ramnit | 16571e6da1e5261d7a97e8f1bddd953dd2cb4e94cf67e378376521ef675fa6f7

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe
Size 368KB
Sample240613-3pgbcszblp
SHA256 16571e6da1e5261d7a97e8f1bddd953dd2cb4e94cf67e378376521ef675fa6f7
MD5 a7258abe54185fa9651fd4c0ac03fefa
SHA1 7ca46de7d75de921d10cbeb07a8a91ec03cdc636
SHA512 43146037f16c74c683bdc53f7c24a0fcbb10a76821e84097910a6af72da52e611677256201d978f9f0773d8216e9d2a4b5ae4f91cb23122208acebe216816848
SSDEEP 6144:SWKRvtDOCzszEklyYFhaHnE1ZxFzrAXiL9a1gmjMm:SWKPIEks+OoZv/zBab
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Deletes itself 1 IoCs

pid	Process
1524	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
2612	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
2156	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
2572	DesktopLayer.exe
2556	ccyqqw.exe
2476	ccyqqwmgr.exe
2464	ccyqqwSrv.exe

Loads dropped DLL 7 IoCs

pid	Process
1872	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe
1872	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe
1872	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe
2612	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0035000000015609-13.dat	upx
behavioral1/files/0x000a000000012286-4.dat	upx
behavioral1/memory/2572-30-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2156-21-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2612-20-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2156-32-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2464-59-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2464-54-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2476-51-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2556-48-0x00000000001B0000-0x000000000020B000-memory.dmp	upx
behavioral1/memory/2156-34-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2156-157-0x0000000000400000-0x000000000045B000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\Favorites	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\DNTException\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69DC3361-29DE-11EF-BA28-C2931B856BB4}.dat	iexplore.exe
File created	C:\Windows\SysWOW64\ccyqqwmgr.exe	ccyqqw.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ieonline.microsoft[1]	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69D9D201-29DE-11EF-BA28-C2931B856BB4}.dat	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	IEXPLORE.EXE
File opened for modification	C:\Windows\System32\config\systemprofile\Favorites\Links	iexplore.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69D50F41-29DE-11EF-BA28-C2931B856BB4}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{69DC3363-29DE-11EF-BA28-C2931B856BB4}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	iexplore.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69DC3361-29DE-11EF-BA28-C2931B856BB4}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69D50F41-29DE-11EF-BA28-C2931B856BB4}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Favorites\Links\Suggested Sites.url	iexplore.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatCache\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69D50F41-29DE-11EF-BA28-C2931B856BB4}.dat	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69D9D201-29DE-11EF-BA28-C2931B856BB4}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\Favorites\Links\Suggested Sites.url	iexplore.exe
File created	C:\Windows\SysWOW64\ccyqqwSrv.exe	ccyqqw.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatCache\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low	iexplore.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\DNTException\Low	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	IEXPLORE.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69D50F41-29DE-11EF-BA28-C2931B856BB4}.dat	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\ccyqqw.exe	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\DNTException\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatCache\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69D9D201-29DE-11EF-BA28-C2931B856BB4}.dat	iexplore.exe
File created	C:\Windows\SysWOW64\ccyqqw.exe	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{69D50F43-29DE-11EF-BA28-C2931B856BB4}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~	iexplore.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px17C5.tmp	ccyqqwSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	ccyqqwSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px16FA.tmp	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ccyqqw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ccyqqw.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424483960"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69B15AA1-29DE-11EF-BA28-C2931B856BB4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69C22B51-29DE-11EF-BA28-C2931B856BB4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69C20441-29DE-11EF-BA28-C2931B856BB4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\Flags = "512"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore\Count = "3"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\LoadTimeArray = 16000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-b9-b0-30-a5-b2	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Type = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore\Flags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\LinksBar\MarketingLinksMigrate = 60b0742cebbdda01	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\Software\Microsoft\Internet Explorer	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{69D9D201-29DE-11EF-BA28-C2931B856BB4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F05F8F-08BA-40DE-93BD-80EE08D70B30}\56-b9-b0-30-a5-b2	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-b9-b0-30-a5-b2\WpadDecision = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F05F8F-08BA-40DE-93BD-80EE08D70B30}\WpadNetworkName = "Network 3"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Count = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore\Time = e807060004000d00170029000c005800	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Setup\HaveCreatedQuickLaunchItems = "1"	ie4uinit.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2300000023000000430300007b020000	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Time = e807060004000d00170029000c002900	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-b9-b0-30-a5-b2\WpadDecisionTime = e069a954ebbdda01	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\Flags = "512"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F05F8F-08BA-40DE-93BD-80EE08D70B30}\WpadDecisionReason = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\VerCache = 0086a9a807ccca010086a9a807ccca01000000009093660000000e00e803991200000e000000991209040000	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Zones	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\KnownProvidersUpgradeTime = 604a8a40ebbdda01	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F05F8F-08BA-40DE-93BD-80EE08D70B30}\WpadNetworkName = "Network 3"	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e807060004000d00170029000f008b0100000000	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021494-0000-0000-C000-000000000046}\Enum	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore\Type = "3"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2572	DesktopLayer.exe
2572	DesktopLayer.exe
2572	DesktopLayer.exe
2572	DesktopLayer.exe
2156	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
2156	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
2156	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
2156	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
2156	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
2156	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
2156	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
2156	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
2476	ccyqqwmgr.exe
2476	ccyqqwmgr.exe
2464	ccyqqwSrv.exe
2464	ccyqqwSrv.exe
2464	ccyqqwSrv.exe
2464	ccyqqwSrv.exe
2476	ccyqqwmgr.exe
2476	ccyqqwmgr.exe
2476	ccyqqwmgr.exe
2476	ccyqqwmgr.exe
2476	ccyqqwmgr.exe
2476	ccyqqwmgr.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe
2556	ccyqqw.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2156	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
Token: SeDebugPrivilege	2476	ccyqqwmgr.exe
Token: SeIncBasePriorityPrivilege	1872	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe
Token: SeDebugPrivilege	2556	ccyqqw.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2648	iexplore.exe
2912	iexplore.exe
2912	iexplore.exe
2112	iexplore.exe
2112	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2912	iexplore.exe
2912	iexplore.exe
2912	iexplore.exe
2912	iexplore.exe
2912	iexplore.exe
2912	iexplore.exe
2112	iexplore.exe
2112	iexplore.exe
2112	iexplore.exe
2112	iexplore.exe
2112	iexplore.exe
2112	iexplore.exe
2580	iexplore.exe
2680	iexplore.exe

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
2648	iexplore.exe
2648	iexplore.exe
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2112	iexplore.exe
2112	iexplore.exe
2912	iexplore.exe
2912	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
2580	iexplore.exe
2580	iexplore.exe
2680	iexplore.exe
2680	iexplore.exe
1440	IEXPLORE.EXE
1440	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
1440	IEXPLORE.EXE
1440	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2156	1872	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	29
PID 1872 wrote to memory of 2156	1872	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	29
PID 1872 wrote to memory of 2156	1872	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	29
PID 1872 wrote to memory of 2156	1872	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	29
PID 1872 wrote to memory of 2612	1872	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	30
PID 1872 wrote to memory of 2612	1872	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	30
PID 1872 wrote to memory of 2612	1872	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	30
PID 1872 wrote to memory of 2612	1872	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	30
PID 2612 wrote to memory of 2572	2612	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe	31
PID 2612 wrote to memory of 2572	2612	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe	31
PID 2612 wrote to memory of 2572	2612	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe	31
PID 2612 wrote to memory of 2572	2612	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe	31
PID 2572 wrote to memory of 2648	2572	DesktopLayer.exe	32
PID 2572 wrote to memory of 2648	2572	DesktopLayer.exe	32
PID 2572 wrote to memory of 2648	2572	DesktopLayer.exe	32
PID 2572 wrote to memory of 2648	2572	DesktopLayer.exe	32
PID 2156 wrote to memory of 2580	2156	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe	33
PID 2156 wrote to memory of 2580	2156	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe	33
PID 2156 wrote to memory of 2580	2156	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe	33
PID 2156 wrote to memory of 2580	2156	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe	33
PID 2156 wrote to memory of 2680	2156	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe	35
PID 2156 wrote to memory of 2680	2156	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe	35
PID 2156 wrote to memory of 2680	2156	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe	35
PID 2156 wrote to memory of 2680	2156	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe	35
PID 2648 wrote to memory of 2752	2648	iexplore.exe	36
PID 2648 wrote to memory of 2752	2648	iexplore.exe	36
PID 2648 wrote to memory of 2752	2648	iexplore.exe	36
PID 2648 wrote to memory of 2752	2648	iexplore.exe	36
PID 2556 wrote to memory of 2476	2556	ccyqqw.exe	37
PID 2556 wrote to memory of 2476	2556	ccyqqw.exe	37
PID 2556 wrote to memory of 2476	2556	ccyqqw.exe	37
PID 2556 wrote to memory of 2476	2556	ccyqqw.exe	37
PID 2556 wrote to memory of 2464	2556	ccyqqw.exe	38
PID 2556 wrote to memory of 2464	2556	ccyqqw.exe	38
PID 2556 wrote to memory of 2464	2556	ccyqqw.exe	38
PID 2556 wrote to memory of 2464	2556	ccyqqw.exe	38
PID 2464 wrote to memory of 2912	2464	ccyqqwSrv.exe	40
PID 2464 wrote to memory of 2912	2464	ccyqqwSrv.exe	40
PID 2464 wrote to memory of 2912	2464	ccyqqwSrv.exe	40
PID 2464 wrote to memory of 2912	2464	ccyqqwSrv.exe	40
PID 2476 wrote to memory of 2276	2476	ccyqqwmgr.exe	39
PID 2476 wrote to memory of 2276	2476	ccyqqwmgr.exe	39
PID 2476 wrote to memory of 2276	2476	ccyqqwmgr.exe	39
PID 2476 wrote to memory of 2276	2476	ccyqqwmgr.exe	39
PID 2912 wrote to memory of 624	2912	iexplore.exe	41
PID 2912 wrote to memory of 624	2912	iexplore.exe	41
PID 2912 wrote to memory of 624	2912	iexplore.exe	41
PID 2476 wrote to memory of 2112	2476	ccyqqwmgr.exe	42
PID 2476 wrote to memory of 2112	2476	ccyqqwmgr.exe	42
PID 2476 wrote to memory of 2112	2476	ccyqqwmgr.exe	42
PID 2476 wrote to memory of 2112	2476	ccyqqwmgr.exe	42
PID 2112 wrote to memory of 1232	2112	iexplore.exe	43
PID 2112 wrote to memory of 1232	2112	iexplore.exe	43
PID 2112 wrote to memory of 1232	2112	iexplore.exe	43
PID 2276 wrote to memory of 2408	2276	iexplore.exe	44
PID 2276 wrote to memory of 2408	2276	iexplore.exe	44
PID 2276 wrote to memory of 2408	2276	iexplore.exe	44
PID 1872 wrote to memory of 1524	1872	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	45
PID 1872 wrote to memory of 1524	1872	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	45
PID 1872 wrote to memory of 1524	1872	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	45
PID 1872 wrote to memory of 1524	1872	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	45
PID 2112 wrote to memory of 1200	2112	iexplore.exe	47
PID 2112 wrote to memory of 1200	2112	iexplore.exe	47
PID 2112 wrote to memory of 1200	2112	iexplore.exe	47

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
  C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2580
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1440
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2680
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2680 CREDAT:275457 /prefetch:2
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2172
- C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
  C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2648
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2752
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A7258A~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1524

C:\Windows\SysWOW64\ccyqqw.exe
C:\Windows\SysWOW64\ccyqqw.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\ccyqqwmgr.exe
  C:\Windows\SysWOW64\ccyqqwmgr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\Windows\System32\ie4uinit.exe
      "C:\Windows\System32\ie4uinit.exe" -ShowQLIcon
      4⤵
      Drops file in System32 directory
      PID:2408
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of SetWindowsHookEx
      PID:1988
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\System32\ie4uinit.exe
      "C:\Windows\System32\ie4uinit.exe" -ShowQLIcon
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:1232
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of SetWindowsHookEx
      PID:1200
- C:\Windows\SysWOW64\ccyqqwSrv.exe
  C:\Windows\SysWOW64\ccyqqwSrv.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\System32\ie4uinit.exe
      "C:\Windows\System32\ie4uinit.exe" -ShowQLIcon
      4⤵
      Drops file in System32 directory
      PID:624
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:2
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of SetWindowsHookEx
      PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RecoveryStore.{69C20441-29DE-11EF-BA28-C2931B856BB4}.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69C20441-29DE-11EF-BA28-C2931B856BB4}.dat
Size 3KB
SHA256 fb6ad4760265fc9fd0b11f56a48a4d849eb25c99496930e27a36aafcead8114a
MD5 fe6d498d8b0ba5e39e488dea7d774baf
SHA1 c6b246fed06433ee6ba32f197f8d0ecb46740f54
SHA512 468692f764ee6fb30ceacd691fa30913534d35af495c8ef4a7b341208a2ce09130f912cc84ab94ebeaf194f74f06b5fa2f65b5746a8d27053f281fa3b40c1d03
MD5 SHA1 SHA512

Submit Download

RecoveryStore.{69C22B51-29DE-11EF-BA28-C2931B856BB4}.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69C22B51-29DE-11EF-BA28-C2931B856BB4}.dat
Size 5KB
SHA256 ef9e054bb079950dce93cedb81f03f2f81d4d0a21ec8193e9f863a9a59f244e4
MD5 a050eecf95ef1762be8ba8211f52453e
SHA1 809eb51441853dd863b5879fb14e037fdcfcacf4
SHA512 9f42c1f8d4587ab0f514286c51aa4def823b76d2d675687fe38ec5cb8b3123b2fe38a6c6afa82310e058fcc58598ccf156c7f6efe57319768f006c9e63227982
SSDEEP 24:rSGo/QNBumXWGo/5BumXWBumX8QNlWdxl+vNlWdxl+:rSGo4TummGoHumOumsddjTdj
MD5 SHA1 SHA512 SSDEEP

Submit Download

a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe

Path C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
Size 55KB
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
SSDEEP 1536:Q+hzRsibKplyXTq8OGRnsPFG+RODTb7MXL5uXZnzE:bROzoTq0+RO7IwnY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccyqqw.exe

Path C:\Windows\SysWOW64\ccyqqw.exe
Size 368KB
SHA256 16571e6da1e5261d7a97e8f1bddd953dd2cb4e94cf67e378376521ef675fa6f7
MD5 a7258abe54185fa9651fd4c0ac03fefa
SHA1 7ca46de7d75de921d10cbeb07a8a91ec03cdc636
SHA512 43146037f16c74c683bdc53f7c24a0fcbb10a76821e84097910a6af72da52e611677256201d978f9f0773d8216e9d2a4b5ae4f91cb23122208acebe216816848
SSDEEP 6144:SWKRvtDOCzszEklyYFhaHnE1ZxFzrAXiL9a1gmjMm:SWKPIEks+OoZv/zBab
MD5 SHA1 SHA512 SSDEEP

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
Size 97B
SHA256 a42b05c8ba93f4f590f5f367118f4850dff4f3ec3a4a5e1aecce87a9ae4d5511
MD5 45746b5317d380078febe04385b81405
SHA1 e6b9a47deab744c12125936c5e5abb3e07b87fe8
SHA512 caf91351c5590922a9a3faa41f5ebc82b450208a486a7a1cee32c140c2290f8890bcdd216371cfe5135e5cc0cfeca323b1d3a09973cd415239b1f7959af28098
MD5 SHA1 SHA512

Submit Download

Suggested Sites.url

Path C:\Windows\System32\config\systemprofile\Favorites\Links\Suggested Sites.url
Size 129B
SHA256 bdc63d9fd191114227a6e0ac32aaf4de85b91fc602fcb8555c0f3816ac8620b3
MD5 2578ef0db08f1e1e7578068186a1be0f
SHA1 87dca2f554fa51a98726f0a7a9ac0120be0c4572
SHA512 b42be0e6f438362d107f0f3a7e4809753cf3491ab15145f9ffa4def413606243f4dfffc0449687bd1bb01c653e9339e26b97c286382743d14a2f0ed52e72f7ee
MD5 SHA1 SHA512

Submit Download

Suggested Sites.url

Path C:\Windows\System32\config\systemprofile\Favorites\Links\Suggested Sites.url
Size 236B
SHA256 e3ab045d746a0821cfb0c34aee9f98ce658caab2c99841464c68d49ab2cd85d9
MD5 11cede0563d1d61930e433cd638d6419
SHA1 366b26547292482b871404b33930cefca8810dbd
SHA512 d9a4cdd3d3970d1f3812f7b5d21bb9ae1f1347d0ddfe079a1b5ef15ec1367778056b64b865b21dd52692134771655461760db75309c78dc6f372cc4d0ab7c752
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Favorites\Links\desktop.ini
Size 80B
SHA256 e469ed17b4b54595b335dc51817a52b81fcf13aad7b7b994626f84ec097c5d57
MD5 3c106f431417240da12fd827323b7724
SHA1 2345cc77576f666b812b55ea7420b8d2c4d2a0b5
SHA512 c7391b6b9c4e00494910303e8a6c4dca5a5fc0c461047ef95e3be1c8764928af344a29e2e7c92819174894b51ae0e69b5e11a9dc7cb093f984553d34d5e737bb
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Favorites\desktop.ini
Size 402B
SHA256 a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
MD5 881dfac93652edb0a8228029ba92d0f5
SHA1 5b317253a63fecb167bf07befa05c5ed09c4ccea
SHA512 592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810
MD5 SHA1 SHA512

Submit Download

www1A35.tmp

Path C:\Windows\Temp\www1A35.tmp
Size 195B
SHA256 d3b6eea852bacee54fbf4f3d77c6ec6d198bd59258968528a0231589f01b32f4
MD5 a1fd5255ed62e10721ac426cd139aa83
SHA1 98a11bdd942bb66e9c829ae0685239212e966b9e
SHA512 51399b4eac1883f0e52279f6b9943d5a626de378105cadff2b3c17473edf0835d67437ae8e8d0e25e5d4b88f924fa3ac74d808123ec2b7f98eff1b248a1ab370
MD5 SHA1 SHA512

Submit Download

www1A36.tmp

Path C:\Windows\Temp\www1A36.tmp
Size 216B
SHA256 992031e95ad1e0f4305479e8d132c1ff14ed0eb913da33f23c576cd89f14fa48
MD5 2ce792bc1394673282b741a25d6148a2
SHA1 5835c389ea0f0c1423fa26f98b84a875a11d19b1
SHA512 cdcc4d9967570018ec7dc3d825ff96b4817fecfbd424d30b74ba9ab6cc16cb035434f680b3d035f7959ceb0cc9e3c56f8dc78b06adb1dd2289930cc9acc87749
MD5 SHA1 SHA512

Submit Download

RecoveryStore.{69D50F41-29DE-11EF-BA28-C2931B856BB4}.dat

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69D50F41-29DE-11EF-BA28-C2931B856BB4}.dat
Size 5KB
SHA256 8c3ca5ae3147acbb08165abde9a30197f896046797b9ca099942d21236c96742
MD5 595230d35ea439306ad84fb6c21e36b9
SHA1 7622a87c12d102a2a210a288c9bc8b5d13370045
SHA512 f84080bc99255e8e20e8d9b1381b3892b4ee55146741c5dce15a450d748f6e61a4e53970911048db67a8b5dce1cb0142fa41131bb378095d9a292d55cc7f7bad
SSDEEP 24:rpGo/QvwQBumXdGo/bwQBumX0wQBumX8QNlWYlrcNlWYlr:rpGo4vhumNGozhumkhumsd4l4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Launch Internet Explorer Browser.lnk

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Size 1KB
SHA256 26c511995921ce38781848bbfd17f18c3bcbb799f576fc72370dff3485fa14a0
MD5 88f7a3be05d963c1b806ddbc7135ca8c
SHA1 cac3eaf79d44c4267024d576fcd7ca1ebe802d26
SHA512 dfff2f34cbe088714707d3631080b7296ba46d37f7277d5c3d3f04b29933c059ff63c2d39ee48a4e8b79444e488e169a41cdb0a9faab1a803f092cd1a68e05ed
MD5 SHA1 SHA512

Submit Download

a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe

Path \Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
Size 105KB
SHA256 54282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0
MD5 dfb5daabb95dcfad1a5faf9ab1437076
SHA1 4a199569a9b52911bee7fb19ab80570cc5ff9ed1
SHA512 5d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8
SSDEEP 1536:MOC0FvV4OguHxjhpA4Bm7uW0vSUsghQevBFkutIbgTuFqKRr0aF5frleGhd9TfBi:MwV4OgSzBmh04eZFkz3Rr0gwGj9Tf8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1872-17-0x0000000000360000-0x00000000003BB000-memory.dmp

Download

memory/1872-52-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1872-15-0x0000000000360000-0x00000000003BB000-memory.dmp

Download

memory/1872-19-0x0000000000220000-0x000000000024E000-memory.dmp

Download

memory/1872-0-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2156-34-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/2156-33-0x0000000000330000-0x0000000000331000-memory.dmp

Download

memory/2156-157-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/2156-21-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/2156-31-0x0000000000320000-0x0000000000321000-memory.dmp

Download

memory/2156-32-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/2464-54-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2464-59-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2476-60-0x00000000003F0000-0x00000000003F1000-memory.dmp

Download

memory/2476-56-0x00000000003E0000-0x00000000003E1000-memory.dmp

Download

memory/2476-51-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/2556-37-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2556-53-0x00000000001B0000-0x00000000001DE000-memory.dmp

Download

memory/2556-48-0x00000000001B0000-0x000000000020B000-memory.dmp

Download

memory/2556-159-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2556-160-0x00000000001B0000-0x00000000001DE000-memory.dmp

Download

memory/2572-28-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/2572-30-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2612-20-0x0000000000400000-0x000000000042E000-memory.dmp

Download