465bc4c2a82fe0ef8c030a421a7598fa07937d9c8cd8b23f4b14d168999d48bbdd84b3a2649fd8502bd6e1739c3a9edebe3a9ed8c1a
MD5 SHA1 SHA512

Submit Download

0f5007522459c86e95ffcc62f32308f1_4e9d29e8-d503-4a26-a76f-7cc312f25f4e

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-954806191-3584048385-2656851463-1000\0f5007522459c86e95ffcc62f32308f1_4e9d29e8-d503-4a26-a76f-7cc312f25f4e
Size 46B
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
MD5 SHA1 SHA512

Submit Download

0f5007522459c86e95ffcc62f32308f1_4e9d29e8-d503-4a26-a76f-7cc312f25f4e

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-954806191-3584048385-2656851463-1000\0f5007522459c86e95ffcc62f32308f1_4e9d29e8-d503-4a26-a76f-7cc312f25f4e
Size 46B
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
MD5 SHA1 SHA512

Submit Download

oQrYcDBYVW.exe

Path C:\Users\Admin\AppData\Roaming\oQrYcDBYVW.exe
Size 492KB
SHA256 ce8bb22be29d0043943e2a2a0516d6138aae58dafcd9ad76236a4510e693d9f0
MD5 fbcac38f851d6cb0718395382c854a80
SHA1 0f08258eaba6ad30ddd6a06ee55006d0e8c192b1
SHA512 bf5ee08f6c47a6b7af512049fd7069ad0e55f47e3231c1ce9345f74b67bc34ecfdcc1f6f95ff240e54f378a5b505ac9af59e2d44dd07195fbc99576d36476909
SSDEEP 6144:E9LoQZkJEMP4a0hOSJ6e+4wmVY2tDA5U5t5ULWmhAWpRsSvV7lpJcupktbR8Zl0b:S1kyaXmi4wmts5U5t5UtVxE98Zl053h
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2848-7-0x0000000005170000-0x0000000005180000-memory.dmp

Download

memory/2848-3-0x0000000005170000-0x0000000005180000-memory.dmp

Download

memory/2848-1-0x0000000005500000-0x0000000005AA6000-memory.dmp

Download

memory/2848-2-0x0000000004F50000-0x0000000004FE2000-memory.dmp

Download

memory/2848-8-0x0000000006730000-0x000000000678C000-memory.dmp

Download

memory/2848-0-0x0000000000380000-0x0000000000402000-memory.dmp

Download

memory/2848-4-0x0000000005050000-0x000000000505A000-memory.dmp

Download

memory/2848-6-0x00000000065E0000-0x00000000065F2000-memory.dmp

Download

memory/2848-5-0x0000000005180000-0x000000000521C000-memory.dmp

Download

memory/4760-91-0x0000000005A90000-0x0000000005DE7000-memory.dmp

Download

memory/4760-102-0x00000000716B0000-0x00000000716FC000-memory.dmp

Download

memory/4760-101-0x00000000060F0000-0x000000000613C000-memory.dmp

Download

memory/4868-109-0x00000000716B0000-0x00000000716FC000-memory.dmp

Download

memory/4868-116-0x0000000006F30000-0x0000000006FD4000-memory.dmp

Download

memory/4868-117-0x0000000007210000-0x0000000007221000-memory.dmp

Download

memory/4868-118-0x0000000007250000-0x0000000007265000-memory.dmp

Download

memory/5160-127-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/5160-132-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/5160-24-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/5160-23-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/5912-25-0x0000000005820000-0x0000000005B77000-memory.dmp

Download

memory/5912-61-0x0000000006CB0000-0x0000000006D54000-memory.dmp

Download

memory/5912-45-0x0000000006C50000-0x0000000006C84000-memory.dmp

Download

memory/5912-62-0x0000000007650000-0x0000000007CCA000-memory.dmp

Download

memory/5912-63-0x0000000007010000-0x000000000702A000-memory.dmp

Download

memory/5912-64-0x0000000007090000-0x000000000709A000-memory.dmp

Download

memory/5912-46-0x0000000075900000-0x000000007594C000-memory.dmp

Download

memory/5912-54-0x0000000006C90000-0x0000000006CAE000-memory.dmp

Download

memory/5912-40-0x0000000005D50000-0x0000000005D9C000-memory.dmp

Download

memory/5912-39-0x0000000005BC0000-0x0000000005BDE000-memory.dmp

Download

memory/5912-18-0x00000000051F0000-0x000000000581A000-memory.dmp

Download

memory/5912-15-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Download

memory/5912-14-0x0000000000D00000-0x0000000000D36000-memory.dmp

Download

memory/5912-13-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Download

memory/6012-17-0x0000000002220000-0x0000000002230000-memory.dmp

Download

memory/6012-70-0x00000000070D0000-0x00000000070D8000-memory.dmp

Download

memory/6012-69-0x00000000070E0000-0x00000000070FA000-memory.dmp

Download

memory/6012-68-0x0000000006FE0000-0x0000000006FF5000-memory.dmp

Download

memory/6012-67-0x0000000006FD0000-0x0000000006FDE000-memory.dmp

Download

memory/6012-66-0x0000000006FA0000-0x0000000006FB1000-memory.dmp

Download

memory/6012-65-0x0000000007020000-0x00000000070B6000-memory.dmp

Download

memory/6012-53-0x0000000075900000-0x000000007594C000-memory.dmp

Download

memory/6012-20-0x0000000004BA0000-0x0000000004BC2000-memory.dmp

Download

memory/6012-22-0x00000000053E0000-0x0000000005446000-memory.dmp

Download

memory/6012-21-0x0000000005370000-0x00000000053D6000-memory.dmp

Download

memory/6012-16-0x0000000002220000-0x0000000002230000-memory.dmp

Download