cobaltstrike | 67c14d481a2795e74d862fe02bce778dbca9fcfc0d60e1321599ada6ea385895

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Size

7.5MB
MD5

609e5b6b5a19062f287c31e5618e592f
SHA1

f3dbdbba57a23a17cc35a281c98502bdddaf66f9
SHA256

67c14d481a2795e74d862fe02bce778dbca9fcfc0d60e1321599ada6ea385895
SHA512

0a58d30b40206aeb0c8b8ab4e46fc00a192c91a7468f52a29d1db8c8fd7e01c2829edda1d3164fc5d041ec6d538069571837b73fe6177ba120558686cb56203a
SSDEEP

98304:bGUjSb/X0Z3y/t2uDN8nsk/39999999999eEN3JjAUtw6MT4nR8CZqXebhnp3aJZ:bGUGb/X0Zi/t2uDN8qurYmd08uuI

Score

10^/10

cobaltstrike xmrig backdoor miner trojan

Malware Config

Signatures

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

Processes:

resource	yara_rule
F:\USBDriver.exe	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 15 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1936-636-0x0000000000400000-0x0000000000DBD000-memory.dmp	xmrig
behavioral1/memory/1936-691-0x0000000000400000-0x0000000000DBD000-memory.dmp	xmrig
behavioral1/memory/1936-1124-0x0000000000400000-0x0000000000DBD000-memory.dmp	xmrig
behavioral1/memory/1936-1125-0x0000000000400000-0x0000000000DBD000-memory.dmp	xmrig
behavioral1/memory/1936-1200-0x0000000000400000-0x0000000000DBD000-memory.dmp	xmrig
behavioral1/memory/1936-1781-0x0000000000400000-0x0000000000DBD000-memory.dmp	xmrig
behavioral1/memory/1936-2270-0x0000000000400000-0x0000000000DBD000-memory.dmp	xmrig
F:\USBDriver.exe	xmrig
behavioral1/memory/1936-2921-0x0000000000400000-0x0000000000DBD000-memory.dmp	xmrig
behavioral1/memory/1936-2982-0x0000000000400000-0x0000000000DBD000-memory.dmp	xmrig
behavioral1/memory/1936-3473-0x0000000000400000-0x0000000000DBD000-memory.dmp	xmrig
behavioral1/memory/1936-3582-0x0000000000400000-0x0000000000DBD000-memory.dmp	xmrig
behavioral1/memory/1936-3809-0x0000000000400000-0x0000000000DBD000-memory.dmp	xmrig
behavioral1/memory/1936-3864-0x0000000000400000-0x0000000000DBD000-memory.dmp	xmrig
behavioral1/memory/1936-4355-0x0000000000400000-0x0000000000DBD000-memory.dmp	xmrig

Drops desktop.ini file(s) 1 IoCs

Processes:

609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe

description	ioc	process
File created	C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

150 raw.githubusercontent.com
240 raw.githubusercontent.com
290 raw.githubusercontent.com
148 raw.githubusercontent.com

flow	ioc
150	raw.githubusercontent.com
240	raw.githubusercontent.com
290	raw.githubusercontent.com
148	raw.githubusercontent.com

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe

description	ioc	process
File created	D:\autorun.inf	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
File created	F:\autorun.inf	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
File opened for modification	F:\autorun.inf	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe

Modifies Internet Explorer start page 1 TTPs 12 IoCs

stealer

Modify Registry

T1112

Processes:

609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.JwhXLaWIJK.com"	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.CCDPEqRdkt.com"	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.rSNLFlnXSe.com"	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.scUxXbhvUz.com"	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.VNYSbgmKhe.com"	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.xnpmzADAzV.com"	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.ybrInKGnlm.com"	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.jJayWlREww.com"	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.echudzwKxs.com"	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.uWZCBZEjVq.com"	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.SGpvaPeCwi.com"	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.lhJpETJudi.com"	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 17 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe

description	pid	process
Token: SeLockMemoryPrivilege	1936	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1936	609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\609e5b6b5a19062f287c31e5618e592f_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa3a4ff4be23a086a0bf02dcafd8f669

SHA1
29bf500d35400d273d3bde83c4c8eabbd77a9b7f

SHA256
e72734708cbc93cbf53b1019b1550524eaa4c8d9dc226f0e82dee750ea54e84e

SHA512
63a20a9d1f135029deeb74dd500e1b1749a66ca5e09dc17419bb1a7973be7e8c37e511084088748dd93a06dd7fcd33a47ca4b4f37de1cc89a9c2b64ce65fef89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0663a06ef22667d0966294d675a1343

SHA1
d8aee9edfba1424fbb7ff005e7863bf61ce094b1

SHA256
66f098225b6283b6e261c80558f72aa824f766419fc9877f7be0967378032a13

SHA512
0795ce3ead2adc929184a7d861c36937c635ad4ad2c7548810fb44e1bf656d8734e504799a377ea0ffa894d7e764dc07de32784cfe41ae9486575486fd14b7eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e46920691b4cb6e24e3c5b1c6935129

SHA1
847a1e311286338956cc9683ae3f0f4f516a85c9

SHA256
559344f439d59e09b23f214604d74be3586e3eda0bbfa3bbe8472d9db71dfa44

SHA512
187ae27798c20186b7607216b2bdf86558ca0e269d6d61bb9da80d1a0c3d2d3aa5173f082776e5b7f00ee21c67aba16260ed71ff4dd9cb15cef3d27608978589

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15c026b3aa60066db33e8b2b2a7b9a7b

SHA1
34af8384a499dfd45ac31001ca766b86639ac5a5

SHA256
bd5698a0f46a10e27a4023934e9b05b78acf28c9f6e9b497266a6343ff5be718

SHA512
49a4fd27c3725b7aedf760f98cc5600080175ebf77a813a8399f944653557643a645cbc29efcd76dacadcf2e5836eda855658b9c41ab31c90c83cfe54f84b301

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57cedacf04863ddacd74e136fde41647

SHA1
42b4022b92c31c4134e49edc8c2f7582647ffbce

SHA256
de344aca4f1592d36c40a60d89a03f4569f51c1a0d3e6a0949863de4fc0d68bb

SHA512
b5d1266e6a56ae6fbf08b258ba310b25c9f2a8d3d78637b7e71459560d2aaa29e2d236f8f7a43b34976d9373cde09e5a26b6179d28b1b0e0e024d80bcb9ef66d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eba9293deb52894b6c432e56793e4fce

SHA1
76ed3a7100fa651f121e324019bc7ef1fb032566

SHA256
136ec0500940aac0fb84a6ab3fe5ad3ddc2e73c36949a70d3727352b8270e7f0

SHA512
a83dd3f744e027e510d3e1b68e85ab69ef02e5865a8167e89af4e87d4485553cb225853a4536718a8639bd0b40c29216d7d9e884062d949dbd47d16522cbacad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07033f6dc53c9fc5f2161717bb06c1ee

SHA1
b0d0bf3536f39598ce7029fde4bb8a286c955a36

SHA256
ceaa4b0d81f49b4572a489b99dce7971b24e27a7115fb766c42885f7e85367ba

SHA512
8896443295da9c7dada26ffe5568f467857b782e086fc0eefa3d9cd216f0b9dc7a63b633791d5a572c88df5b72d213b61850d7f45ae356949b154c9c6226a4c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e894c00abdc0f5c7ec88f328f980b2f

SHA1
34158d432c66f31e01ef32efee71fa23d3735de1

SHA256
3b803b76c60ce7200854b34417f9b3a20fb0bfb7d5ab7f3961afc18dc60a7fd9

SHA512
b16fed1e319c5e7f4805ac49d1e89c3534aca3adbb3956ef7205bb110bb9b5a25330b60b8d1ede4308b89f0b5eb12e667b6fd0ac3d9eed5db3ede410c30c176c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28278baf0e95e5ccd676e72adeb46d8b

SHA1
c94b274a8c38c55d0c03eaedb19840c5b3ffbb5b

SHA256
a441445355658d5a264b9a1363c7d23516f6f58a8ac266393d3d4fe45e332361

SHA512
44df15e4f7f696d71ec47e869fd0e5068d05938a7b6c061130ae1a84bd25c9bbfba801a4c2175df62f3445624c46e09650246a2414a8fc20dcd0c140f82428e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff69b2f53b5bf33fd4b8401c427adac7

SHA1
2b4cbaa0f1f0142d6a8bc292b451e3d4adc4fe0d

SHA256
6e8444a031ec916c122fdf97a545c3c2e70453f44d26e5f45ab5e38d175c6622

SHA512
5453573aa5593ab44fad8cf41040b59e65ca8c9d701bc5bdc3ec14fda1cd0b7dedb2924a4b838cfc157035e615d5e4a3fd27b5176f6ad627162bba2c35882ffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdfd2b8947f0c68b6d0d76c7d61f56ff

SHA1
48bdcbd1841701b4a3e7e4b702a6953558a1fae0

SHA256
1bf2c089ebfbdb3dcf291c6a774dcdeef9008cf61a9e1ed21ac60b04e80a03f6

SHA512
e518f519e11ba139372a7c8bde130d40648992e5d36bd196c19e48ba209465aee49e574a4555b238dfe03b13825428f1a4d377a935b3426dce6bfd9d7aaff6eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2afa777fdf98ed4d87b0fea6758cf3df

SHA1
0d319538b66046d34c6d8a954758a29f732421be

SHA256
420ba56b4995883e9b2b548c5d9d922f5a578bbbd60376c8f828b9619212d24c

SHA512
4c85678ee8915f7e59e323c2facb6eddf9d4fb11d7b157343451de9a349862a675edb1a76ff408979ee81d4e1500a64574e15fc7a96e3572bb693911b1af2271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e8e2dcca1fcfaf39d150e533d6e26cf

SHA1
fc514990802fc46a826dea52c177b9ecb1a32e3d

SHA256
1d7bf1087132ab6ee4c2d3fe17d8922ec50c14157faead59a292154ef72d192b

SHA512
afa7286b2c05e050124227db9f684cf703c58bd3346df77b9e40cb8129e5f574879a715e4df59fe7bcbd9944b94ba3a22ac417803c5d3d6a26763324861c8e6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad44a4e19643003a6d40c405b8e76001

SHA1
f3ef056dbb60b82370226349cbed22379a790f22

SHA256
f8c0b658df5e40ea4a12083a28e77f5710a70c01153a34e7a314ca0397519e59

SHA512
26041722c065c3d8fea35646c664874f11fac24223da5bacf553f70118775df5a5b15aa488d047ca3dc7c3fc585987390c822d13e4a2ee397beef6773787e5ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46a9b3deb15b7faeddff55badd64edbd

SHA1
cce21adc92c90a9ac509c174a965c248bd5aba6e

SHA256
3527f95a75872365fdf848bbb3578321d6b1bb4b4fcd057da9d8b9ead28f3438

SHA512
dda4204ff9f43ffdea4ed57aa06b898cea391828e2713a71cbc3f72353c73bc9bb04fa08dcf1f92784b1e5fec4af9c943d0eb2e47ce569c7b7677d10c12bcfef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abb7d9d3424fad7425c67eef76a4a63e

SHA1
4006fc68c3d1eea0c16934d8ec5d5a497b097ea5

SHA256
a5ab2233137ffcbdf887b94406ed2bca00197ba6f6cf67c6f7fe275432fff239

SHA512
4f5d52272b5607f3344fb14a8bf51f7db2e1c0ae3a32d8d7944fdcaaf18d9835f5a3e95a7dc9e00d02e3649e728ff8054d5d1257ac0b1109a6f4f71b49627c85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5b1c75c21daae41e90506dbf0b16e03

SHA1
60133cc61d19689d68b3d119831f1f7cd4687acc

SHA256
b6c877c0300d2806492c9da4ea011f8fd3e0969b722fb9d77cdd4a22dae17890

SHA512
4fe9e1ab43686d12707fbd5188c08dd8d677e72a9aad67d4a005ee2fa33082bf89b12846eedb5d7eceb7180dae86c43dea9f253bf527661d6ecc2af5d8964b8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33a176996b05c1f735a8f88fa71c7814

SHA1
8ba91f5b7c92b213a3058b57e9b6b58c1fe82a25

SHA256
a942ec6a049605ba61b9fa313438e285ac26767fa9136b04993f9b6936f83a5e

SHA512
35f011fd1547b9f3b4c950777de38c69e2eead2cec5fe65d9e67d9667e09ef421ae908f6325fe51208fb89ca3dd917a9177a4d2cb53057cc98ef1e52bca4eb7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b99c1e41b83b42dafa72670642a8d47e

SHA1
84b4845968b12d9b3e6dcae8035f0a5c51c19a5e

SHA256
40b82474c079a025b544c639acfebec3546b23eae1cdf3c2d6c66f4832d904f2

SHA512
ae23c116eb965bce8c4ef1e85bece6eb4c7d718c9a956edec5c05a7d821d4b20728a9fe7b9818873652a1f9c6a4baa683fb4223cea6e9372508ab7177174c2fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dd5705af3e07a363dac4d2604cdc8fc

SHA1
285bc5df6894844d326974d7eb955af69f68f994

SHA256
4f3804e9261febf502e369b25272895018a1a1a83cc5cbd75ad62b3b734d2cb8

SHA512
60fd584abcf55f21d11214677190fd4b58367788c745652a721d118dcde4dc17aeb083dc847a41a38ad64539149142333251674c1b5abae84723c003f711cbd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90b4d7f7f755ff9c6cf2f1427c389d5d

SHA1
5bcfc9816f29715789e68aaa06ba899ce435b8bf

SHA256
46a854e6dc46760d233c6f114d332c10aac91ca0d43eecd47a3bcb89a5ceeaae

SHA512
aac53be0e5b6996b7fdfbbd040fcd8b7555e0b6a206553f660e0651fcc8a6c4d218a58fe2b1da09d10a5c71893d74d8edde37ffc9bcad0522359d83275eef9f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
322ae135475043083689e15e323592b9

SHA1
c52fb277ebbeff123e5783b6f2098f7e5b9debe6

SHA256
8749f759b0f8c748be74bbb803b393c87c796a3113e82a66ab48f671e2db0b5f

SHA512
641cc1bedb575103d29505b9fecaf03043ab37008e6a981b1537c30c8aa17b0b4a5d06b3bcdb5d5e013d1eff3f7a4fc1632bbbd165ca48d18449cf9a9b876ba5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9e536f821757e5ef3c0b5e5c0f16c79

SHA1
af0a7ea9a2f694ab1248e558f862d418b0311aa8

SHA256
fd64ff970d75dafe3f51faee1335045a1bd6a76c9989d1e87c05f7b5c9cd72f8

SHA512
a460bf482dd5235442cebd49c784e89a9d937010763bdbdbb120eefcb1049ee9a09b260b2d87b3addef187e43ae2975777df81e14af29d62bbc1a46250da9ff6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b733cf7578e4f6381c4ed0af7940f24

SHA1
23cb4ce3334d123cbbd38a1c93ea5f7863cedd76

SHA256
8a5889260f1e578f7a27edc7c0ee1efa52c3665251ca0fbb45d50c500781e044

SHA512
2a3ac653766557107e0017adb82fb202ced6a0e5404de525580e455f3c25886171314dd9b7e58b17e16952986b7717d57a8a15c4923156ea3f7808e5fa302465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
535e99eb6f008c49c2d192c4d9835409

SHA1
5abd9d2c981ba2cf2f6d4e4113daf94955bd6607

SHA256
41b94f0f8c7c67b00a6016359b9ca29ee1977bb0b1c9a071df52276db62d96c1

SHA512
a77b393e3b28abd0c5a6f3fca595cac86a4ea0ef56e711b49dbbb63c901ce96f5357dc9ffc712337af11f2f7cee6a34a88795ff7cf615b185c00edfa24c427a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffa9ce5059188bd22bb54e0652e284fa

SHA1
8fa73cc84801f1a8e5d4fc638af4ceca9fd98637

SHA256
ea68a4651d753790e3b7d6da613c1d18d954bba2bc5239906e42c289ade4a357

SHA512
258339d46d567e957d8352e34b07f3cd200ae8bdc54738f75613fd3e0c25e962eb69eb882f18e451b4a989edd6016812ae38be1f0ce86503da8b9718cbc36c32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57e65cb8e1918f61ff9fdda515ae8cd7

SHA1
440e0672e81ca9dfd47f359271c42f75e67bdbb6

SHA256
f314e588e7904680c09a7365c3582408dcbb69b66cf55a33c298cfe081827404

SHA512
ebd222b783b52ae8e7157d5ea254804b2bf3d93b771086fbfde3e03eac0006826cd0df28475ab24d2d4a961dc4897db71c7a4c69adaa4c246b0d1908aebbcbbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4bde3952c6818e50349603812b9b45b

SHA1
6150f901f45bd51d15455b21c81858d41a0e45b4

SHA256
de0033afff8f14686a53368f438e44e9182ab5491104df420c7e73e63fe6a829

SHA512
3abbdbb510ea5a9cc47260f6b2c20e2e2dabaec1c54345acfc7aa9ef83529b6a5dcd8058736ba299dba4f3f5575b100039bc32e6b418afb5d58be94ad86d0d6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c12566241e1642ea5346af20a3bf9f7

SHA1
f0c49b5b442d25976ddeb496b91bd4cff56f4f60

SHA256
89d73cf1e91c90b14da91df6fb0e1ac8e6650c22c087ef10da22015b7c21452e

SHA512
508a423e141834b7b950b6583529e85a388be83aba81aaf01bcf7c6b7d81337c2f86557ea9b2695ee738e9d7bbb9ff3e911952c7655da46b1d37f3b6e3b70d26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D52.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D65.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
F:\USBDriver.exe

Filesize
7.5MB

MD5
609e5b6b5a19062f287c31e5618e592f

SHA1
f3dbdbba57a23a17cc35a281c98502bdddaf66f9

SHA256
67c14d481a2795e74d862fe02bce778dbca9fcfc0d60e1321599ada6ea385895

SHA512
0a58d30b40206aeb0c8b8ab4e46fc00a192c91a7468f52a29d1db8c8fd7e01c2829edda1d3164fc5d041ec6d538069571837b73fe6177ba120558686cb56203a

Download Submit
F:\autorun.inf

Filesize
30B

MD5
889582a1f03237bcdb184835adc90cfe

SHA1
126f1a62951d5841365323609eec048df5054224

SHA256
4cfc1d1cf149df6f4f27d1d34842adc2e79cef413ca76d92928ee9b6709d7518

SHA512
debab66dab530f5ff7143dff5375c07aa6b9d8747184909c842752d14f6eb8b72a90b8cd02f62a81382a85a4a7c4d16ebbce50f579b99df073535ea64cce2194

Download Submit
F:\autorun.inf

Filesize
26B

MD5
1935cdab3da6383f98941575f1e8008d

SHA1
fa28e3d3a3c72ebf691233fc8fe9f236b08fe8a3

SHA256
f1070351b8c0a4c68c56112ccbb8fcad6d3730e2b24df38167f43284372bc438

SHA512
a7f03a4e04a8d479c92f96884791b6b3462119c1e2e8a8f99f9d94dacdc3d39853d62755210dbd9f8a416506a08a5e949d5f998c9e02df0b15e3b9d04e7f1e02

Download Submit
memory/1936-3582-0x0000000000400000-0x0000000000DBD000-memory.dmp

Filesize
9.7MB

Download
memory/1936-636-0x0000000000400000-0x0000000000DBD000-memory.dmp

Filesize
9.7MB

Download
memory/1936-2270-0x0000000000400000-0x0000000000DBD000-memory.dmp

Filesize
9.7MB

Download
memory/1936-4355-0x0000000000400000-0x0000000000DBD000-memory.dmp

Filesize
9.7MB

Download
memory/1936-1125-0x0000000000400000-0x0000000000DBD000-memory.dmp

Filesize
9.7MB

Download
memory/1936-1124-0x0000000000400000-0x0000000000DBD000-memory.dmp

Filesize
9.7MB

Download
memory/1936-3864-0x0000000000400000-0x0000000000DBD000-memory.dmp

Filesize
9.7MB

Download
memory/1936-1200-0x0000000000400000-0x0000000000DBD000-memory.dmp

Filesize
9.7MB

Download
memory/1936-691-0x0000000000400000-0x0000000000DBD000-memory.dmp

Filesize
9.7MB

Download
memory/1936-1781-0x0000000000400000-0x0000000000DBD000-memory.dmp

Filesize
9.7MB

Download
memory/1936-3473-0x0000000000400000-0x0000000000DBD000-memory.dmp

Filesize
9.7MB

Download
memory/1936-0-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/1936-2982-0x0000000000400000-0x0000000000DBD000-memory.dmp

Filesize
9.7MB

Download
memory/1936-2921-0x0000000000400000-0x0000000000DBD000-memory.dmp

Filesize
9.7MB

Download
memory/1936-3809-0x0000000000400000-0x0000000000DBD000-memory.dmp

Filesize
9.7MB

Download