a52ba33e7b386e933d1a6ae99f257315935d4c68cd21f91e987d327683f9c990

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
Size

8.8MB
MD5

6d2252d1f81e4a89059e7fbf6d4d0ecf
SHA1

fd182a7b2236b0bf447ac940d26b230fc75c54f3
SHA256

a52ba33e7b386e933d1a6ae99f257315935d4c68cd21f91e987d327683f9c990
SHA512

cfa5ead005026c01a3a72eca8d1a50ccce02283146f6e6ba99945d3e25879b7314a392cb342e8018b860b16dc10ff6db08168815a4fad84a49f9cb43f4676871
SSDEEP

196608:EwWfZ4PDKMxSIFQColSp5oNeW7f9VBQWwigouggCJEmvPjUide:1WfZ47X4QolSXglfiouggC2m4D

Score

8^/10

discovery evasion execution persistence spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

5436 powershell.exe
5632 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Drops file in Drivers directory 1 IoCs

Processes:

6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe

description ioc process

File created C:\Windows\system32\drivers\39a7eed1b01781a6d51a82ee4de8f1e0.sys 6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Executes dropped EXE 3 IoCs

Processes:

nsr7D32.tmpdff269b1874ee4e2fa65b26beaa5fac0.exedff269b1874ee4e2fa65b26beaa5fac0.exe

pid process

4052 nsr7D32.tmp
5412 dff269b1874ee4e2fa65b26beaa5fac0.exe
5508 dff269b1874ee4e2fa65b26beaa5fac0.exe

pid	process
5436	powershell.exe
5632	powershell.exe

description	ioc	process
File created	C:\Windows\system32\drivers\39a7eed1b01781a6d51a82ee4de8f1e0.sys	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe

pid	process
4052	nsr7D32.tmp
5412	dff269b1874ee4e2fa65b26beaa5fac0.exe
5508	dff269b1874ee4e2fa65b26beaa5fac0.exe

Loads dropped DLL 64 IoCs

Processes:

6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exensr7D32.tmp

pid	process
2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp
4052	nsr7D32.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 9 IoCs

Processes:

dff269b1874ee4e2fa65b26beaa5fac0.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\SSL\cert.db	dff269b1874ee4e2fa65b26beaa5fac0.exe
File opened for modification	C:\Windows\System32\SSL\xtls.db	dff269b1874ee4e2fa65b26beaa5fac0.exe
File opened for modification	C:\Windows\System32\SSL\xv.db	dff269b1874ee4e2fa65b26beaa5fac0.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\System32\SSL	dff269b1874ee4e2fa65b26beaa5fac0.exe
File created	C:\Windows\System32\SSL\cert.db	dff269b1874ee4e2fa65b26beaa5fac0.exe
File opened for modification	C:\Windows\System32\SSL\x.db	dff269b1874ee4e2fa65b26beaa5fac0.exe
File opened for modification	C:\Windows\System32\SSL\4e4f2afe94b0fae0.cer	dff269b1874ee4e2fa65b26beaa5fac0.exe

Drops file in Program Files directory 8 IoCs

Processes:

6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\0b3b547fd93c69f67a64b1d149c763ac\3ec8dcc7c5955ffa43c6c7127b87e5e0\5749cbc5f67e00f696cae5d3008bd7c3.ico	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
File created	C:\Program Files\0b3b547fd93c69f67a64b1d149c763ac\115c915088b333bca4c93f98f39d62df.ico	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
File created	C:\Program Files\0b3b547fd93c69f67a64b1d149c763ac\80a87b0b5040b12e5eac711401067591	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
File created	C:\Program Files\0b3b547fd93c69f67a64b1d149c763ac\dff269b1874ee4e2fa65b26beaa5fac0.exe	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
File created	C:\Program Files\0b3b547fd93c69f67a64b1d149c763ac\2af5ece3c0280f009e95996a566a5132.exe	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
File created	C:\Program Files\0b3b547fd93c69f67a64b1d149c763ac\90922cb71dfcba41381ba4b1ebc3b903.exe	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
File created	C:\Program Files\0b3b547fd93c69f67a64b1d149c763ac\3ec8dcc7c5955ffa43c6c7127b87e5e0\115c915088b333bca4c93f98f39d62df.ico	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
File created	C:\Program Files\0b3b547fd93c69f67a64b1d149c763ac\3ec8dcc7c5955ffa43c6c7127b87e5e0\3de44fcb5fa1b3b08a775e6470e291a1.ico	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

Processes:

dff269b1874ee4e2fa65b26beaa5fac0.exe6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\system32	dff269b1874ee4e2fa65b26beaa5fac0.exe
File created	C:\Windows\90922cb71dfcba41381ba4b1ebc3b903.exe	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe

Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

752 sc.exe
5300 sc.exe
1852 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

4060 tasklist.exe

pid	process
752	sc.exe
5300	sc.exe
1852	sc.exe

Modifies data under HKEY_USERS 56 IoCs

Processes:

powershell.exensr7D32.tmpdff269b1874ee4e2fa65b26beaa5fac0.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings	nsr7D32.tmp
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	nsr7D32.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dff269b1874ee4e2fa65b26beaa5fac0.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	nsr7D32.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	nsr7D32.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	nsr7D32.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dff269b1874ee4e2fa65b26beaa5fac0.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings	nsr7D32.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dff269b1874ee4e2fa65b26beaa5fac0.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dff269b1874ee4e2fa65b26beaa5fac0.exe

Modifies registry class 8 IoCs

Processes:

dff269b1874ee4e2fa65b26beaa5fac0.exensr7D32.tmp

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\56BF5154-0B48-4ADB-902A-6C8B12E270D9	dff269b1874ee4e2fa65b26beaa5fac0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\56BF5154-0B48-4ADB-902A-6C8B12E270D9\LocalService = "0b3b547fd93c69f67a64b1d149c763ac"	dff269b1874ee4e2fa65b26beaa5fac0.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings	nsr7D32.tmp
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Software	nsr7D32.tmp
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Software\Microsoft	nsr7D32.tmp
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Software\Microsoft\Windows	nsr7D32.tmp
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Software\Microsoft\Windows\CurrentVersion	nsr7D32.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	nsr7D32.tmp

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

dff269b1874ee4e2fa65b26beaa5fac0.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\029D67B9475788276C7ECA7759845CA7F47E7DA3	dff269b1874ee4e2fa65b26beaa5fac0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\029D67B9475788276C7ECA7759845CA7F47E7DA3\Blob = 030000000100000014000000029d67b9475788276c7eca7759845ca7f47e7da320000000010000006e0300003082036a30820252a003020102021100c96b859c63bc782c5d661a5934a03300300d06092a864886f70d01010b0500305d3133303106092a864886f70d0109011624696e666f40746563686e6f6c6f67696561647269656e70726f76656e636865722e636f6d310b300906035504061302454e3119301706035504030c10346534663261666539346230666165303020170d3034303532393033303331365a180f32303634303531343033303331365a305d3133303106092a864886f70d0109011624696e666f40746563686e6f6c6f67696561647269656e70726f76656e636865722e636f6d310b300906035504061302454e3119301706035504030c103465346632616665393462306661653030820122300d06092a864886f70d01010105000382010f003082010a0282010100d102fac59471f2454e80b9ee0861ed6bc62c3adfc79948a74cab6431221d7b71df61aa005a245e6c3327cda20d5c08adb0d221feb6341439cede4d10d764e688b7eabc1894335631312cf2bb7018c589ba265131a95e54f5632f511c7f64f87025a21b0f37aaf37258301de0e6985740c2bc17b760f47b6ce2abce7c04bff132729f8d8813a4a627589f2add6ff03882c301b842988c8437cf996bac4b8052ba490037f68e5c534c9ede75ed439b281ad72ce839e02e73464b10929aa8d1b67302beb4e67d5bb38bfca987818ffe16130e77dc73b89a042671727239f9c7b1dad7e1b249c30f51a713dd9dd7f7eba4617c90ae2c806af2cec304d8759e219fe10203010001a3233021300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106300d06092a864886f70d01010b05000382010100b7173b0716d68c239afb40213a0deb591cb89f04a4a6b1b43fd841fb37ec787f328d3bf0019b64b0a58e488c3df898773270ba56fa83de6b295b2e322c5aacd7e4382ad4a1a293d826fb6abdf393c2919352a56f32b3e9dc10de26e9f1d973182c4a88ea5d98b3967371be405d31e2ead4fa9a1361b658fe46225f43feb71418461edb4f06e6f1d19bc2db1cfd6aa410ffd89d702aaa00749eaa5fb8d9ccc550510b0ff0f802a20f385279479843e7643c8444bf66aa0744bfab21d167db8fb9056adb2d10e69487c923d157f0d7582fcbe92ec3554294feb16b668916379a778a0b417d0c38d39ca4199a9b1dfba817670c322d8e4f3212ae8e3ea9f2c4e10f	dff269b1874ee4e2fa65b26beaa5fac0.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

tasklist.exepowershell.exedff269b1874ee4e2fa65b26beaa5fac0.exepowershell.exe

pid	process
4060	tasklist.exe
4060	tasklist.exe
5436	powershell.exe
5436	powershell.exe
5508	dff269b1874ee4e2fa65b26beaa5fac0.exe
5508	dff269b1874ee4e2fa65b26beaa5fac0.exe
5632	powershell.exe
5508	dff269b1874ee4e2fa65b26beaa5fac0.exe
5508	dff269b1874ee4e2fa65b26beaa5fac0.exe
5632	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

656
656

pid	process
656
656

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

tasklist.exeWMIC.exensr7D32.tmp

description	pid	process
Token: SeDebugPrivilege	4060	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3092	WMIC.exe
Token: SeSecurityPrivilege	3092	WMIC.exe
Token: SeTakeOwnershipPrivilege	3092	WMIC.exe
Token: SeLoadDriverPrivilege	3092	WMIC.exe
Token: SeSystemProfilePrivilege	3092	WMIC.exe
Token: SeSystemtimePrivilege	3092	WMIC.exe
Token: SeProfSingleProcessPrivilege	3092	WMIC.exe
Token: SeIncBasePriorityPrivilege	3092	WMIC.exe
Token: SeCreatePagefilePrivilege	3092	WMIC.exe
Token: SeBackupPrivilege	3092	WMIC.exe
Token: SeRestorePrivilege	3092	WMIC.exe
Token: SeShutdownPrivilege	3092	WMIC.exe
Token: SeDebugPrivilege	3092	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3092	WMIC.exe
Token: SeRemoteShutdownPrivilege	3092	WMIC.exe
Token: SeUndockPrivilege	3092	WMIC.exe
Token: SeManageVolumePrivilege	3092	WMIC.exe
Token: 33	3092	WMIC.exe
Token: 34	3092	WMIC.exe
Token: 35	3092	WMIC.exe
Token: 36	3092	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3092	WMIC.exe
Token: SeSecurityPrivilege	3092	WMIC.exe
Token: SeTakeOwnershipPrivilege	3092	WMIC.exe
Token: SeLoadDriverPrivilege	3092	WMIC.exe
Token: SeSystemProfilePrivilege	3092	WMIC.exe
Token: SeSystemtimePrivilege	3092	WMIC.exe
Token: SeProfSingleProcessPrivilege	3092	WMIC.exe
Token: SeIncBasePriorityPrivilege	3092	WMIC.exe
Token: SeCreatePagefilePrivilege	3092	WMIC.exe
Token: SeBackupPrivilege	3092	WMIC.exe
Token: SeRestorePrivilege	3092	WMIC.exe
Token: SeShutdownPrivilege	3092	WMIC.exe
Token: SeDebugPrivilege	3092	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3092	WMIC.exe
Token: SeRemoteShutdownPrivilege	3092	WMIC.exe
Token: SeUndockPrivilege	3092	WMIC.exe
Token: SeManageVolumePrivilege	3092	WMIC.exe
Token: 33	3092	WMIC.exe
Token: 34	3092	WMIC.exe
Token: 35	3092	WMIC.exe
Token: 36	3092	WMIC.exe
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp
Token: SeRestorePrivilege	4052	nsr7D32.tmp

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.execmd.execmd.exensr7D32.tmpdff269b1874ee4e2fa65b26beaa5fac0.exedff269b1874ee4e2fa65b26beaa5fac0.exe

description	pid	process	target process
PID 2252 wrote to memory of 4604	2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe	cmd.exe
PID 2252 wrote to memory of 4604	2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe	cmd.exe
PID 2252 wrote to memory of 4604	2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe	cmd.exe
PID 4604 wrote to memory of 1816	4604	cmd.exe	cmd.exe
PID 4604 wrote to memory of 1816	4604	cmd.exe	cmd.exe
PID 4604 wrote to memory of 1816	4604	cmd.exe	cmd.exe
PID 1816 wrote to memory of 4060	1816	cmd.exe	tasklist.exe
PID 1816 wrote to memory of 4060	1816	cmd.exe	tasklist.exe
PID 1816 wrote to memory of 4060	1816	cmd.exe	tasklist.exe
PID 4604 wrote to memory of 3092	4604	cmd.exe	WMIC.exe
PID 4604 wrote to memory of 3092	4604	cmd.exe	WMIC.exe
PID 4604 wrote to memory of 3092	4604	cmd.exe	WMIC.exe
PID 2252 wrote to memory of 4052	2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe	nsr7D32.tmp
PID 2252 wrote to memory of 4052	2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe	nsr7D32.tmp
PID 2252 wrote to memory of 4052	2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe	nsr7D32.tmp
PID 4052 wrote to memory of 752	4052	nsr7D32.tmp	sc.exe
PID 4052 wrote to memory of 752	4052	nsr7D32.tmp	sc.exe
PID 4052 wrote to memory of 752	4052	nsr7D32.tmp	sc.exe
PID 2252 wrote to memory of 5300	2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe	sc.exe
PID 2252 wrote to memory of 5300	2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe	sc.exe
PID 2252 wrote to memory of 5300	2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe	sc.exe
PID 2252 wrote to memory of 1852	2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe	sc.exe
PID 2252 wrote to memory of 1852	2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe	sc.exe
PID 2252 wrote to memory of 1852	2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe	sc.exe
PID 2252 wrote to memory of 5412	2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe	dff269b1874ee4e2fa65b26beaa5fac0.exe
PID 2252 wrote to memory of 5412	2252	6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe	dff269b1874ee4e2fa65b26beaa5fac0.exe
PID 5412 wrote to memory of 5436	5412	dff269b1874ee4e2fa65b26beaa5fac0.exe	powershell.exe
PID 5412 wrote to memory of 5436	5412	dff269b1874ee4e2fa65b26beaa5fac0.exe	powershell.exe
PID 5508 wrote to memory of 5632	5508	dff269b1874ee4e2fa65b26beaa5fac0.exe	powershell.exe
PID 5508 wrote to memory of 5632	5508	dff269b1874ee4e2fa65b26beaa5fac0.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6d2252d1f81e4a89059e7fbf6d4d0ecf_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\GetSID.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq explorer.exe" /FO LIST /V
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1816
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "IMAGENAME eq explorer.exe" /FO LIST /V
      4⤵
      Enumerates processes with tasklist
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4060
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' get sid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3092
- C:\Users\Admin\AppData\Local\Temp\nsr7D32.tmp
  "C:\Users\Admin\AppData\Local\Temp\nsr7D32.tmp" /S /UPDATE /NAME ${UppFolderName} /SID S-1-5-21-2539840389-1261165778-1087677076-1000 _?=C:\Users\Admin\AppData\Local\Temp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\SysWOW64\sc.exe
    sc delete "0"
    3⤵
    - Launches sc.exe
    PID:752
- C:\Windows\SysWOW64\sc.exe
  sc create 39a7eed1b01781a6d51a82ee4de8f1e0 binpath= C:\Windows\system32\drivers\39a7eed1b01781a6d51a82ee4de8f1e0.sys DisplayName= 39a7eed1b01781a6d51a82ee4de8f1e0 type= kernel start= system group= PNP_TDI
  2⤵
  - Launches sc.exe
  PID:5300
- C:\Windows\SysWOW64\sc.exe
  sc start 39a7eed1b01781a6d51a82ee4de8f1e0
  2⤵
  - Launches sc.exe
  PID:1852
- C:\Program Files\0b3b547fd93c69f67a64b1d149c763ac\dff269b1874ee4e2fa65b26beaa5fac0.exe
  "C:\Program Files\0b3b547fd93c69f67a64b1d149c763ac\dff269b1874ee4e2fa65b26beaa5fac0.exe" --install
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "& {Add-MpPreference -ExclusionPath @('c:\program files\0b3b547fd93c69f67a64b1d149c763ac\', 'C:\Windows\System32\drivers\39a7eed1b01781a6d51a82ee4de8f1e0.sys', 'C:\Windows\90922cb71dfcba41381ba4b1ebc3b903.exe')}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5436

C:\Program Files\0b3b547fd93c69f67a64b1d149c763ac\dff269b1874ee4e2fa65b26beaa5fac0.exe
"C:\Program Files\0b3b547fd93c69f67a64b1d149c763ac\dff269b1874ee4e2fa65b26beaa5fac0.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "& {Add-MpPreference -ExclusionPath @('c:\program files\0b3b547fd93c69f67a64b1d149c763ac\', 'C:\Windows\System32\drivers\39a7eed1b01781a6d51a82ee4de8f1e0.sys', 'C:\Windows\90922cb71dfcba41381ba4b1ebc3b903.exe')}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GetSID.bat

Filesize
318B

MD5
e30dcd7ebbf471ece9b52809f7bf0b8f

SHA1
fbcfcea872f8aa30b4802fc41c46028e8da064d5

SHA256
c3738c586b10a499f7a528e6405e2309c4988d360de57f42169ca51e94537478

SHA512
72d169d9506f4ff7024e79e1e5a676f5d85311bc28ca92119f83bbb761a83cc4389adb8baf8c91aa039782a4a96e5ce747bd472981a8d80e72f3fcf8c238ea79

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hvfyrfw1.zi1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh7DDC.tmp\NSISList.dll

Filesize
97KB

MD5
2e0785f18f8714393bc4bc1fe170eadf

SHA1
1efba431c0fac46c6cb6f60dc08f65a0e23ccf3d

SHA256
e68d65626b24e7c1f6fbe1001f43174d0243095181025736f37ad704662f4351

SHA512
8a272bb264fa066960a4f34411a81652839eccdbc6fa25be20c0b94d7d10b16cb568338abb5d1a96c155cbc4bc7923d0387fa36bed69c1021296cc6cc5fbb45e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh7DDC.tmp\SimpleSC.dll

Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh7DDC.tmp\StdUtils.dll

Filesize
94KB

MD5
9be4857761626998d1522c623058b2d0

SHA1
054c7d13400117f8b4accc2cba2bca5f976baa70

SHA256
8717e451286278ba07a15197f0292de2fd90487a9f78ad00b28f5d6b6ea2c8c9

SHA512
8bca7b46a3f1d8b11a8690b02e3802428b310693f090a4ddfb397249b4f5ce9ff6112d0f2a85f89ac5eb75133035bcb111cac8bc6cb18ad9875d17122834d81c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh7DDC.tmp\nsisos.dll

Filesize
5KB

MD5
69806691d649ef1c8703fd9e29231d44

SHA1
e2193fcf5b4863605eec2a5eb17bf84c7ac00166

SHA256
ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

SHA512
5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr7D32.tmp

Filesize
3.8MB

MD5
7ede9c63f9a5134eb50eb928c0c5aabf

SHA1
86d2cf7837cd460043835e8661ae5239c6f59fb3

SHA256
fdc3ac6e64545a4d500e7649203c9fe058c571065e98ae8a0002524879ba3c77

SHA512
7786a98dd74b769bae06e8679b093c134adffeb9bb29d89fc716498fcb900e000c320bfca178610126d5f6a3eeb9a450ac9ea0c8d292a7e6e01ccecd109a9389

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy761C.tmp\MoreInfo.dll

Filesize
7KB

MD5
80e34b7f576b710d100f6e7c0bed0c2e

SHA1
2b5b895034d41ee0d0d01bf650594ad0d1346662

SHA256
569d62345f6c915236772fa2575d1806cd2bfe089505807cb477618f1eeccf99

SHA512
f5970c192b7089040fd1cf26e5cab131879b91722dff0216cdc735f9cfde1eda061409b579eb0f11e3b32e5513e34bbedd4050b75bb1b2acc81be814c2c6c59b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy761C.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy761C.tmp\brh.dll

Filesize
840KB

MD5
355c877b0a9c80d27eca9a480bf5fd5d

SHA1
af1d07a1d11d7f3e24d84324cc0cf70849da9338

SHA256
2e484b9053b5e155608fd10da190d4ee92c2286eea2a3f2ee6c564f24e8c1bba

SHA512
b2f115824617c9c23ef9df3b89f0cba6852071cd997ecb543cf1ca9c72fdefa636a74d25393c70c4ae2f602f499d5704c0917e8036c81537f8e07f0c0ee50250

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy761C.tmp\inetc.dll

Filesize
21KB

MD5
d7a3fa6a6c738b4a3c40d5602af20b08

SHA1
34fc75d97f640609cb6cadb001da2cb2c0b3538a

SHA256
67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

SHA512
75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy761C.tmp\md5dll.dll

Filesize
8KB

MD5
97960d7a18662dac9cd80a8c5e3c794b

SHA1
4c28449cefa9af46bb7a63e9b9ea66a2de0ea287

SHA256
e0d1dc6e4c5cc13fb2db08fc741da0d08b315ebc8d3b53baa61552625d19b9c3

SHA512
1baab7b5378f3a396b31bf63b01b7905759c9f1d17d71882af63338d64eceda1884c947d93e4d9ef911bded1ef061043c873a88b8272f1aa296731aa745e756c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy761C.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
memory/2252-28-0x0000000074BB0000-0x0000000074C88000-memory.dmp

Filesize
864KB

Download
memory/2252-3405-0x0000000074BB0000-0x0000000074C88000-memory.dmp

Filesize
864KB

Download
memory/2252-3321-0x0000000074BB0000-0x0000000074C88000-memory.dmp

Filesize
864KB

Download
memory/4052-69-0x0000000003860000-0x000000000387D000-memory.dmp

Filesize
116KB

Download
memory/4052-77-0x0000000003980000-0x0000000003993000-memory.dmp

Filesize
76KB

Download
memory/5412-3262-0x00007FF773A70000-0x00007FF774886000-memory.dmp

Filesize
14.1MB

Download
memory/5412-3261-0x00007FF773A70000-0x00007FF774886000-memory.dmp

Filesize
14.1MB

Download
memory/5436-3278-0x0000018E52940000-0x0000018E52962000-memory.dmp

Filesize
136KB

Download
memory/5508-3298-0x00007FF773A70000-0x00007FF774886000-memory.dmp

Filesize
14.1MB

Download
memory/5508-3272-0x00007FF773A70000-0x00007FF774886000-memory.dmp

Filesize
14.1MB

Download
memory/5632-3312-0x00000231E6930000-0x00000231E693A000-memory.dmp

Filesize
40KB

Download
memory/5632-3311-0x00000231E6950000-0x00000231E696C000-memory.dmp

Filesize
112KB

Download
memory/5632-3310-0x00000231E64C0000-0x00000231E64CA000-memory.dmp

Filesize
40KB

Download
memory/5632-3313-0x00000231E6990000-0x00000231E69AA000-memory.dmp

Filesize
104KB

Download
memory/5632-3314-0x00000231E6940000-0x00000231E6948000-memory.dmp

Filesize
32KB

Download
memory/5632-3315-0x00000231E6970000-0x00000231E6976000-memory.dmp

Filesize
24KB

Download
memory/5632-3316-0x00000231E6980000-0x00000231E698A000-memory.dmp

Filesize
40KB

Download
memory/5632-3309-0x00000231E6730000-0x00000231E67E5000-memory.dmp

Filesize
724KB

Download
memory/5632-3308-0x00000231E6710000-0x00000231E672C000-memory.dmp

Filesize
112KB

Download