qulab | d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2

Analysis

max time kernel
144s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe
Size

3.1MB
MD5

a6eb72786833e41037b692d54a08d64b
SHA1

209d8da4ba64ad038225b99bd2ae8d38eba63805
SHA256

d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2
SHA512

69261858bb0aa897f5d80c40dbd66de905d347a94b72c98fd6fc6d1d6966d1cc4a2456aaa5a9b596b8a1109b66284bae89d01bbcfb2cb8c40bd2ac17a83cd193
SSDEEP

49152:Hs3dakSdDYG/RTi10rNdCvJOAcHgAlIZ3t61hAloK1Zlxv1yq1M8Il2jrY788GhY:HhdDE0rNdZrHgUIjQCowx/C5179GtQz

Score

10^/10

qulab discovery evasion ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\1\Information.txt

Family

qulab

Ransom Note

# /===============================\ # |=== QULAB CLIPPER + STEALER ===| # |===============================| # |==== BUY CLIPPER + STEALER ====| # |=== http://teleg.run/QulabZ ===| # \===============================/ Date: 13.06.2024, 22:36:30 Main Information: - OS: Windows 7 X64 / Build: 7601 - UserName: Admin - ComputerName: IZKCKOTP - Processor: Intel(R) Xeon(R) CPU E5-2689 0 @ 2.60GHz - VideoCard: Standard VGA Graphics Adapter - Memory: 2.00 Gb - KeyBoard Layout ID: 00000409 - Resolution: 1280x720x32, 1 GHz Other Information: <error> Soft / Windows Components / Windows Updates: - Adobe AIR - Google Chrome - Microsoft Office Professional Plus 2010 - Adobe AIR - Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 - Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.30.30704 - Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.30.30704 - Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 - Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40660 - Microsoft Office Professional Plus 2010 - Microsoft Office Access MUI (English) 2010 - Microsoft Office Excel MUI (English) 2010 - Microsoft Office PowerPoint MUI (English) 2010 - Microsoft Office Publisher MUI (English) 2010 - Microsoft Office Outlook MUI (English) 2010 - Microsoft Office Word MUI (English) 2010 - Microsoft Office Proof (English) 2010 - Microsoft Office Proof (French) 2010 - Microsoft Office Proof (Spanish) 2010 - Microsoft Office Proofing (English) 2010 - Microsoft Office InfoPath MUI (English) 2010 - Microsoft Office Shared MUI (English) 2010 - Microsoft Office OneNote MUI (English) 2010 - Microsoft Office Groove MUI (English) 2010 - Microsoft Office Shared Setup Metadata MUI (English) 2010 - Microsoft Office Access Setup Metadata MUI (English) 2010 - Update for Microsoft .NET Framework 4.7.2 (KB4087364) - Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 - Adobe Reader 9 - Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 - Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 - Microsoft Visual C++ 2022 X86 Additional Runtime - 14.30.30704 - Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 - Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40660 - Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 - Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 - Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.30.30704 Process List: - [System Process] / PID: 0 - System / PID: 4 - smss.exe / PID: 260 - csrss.exe / PID: 340 - wininit.exe / PID: 388 - csrss.exe / PID: 396 - winlogon.exe / PID: 436 - services.exe / PID: 484 - lsass.exe / PID: 500 - lsm.exe / PID: 508 - svchost.exe / PID: 612 - svchost.exe / PID: 688 - svchost.exe / PID: 764 - svchost.exe / PID: 820 - svchost.exe / PID: 848 - audiodg.exe / PID: 928 - svchost.exe / PID: 972 - svchost.exe / PID: 284 - spoolsv.exe / PID: 344 - svchost.exe / PID: 1072 - taskhost.exe / PID: 1100 - dwm.exe / PID: 1160 - explorer.exe / PID: 1184 - svchost.exe / PID: 2252 - sppsvc.exe / PID: 2832 - ddrawex.exe / PID: 2568 - dllhost.exe / PID: 2692 - dllhost.exe / PID: 1516

URLs

http://teleg.run/QulabZ

Signatures

Qulab Stealer & Clipper
Infostealer and clipper created with AutoIt.
stealer qulab

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ddrawex.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ddrawex.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ddrawex.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
840	attrib.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000015cba-40.dat	acprotect

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ddrawex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ddrawex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ddrawex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ddrawex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ddrawex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ddrawex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2948	ddrawex.module.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Wine	ddrawex.exe
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Wine	ddrawex.exe
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Wine	ddrawex.exe
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Wine	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe

Loads dropped DLL 4 IoCs

pid	Process
2568	ddrawex.exe
2568	ddrawex.exe
2568	ddrawex.exe
2568	ddrawex.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000015cba-40.dat	upx
behavioral1/memory/2568-44-0x0000000061E00000-0x0000000061ED2000-memory.dmp	upx
behavioral1/memory/2568-46-0x0000000061E00000-0x0000000061ED2000-memory.dmp	upx
behavioral1/files/0x0006000000016572-145.dat	upx
behavioral1/memory/2948-156-0x0000000000400000-0x000000000047D000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ipapi.co
6	ipapi.co

AutoIT Executable 49 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2320-5-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2320-8-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2320-7-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2320-6-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2320-4-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2320-3-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2320-9-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2320-10-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2320-16-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2320-13-0x000000000CED0000-0x000000000D505000-memory.dmp	autoit_exe
behavioral1/memory/2320-12-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-18-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-17-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-21-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-25-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-26-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-27-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-24-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-23-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-20-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-19-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-22-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-28-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-29-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-36-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-45-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-50-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-49-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-70-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-69-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-158-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-159-0x0000000007D30000-0x0000000007DAD000-memory.dmp	autoit_exe
behavioral1/memory/2568-160-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-161-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-162-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-163-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-166-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-167-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2312-169-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-170-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-172-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-173-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-174-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-175-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-176-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2816-179-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-180-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-181-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe
behavioral1/memory/2568-182-0x00000000000B0000-0x00000000006E5000-memory.dmp	autoit_exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	ddrawex.exe
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	ddrawex.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2320	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe
2568	ddrawex.exe
2312	ddrawex.exe
2816	ddrawex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	ddrawex.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ddrawex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	ddrawex.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	ddrawex.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	ddrawex.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	ddrawex.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\winmgmts:\localhost\	ddrawex.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2320	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe
2568	ddrawex.exe
2568	ddrawex.exe
2312	ddrawex.exe
2816	ddrawex.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2320	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2948	ddrawex.module.exe
Token: 35	2948	ddrawex.module.exe
Token: SeSecurityPrivilege	2948	ddrawex.module.exe
Token: SeSecurityPrivilege	2948	ddrawex.module.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2568	2320	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe	28
PID 2320 wrote to memory of 2568	2320	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe	28
PID 2320 wrote to memory of 2568	2320	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe	28
PID 2320 wrote to memory of 2568	2320	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe	28
PID 2568 wrote to memory of 2948	2568	ddrawex.exe	32
PID 2568 wrote to memory of 2948	2568	ddrawex.exe	32
PID 2568 wrote to memory of 2948	2568	ddrawex.exe	32
PID 2568 wrote to memory of 2948	2568	ddrawex.exe	32
PID 2568 wrote to memory of 840	2568	ddrawex.exe	34
PID 2568 wrote to memory of 840	2568	ddrawex.exe	34
PID 2568 wrote to memory of 840	2568	ddrawex.exe	34
PID 2568 wrote to memory of 840	2568	ddrawex.exe	34
PID 2000 wrote to memory of 2312	2000	taskeng.exe	39
PID 2000 wrote to memory of 2312	2000	taskeng.exe	39
PID 2000 wrote to memory of 2312	2000	taskeng.exe	39
PID 2000 wrote to memory of 2312	2000	taskeng.exe	39
PID 2000 wrote to memory of 2816	2000	taskeng.exe	40
PID 2000 wrote to memory of 2816	2000	taskeng.exe	40
PID 2000 wrote to memory of 2816	2000	taskeng.exe	40
PID 2000 wrote to memory of 2816	2000	taskeng.exe	40

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
840	attrib.exe

C:\Users\Admin\AppData\Local\Temp\a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
  C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies system certificate store
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe
    C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ENU_687FE9704FB3BA9E9D41.7z" "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\1\*"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:840

C:\Windows\system32\taskeng.exe
taskeng.exe {A70A02E0-B950-4D94-B550-62F41E4CBAEB} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
  C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2312
- C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
  C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2b2076e31f79d90b4357d501a280ed0

SHA1
ff33f9ab628664e75250d7d09c4d8e0bd0da2677

SHA256
4255ddd15be0da90e3fe51f0572ac695cec29069ffeef9927ea2b5c9bc99916a

SHA512
8b80acf2c9c6b1e67748f95f765091ec60953ce33cea1268ce448a1d3555792b7d16239dc46b301aa2a09b14dfbaff1c7eb77d75fad51dd13ff5b1c0701a9378

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6145.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar63BD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\1\Information.txt

Filesize
3KB

MD5
1f6d0ce8a54370ba58d57fc7395fac18

SHA1
f8cda96834c0ad07567b4f981cc3f3076a711b94

SHA256
84b6832c8ad0ea3324ad94f13d336af0bcf2b6ce6b26e7433924f97f32a99b75

SHA512
3e7a2a11cd087205a81301549e0ad827a137da798d97c4dc0cce3f8386f02f41533261ae1f1b8f3aee3766b14784e16c44239ac49d6a96d9c66e61cf36450c4b

Download Submit
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\1\Screen.jpg

Filesize
32KB

MD5
b867ef01d706af8ebf30b652c6e7a6f1

SHA1
9f9ba02f0fd40d8d57c4ec63b70129cffa88002d

SHA256
71e59742823f805020572fcd73ba74a651047df78ec084f9bd7dff9a2de0c054

SHA512
af92e2687afb81e29691b3c880f71fdb2ea0a5bd2221bbc28be9eacffbb1d913c559f13da05f6ff569b580368e95f9cb329bd42b607cc80a6bdf3e2f25177399

Download Submit
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe.4

Filesize
197KB

MD5
f9b5932ee6439bf0a6ff00d00edc813c

SHA1
8a45baab0364f4056676037224f9f150a358dd35

SHA256
6f3de48abc20c63dcd02a347bc1c54d792d89f2587588ecd0de1330343850c4a

SHA512
0d804a19036f436296af33876bf0fab3062cac62c1f16ff3f5a83f73eb325d7674f5c2a0b23267c4bd42584c332a6e3cc7239660f7d2f877eaaf458cc7b55846

Download Submit
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.sqlite3.module.dll.4

Filesize
360KB

MD5
44dbe3105e40cc8d527de135be76fb7b

SHA1
4918e373c2282db8a66a38ac2a6dc85b5004c623

SHA256
05d638f246c96219011a470cd32626c3f88f43ab8d0ece6883969efb0d704d1b

SHA512
6f8829162b3af1df1c914e879cb8ff71983574c0286d4dc7e63b49c7a6162728ae0c3add50f3cd54f6563e0e4df7ff82a13a30abb078a536847ec3dca8e0a843

Download Submit
\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe

Filesize
197KB

MD5
946285055913d457fda78a4484266e96

SHA1
668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285

SHA256
23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb

SHA512
30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

Download Submit
\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.sqlite3.module.dll

Filesize
360KB

MD5
8c127ce55bfbb55eb9a843c693c9f240

SHA1
75c462c935a7ff2c90030c684440d61d48bb1858

SHA256
4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028

SHA512
d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

Download Submit
memory/2312-169-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2312-168-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2320-5-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2320-3-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2320-10-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2320-16-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2320-13-0x000000000CED0000-0x000000000D505000-memory.dmp

Filesize
6.2MB

Download
memory/2320-12-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2320-2-0x00000000000B1000-0x000000000010E000-memory.dmp

Filesize
372KB

Download
memory/2320-9-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2320-4-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2320-6-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2320-7-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2320-8-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2320-1-0x0000000077260000-0x0000000077262000-memory.dmp

Filesize
8KB

Download
memory/2320-0-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-44-0x0000000061E00000-0x0000000061ED2000-memory.dmp

Filesize
840KB

Download
memory/2568-158-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-19-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-22-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-28-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-29-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-36-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-45-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-23-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-46-0x0000000061E00000-0x0000000061ED2000-memory.dmp

Filesize
840KB

Download
memory/2568-50-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-49-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-70-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-24-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-27-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-26-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-25-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-21-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-17-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-69-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-182-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-20-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-159-0x0000000007D30000-0x0000000007DAD000-memory.dmp

Filesize
500KB

Download
memory/2568-160-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-161-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-162-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-163-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-164-0x0000000007D30000-0x0000000007DAD000-memory.dmp

Filesize
500KB

Download
memory/2568-165-0x0000000007D30000-0x0000000007DAD000-memory.dmp

Filesize
500KB

Download
memory/2568-166-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-167-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-18-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-14-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-170-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-172-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-173-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-174-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-175-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-176-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-181-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2568-180-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2816-179-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2816-177-0x00000000000B0000-0x00000000006E5000-memory.dmp

Filesize
6.2MB

Download
memory/2948-156-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download