cybergate | 69bd0504604bb8f94928e0bc4d710639f23d99ddeedd7036c8d6d19d26b6cd42

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
22/06/2024, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe
Size 428KB
Sample240622-a64trsshpj
SHA256 69bd0504604bb8f94928e0bc4d710639f23d99ddeedd7036c8d6d19d26b6cd42
MD5 0081117561dbbe476ca7c53d931272eb
SHA1 c63c2af8e87297fa66b6fdd8898b50b64a0c2e23
SHA512 cee68886a6d82a16e992bd68e33453d23f71c615771a6ab38a3a4ce691d69d16b4e85fb0c0a2d15443f1920ee686e33d19a49ed87422648eba321fd907a27155
SSDEEP 6144:Ibt2jtf5kORPWBqrqcGSDTE8snxL6SmyOI/z4JK8MtoBhO/Ilu+uzZ:HjXkk+QWcGSDTE99lOIr4Jhh5nuz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cybergate vítima persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

Botnet

vítima

127.0.0.1:81
fenerli1907.no-ip.biz:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
svchost.exe
install_dir
windows
install_file
system.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\windows\\system.exe"	vbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\windows\\system.exe"	vbc.exe
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vbc.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{4G3XAL46-US40-57D6-Y00B-EGLJYBW6HX58}	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4G3XAL46-US40-57D6-Y00B-EGLJYBW6HX58}\StubPath = "C:\\Windows\\system32\\windows\\system.exe Restart"	vbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{4G3XAL46-US40-57D6-Y00B-EGLJYBW6HX58}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4G3XAL46-US40-57D6-Y00B-EGLJYBW6HX58}\StubPath = "C:\\Windows\\system32\\windows\\system.exe"	explorer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
3620	0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe
4484	system.exe

Loads dropped DLL 3 IoCs

pid	Process
3620	0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe
3620	0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe
3620	0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2420-36-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/2420-39-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/2420-40-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/2420-42-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/2420-46-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/2420-49-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/2420-181-0x0000000000400000-0x0000000000459000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rOaoWnZdErpjCyVqQVSdgvRSblgKZsMfaPuEFDIslsXkjzEGxX = "C:\\Users\\Admin\\AppData\\Local\\0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe"	0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\windows\\system.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\windows\\system.exe"	vbc.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\windows\system.exe	vbc.exe
File opened for modification	C:\Windows\SysWOW64\windows\system.exe	vbc.exe
File opened for modification	C:\Windows\SysWOW64\windows\	vbc.exe
File created	C:\Windows\SysWOW64\windows\system.exe	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3620 set thread context of 2420	3620	0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	vbc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2420	vbc.exe
2420	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe
2876	vbc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2876	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	vbc.exe
Token: SeDebugPrivilege	2876	vbc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 3620	3060	0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe	83
PID 3060 wrote to memory of 3620	3060	0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe	83
PID 3060 wrote to memory of 3620	3060	0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe	83
PID 3620 wrote to memory of 2420	3620	0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe	86
PID 3620 wrote to memory of 2420	3620	0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe	86
PID 3620 wrote to memory of 2420	3620	0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe	86
PID 3620 wrote to memory of 2420	3620	0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe	86
PID 3620 wrote to memory of 2420	3620	0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe	86
PID 3620 wrote to memory of 2420	3620	0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe	86
PID 3620 wrote to memory of 2420	3620	0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe	86
PID 3620 wrote to memory of 2420	3620	0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe	86
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56
PID 2420 wrote to memory of 3452	2420	vbc.exe	56

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:784
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:380

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:800
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:2964
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3752
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3840
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3904
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3988
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4132
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:3368
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4948
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:2700
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3488
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:4528
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:3584
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3528
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2984
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:3388
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:1564
- C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
  C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
  2⤵
  PID:4868
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:892
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:520
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:3668
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:4216
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:4060
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:1720
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:1056
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1160
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1532
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2020

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2596

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3352

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3452
- C:\Users\Admin\AppData\Local\Temp\0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Users\Admin\AppData\Roaming\0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Roaming\0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3620
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      4⤵
      Adds policy Run key to start application
      Boot or Logon Autostart Execution: Active Setup
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2420
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        
        PID:4524
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
        5⤵
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:900
      - C:\Windows\SysWOW64\windows\system.exe
        
        "C:\Windows\system32\windows\system.exe"
        6⤵
        Executes dropped EXE
        
        PID:4484
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2212

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4412

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe f911383b43e33a0fa1835ba8709267d9 qmyr5G8v2kOMZjPweHxrtQ.0.1.0.0.0
1⤵
PID:764
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4784

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe.log
Size 319B
SHA256 1493eb1dc75a64eb2eb06bc9eb2c864b78fc4a2c674108d5183ac7824013ff2d
MD5 600936e187ce94453648a9245b2b42a5
SHA1 3349e5da3f713259244a2cbcb4a9dca777f637ed
SHA512 d41203f93ed77430dc570e82dc713f09d21942d75d1f9c3c84135421550ac2fa3845b7e46df70d2c57fe97d3a88e43c672771bb8b6433c44584c4e64646c1964
MD5 SHA1 SHA512

Submit Download

XX--XX--XX.txt

Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Size 240KB
SHA256 81e6cd1275a3df0184b02fcdb5bcb31d27bf56c8f22e7f62bd1d8a2bd1140308
MD5 6e4f978fe3aec19ca9498551e93678d0
SHA1 bd74f4186eb34a6ec0bafc64617968c872079bad
SHA512 57448df1f3f494c2f3f1d7840ac2ee766f0ba2295a5a10fafb9c5560f66a3c17646a6bc4e53b928b999d8a00b78a83cb9b09686cc04e0a9df336d036037797f9
SSDEEP 3072:oKMP5JuXLFG3Oa95BrKUqEQ94jhc3PQuPe2D2ue3NXR0jW/UCFnp7HBIJJyCwFiQ:k5JGmrpQsK3RD2u270jupCJsCxCT
MD5 SHA1 SHA512 SSDEEP

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 3eff209ce8462413158b2d643d7daa17cd432d41923cb9fcce4a5201dc6c91bb
MD5 3605d3cacab0677c0cf4c8f712beae0d
SHA1 ae1c8b4c5347f9a257ea88574251b169550ecd4a
SHA512 945ba0f6e57fd0dc92ded78bc1dadb6030e5c01f9b47c24de5382404e735f89eb55b7660d98b88818cd51f5fb60f83c3f9ca4e004df30019365786b846f69e6b
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 ba9d07f4b2ccbdb5dead4addb899792efbc85284af12d093c0c80a3666ab6aed
MD5 394c4c99d33de21667a4362729ec6a45
SHA1 ae14afaba223202f85f9c0ace3b8d495c2bf0c36
SHA512 622c41b396058a655bf8f8399266b1caf15996b11ee948348b194dce5fff45f8f7286a43e3878dd8380e9cc6b6ca2a95a7115331768da7da066961706fde6415
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 4d5c5d4702f1347c2411260e9ce9ea43089316071a25545a9c0266cb405763ad
MD5 abe16d92b9e6feb2098a22f95747028f
SHA1 da99cbcc0cd0ac7acc5453234d77a00ed24ea7d3
SHA512 a82ea2a7be3a8bb41db8c90660f94e94e2953e762c429c2edacaad60d7ecbe3d6b2e93ce52116f9df887cd6d7e5006a15fc660ee26ba1d912a67e3ac0f6b89bf
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 4e1e6cf042bf5b5fca54178d20f34ae799b881cd7660ac2ee5f2befe3bdbb3f2
MD5 2149a1e3d51b2f22dc529da60b300370
SHA1 f1c8d4304d5885b5439fa34e4aab8a52735117e9
SHA512 6d46b24226fd884db0c224f41a073a5a1bcb2caee58dc4b1fe0dbe373598859c2c87cf561e1f0c78f659657d7332d9dae216b604b90e09387ba9f68cafebed6e
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 f207f7f2d5249cc1a1f79198fba39907592867d3dca334932bacf5744692f42f
MD5 b7e9b7c2773d1ba8848d001e6a51446e
SHA1 37195cdeb982a726582a212843a21e830a21d392
SHA512 7bd4e9ac9f2820407e4b522c403eb728c67a25d8cfcbee1e139457db60a0d53e080aa6f93396d9393a64c109b37bb1b48870b733f5e9009dee75797595da8dd3
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 f7a42bb071e7728debc67375a8a65880e8471c4f24b0ac22f07ec84ae3804fa7
MD5 0652ef583b4d5b0b61082e5b85117ef4
SHA1 ae8eb9f4f4891d14464d4b673b0717cfc04bbc8b
SHA512 634a28a6fd30fe63f12ee47e4076283fa50f9a292b780bae17094ed0d09e137581cb8e5440e8d29999deb052fd4e4227dcd487811ab03ad207ab2d1cbbc1c812
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 7379331c883aacfdbdc436a0bbf37dd8dd4dd66f85e299ad987321d9a042e9fb
MD5 c521edbff8ee66a2c4a13a9b9fd3bf7b
SHA1 5ee01bf076c6098db51a9eba89fc8d52493ebc54
SHA512 bf7e6f2460371b82d782a9050f457e7558ac9535fa69df93a6c6d52eea69b920f38e93c1ac3fd16c459ecb82b00048df765505fe47c5b99c6a158612e56f779a
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 68f24c47110fd079e05f1a25f46e2b3445b868076892e0d9a2c6ddf6bad8652b
MD5 dfd40db1a5ac4e47f785fee37d988f4b
SHA1 f8e002e340f9ff96d58299deda2a8ee9ebf9d4b8
SHA512 f89a000716aca411f77614b43dc579709870ff32bfde38638e1f255f8a01db211ed783306f1ac83e33f6a246823b5bd705de303e34c04c407c341f1247594264
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 fce96eb675da522eff8d078967bb45522c1dacea353cdc42ee13b934da50cbab
MD5 65a1af38189c50777abc38e95acd0141
SHA1 4ea2671bd0ee30647136232b5a3d8fc42a9d2b8b
SHA512 c7b891fab45e4e5763d53e35624868a84e5a570734d7177e158de02f913efbeddb1f50b9fd2aa893b236a7aa3f9730a4bf19f6e2fdfd83bcd65d3debd9301c07
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 59f314dfa2dae8dd5fd3073bcacf2c86401d6ea192811ee1295e3c206d9f1c0c
MD5 52487f67988b549e9d67c87966c44ad3
SHA1 d3847e3b32c9dbf4fdbbfbe1f8314680ae8f7faa
SHA512 485f29099743132f3e43a95c85bfb0d908cbb826b3ebdca00ff2e8cecca2d4170540835963d9bc035affc687d31a1f223db7547e221662b7e1f0edc8049489df
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 b6c425b7eee323c5f0fb95f2799ebd899a452a06b6f11a452da520d3534854b4
MD5 31e4d2c862b871b61db87bc03f589769
SHA1 1c852eca1eebf9c81f8047efec441f289752bb84
SHA512 754ca63fd525fce808ff2f5b5ec15dbad28865c839b4293bc1c743f10a075cccd952a925d4e2b4532daeb530d0aea966cd480381e3ea62755897eecb7f63bb4e
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 bc6760c5c1bcf6d6a782e3b7303394e9c2ba626f32193b8a7224172f766f57d5
MD5 e9ec478b7fc81ff30afb964e2a1884f3
SHA1 b1407dcbe742612cc00eee8ba007bd9195e66161
SHA512 64e70177ab7f01ee5bbc0154a61385542b6375fa05e9b2fcbf294893dd6d5d57a0be86ba11188392745a638d379a1a6f4d5b9cacf1f91bc815fd5bb957adc522
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 102d07742517b2fe6e4f12d27b08416a2924ca7c4b62c851dbb1dfa1453cde4c
MD5 0dde77501aa3545e82e2cef328bcf917
SHA1 bd22714f0f21d4806c0a45c5651643a07c95d7fd
SHA512 462506aa4a9ed9a72b4a997297da8b33851463888926de16c2a669cdc85f7c2e662fedb2a1f4cd8a7e26695c3a0e581b5cda2f9e4e3c708ec920403154007acb
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 8be020a2539cc9129f8472e6a7d7b9bb4b595459d7b0ddf3c85effd963073999
MD5 70dbb774adb0f58d86e7c6886f9ed949
SHA1 9e66b77663266b93222b4297efcbcda129077d6d
SHA512 ae92825e00add36262c5333c711a45ecc90d65a3bf3e945c86c410d44c1dfdaa7c975bcb6bc0432154a011602ea48e8beed8d7e23935ac38259e94296c8a76b3
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 74448383710bae14f755185dd3e62c8a70fd3fc6a5ac91ccb79e76312e43b4e2
MD5 47d49e4018023b366f56a8e63c8e6b18
SHA1 8400098f1fb7bc65a518ba214904a18bc7565ca7
SHA512 a875f2c40b666e1ea587812a7d83aa48c8238f2dd58823b28c3fcd3a4f5e7d43da8663195a63fea6b79d37cbc9061aad0b6a6939a05a2de21c1e317a30408255
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 083bccdfb94f5e2950d39664955d1496e057cea9c2348bae29bc10cfb65637e7
MD5 bd0d26cb524800b461a048de8981fcd4
SHA1 8f690b33aea03370d3bcbde04dc087852fe3b3fa
SHA512 ffc7ca07d3ba5325ebf693cb7c919381378b0c242c30f957d89ede2b7dabe1053834d2419a3debead28e9d9285de62ecf1eb27ae2f50226b74b51ff3a0ed5bf2
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 5faec1cb9679012db719b6ea962140e934888e67d5a439fd733274ca818e69d6
MD5 6fbcc8811c16666e889495fd75f1ecc6
SHA1 fbfc9e56e5451f095b1a52b52306bde260c73d2a
SHA512 b371d07baf558a7166339b558b910cb642f8907572af39ae342c0805a0615586714709dc3592e57361e22ac5546ab363eff5dd6bcf9b192e110d4d1558d44bf8
MD5 SHA1 SHA512

Submit Download

0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe

Path C:\Users\Admin\AppData\Roaming\0081117561dbbe476ca7c53d931272eb_JaffaCakes118.exe
Size 428KB
SHA256 69bd0504604bb8f94928e0bc4d710639f23d99ddeedd7036c8d6d19d26b6cd42
MD5 0081117561dbbe476ca7c53d931272eb
SHA1 c63c2af8e87297fa66b6fdd8898b50b64a0c2e23
SHA512 cee68886a6d82a16e992bd68e33453d23f71c615771a6ab38a3a4ce691d69d16b4e85fb0c0a2d15443f1920ee686e33d19a49ed87422648eba321fd907a27155
SSDEEP 6144:Ibt2jtf5kORPWBqrqcGSDTE8snxL6SmyOI/z4JK8MtoBhO/Ilu+uzZ:HjXkk+QWcGSDTE99lOIr4Jhh5nuz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Twain.dll

Path C:\Users\Admin\AppData\Roaming\Twain.dll
Size 18KB
SHA256 645b30a3ef5cf05ad0df575fbbdbc05387b5493ce1778935b60d98681fea7bc0
MD5 2153e2d85da316a0fe302227e0f9af88
SHA1 48b334c27d604ce7d89c9c825d211d26427176cf
SHA512 647b0b95622c2e9086f072ccf110371b38953619b4cb6697e259165ce12e0dd1854bc6351abb8f693d052d730f8790d72929a8c822a26ac369c372478c1e4fac
SSDEEP 384:sKNh1KNM8/7q8rUSTVAMAt2qqve+LR8v9scYAIZaTWQB:bNwM8/GidINI0lB
MD5 SHA1 SHA512 SSDEEP

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\logs.dat
Size 15B
SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
MD5 e21bd9604efe8ee9b59dc7605b927a2a
SHA1 3240ecc5ee459214344a1baac5c2a74046491104
SHA512 42052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493
MD5 SHA1 SHA512

Submit Download

system.exe

Path C:\Windows\SysWOW64\windows\system.exe
Size 1.1MB
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
SSDEEP 24576:jp2silPBMIXGWClfuRcUGIJYK15Qs/QZM:jp2sMO7VzUTJH15QFZM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2420-49-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/2420-36-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2420-181-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2420-42-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2420-40-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2420-39-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2420-46-0x0000000024010000-0x0000000024072000-memory.dmp

Download

memory/3060-19-0x0000000074EE0000-0x0000000075491000-memory.dmp

Download

memory/3060-1-0x0000000074EE0000-0x0000000075491000-memory.dmp

Download

memory/3060-0-0x0000000074EE2000-0x0000000074EE3000-memory.dmp

Download

memory/3060-2-0x0000000074EE0000-0x0000000075491000-memory.dmp

Download

memory/3620-41-0x0000000074EE0000-0x0000000075491000-memory.dmp

Download

memory/3620-16-0x0000000074EE0000-0x0000000075491000-memory.dmp

Download

memory/3620-18-0x0000000074EE0000-0x0000000075491000-memory.dmp

Download

memory/4524-51-0x00000000010D0000-0x00000000010D1000-memory.dmp

Download

memory/4524-50-0x0000000001010000-0x0000000001011000-memory.dmp

Download

memory/4524-110-0x0000000000090000-0x00000000004C3000-memory.dmp

Download

memory/4524-1311-0x0000000000090000-0x00000000004C3000-memory.dmp

Download