840acc765da512f781f89bb05880e3173a360cfd48c0117938b5348b9b2ef7dd

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 18:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
Size

255KB
MD5

3e80d28328e3ef6aebdb83964111abec
SHA1

3ba7992eec21c31a2289c7381bc3d2f5fc5392bb
SHA256

840acc765da512f781f89bb05880e3173a360cfd48c0117938b5348b9b2ef7dd
SHA512

75ac9c9673aaa61befed276fc0e1c24d12cce205758dce0b641d6b67e32f9477b60e9841f4511f9d2b638592e714582df096eeecfdad6150c868f6d655d19080
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJN:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIC

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	zgrjiskzpg.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	zgrjiskzpg.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	zgrjiskzpg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	zgrjiskzpg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	zgrjiskzpg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	zgrjiskzpg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	zgrjiskzpg.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	zgrjiskzpg.exe

Executes dropped EXE 5 IoCs

pid	Process
1632	zgrjiskzpg.exe
1260	leinjbjlfecnrhk.exe
2236	arcbrzgtpczqq.exe
2884	txldnnww.exe
2716	txldnnww.exe

Loads dropped DLL 5 IoCs

pid	Process
1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
1632	zgrjiskzpg.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1056-0-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x0007000000014b9f-9.dat	upx
behavioral1/files/0x0009000000012286-17.dat	upx
behavioral1/files/0x0007000000014bed-30.dat	upx
behavioral1/files/0x0008000000014b54-40.dat	upx
behavioral1/memory/2884-39-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2236-38-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1260-37-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1632-25-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1056-23-0x0000000002EC0000-0x0000000002F60000-memory.dmp	upx
behavioral1/memory/2716-46-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1056-48-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x0006000000015f37-76.dat	upx
behavioral1/files/0x0006000000015e4e-74.dat	upx
behavioral1/memory/1632-87-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2716-91-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2236-90-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2884-89-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1260-88-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2716-93-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2884-95-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1260-97-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2236-98-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1632-96-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1260-99-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2236-100-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1260-103-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2236-104-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1632-102-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1260-106-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2236-107-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1632-105-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1632-108-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1260-109-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2236-110-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1260-113-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2236-114-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1632-112-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1632-115-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2236-117-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1260-116-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1632-118-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2236-120-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1260-119-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1260-122-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2236-123-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1632-121-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1632-143-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1260-144-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2236-145-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1632-146-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2236-148-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1260-147-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1632-149-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2236-151-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1260-150-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1632-152-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1260-153-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2236-154-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1632-155-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1260-156-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2236-157-0x0000000000400000-0x00000000004A0000-memory.dmp	upx

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	zgrjiskzpg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	zgrjiskzpg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	zgrjiskzpg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	zgrjiskzpg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	zgrjiskzpg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	zgrjiskzpg.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lkindigz = "zgrjiskzpg.exe"	leinjbjlfecnrhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\rvrfcidb = "leinjbjlfecnrhk.exe"	leinjbjlfecnrhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "arcbrzgtpczqq.exe"	leinjbjlfecnrhk.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	zgrjiskzpg.exe
File opened (read-only)	\??\l:	zgrjiskzpg.exe
File opened (read-only)	\??\u:	zgrjiskzpg.exe
File opened (read-only)	\??\w:	zgrjiskzpg.exe
File opened (read-only)	\??\z:	zgrjiskzpg.exe
File opened (read-only)	\??\m:	txldnnww.exe
File opened (read-only)	\??\a:	zgrjiskzpg.exe
File opened (read-only)	\??\r:	zgrjiskzpg.exe
File opened (read-only)	\??\z:	txldnnww.exe
File opened (read-only)	\??\m:	txldnnww.exe
File opened (read-only)	\??\p:	txldnnww.exe
File opened (read-only)	\??\v:	txldnnww.exe
File opened (read-only)	\??\z:	txldnnww.exe
File opened (read-only)	\??\i:	txldnnww.exe
File opened (read-only)	\??\o:	txldnnww.exe
File opened (read-only)	\??\w:	txldnnww.exe
File opened (read-only)	\??\y:	txldnnww.exe
File opened (read-only)	\??\u:	txldnnww.exe
File opened (read-only)	\??\i:	zgrjiskzpg.exe
File opened (read-only)	\??\b:	txldnnww.exe
File opened (read-only)	\??\n:	txldnnww.exe
File opened (read-only)	\??\t:	txldnnww.exe
File opened (read-only)	\??\j:	txldnnww.exe
File opened (read-only)	\??\b:	zgrjiskzpg.exe
File opened (read-only)	\??\h:	txldnnww.exe
File opened (read-only)	\??\r:	txldnnww.exe
File opened (read-only)	\??\i:	txldnnww.exe
File opened (read-only)	\??\a:	txldnnww.exe
File opened (read-only)	\??\e:	zgrjiskzpg.exe
File opened (read-only)	\??\h:	zgrjiskzpg.exe
File opened (read-only)	\??\j:	zgrjiskzpg.exe
File opened (read-only)	\??\q:	zgrjiskzpg.exe
File opened (read-only)	\??\y:	zgrjiskzpg.exe
File opened (read-only)	\??\g:	txldnnww.exe
File opened (read-only)	\??\k:	txldnnww.exe
File opened (read-only)	\??\k:	txldnnww.exe
File opened (read-only)	\??\o:	txldnnww.exe
File opened (read-only)	\??\b:	txldnnww.exe
File opened (read-only)	\??\h:	txldnnww.exe
File opened (read-only)	\??\x:	txldnnww.exe
File opened (read-only)	\??\p:	zgrjiskzpg.exe
File opened (read-only)	\??\v:	zgrjiskzpg.exe
File opened (read-only)	\??\a:	txldnnww.exe
File opened (read-only)	\??\v:	txldnnww.exe
File opened (read-only)	\??\y:	txldnnww.exe
File opened (read-only)	\??\k:	zgrjiskzpg.exe
File opened (read-only)	\??\m:	zgrjiskzpg.exe
File opened (read-only)	\??\o:	zgrjiskzpg.exe
File opened (read-only)	\??\t:	zgrjiskzpg.exe
File opened (read-only)	\??\g:	txldnnww.exe
File opened (read-only)	\??\s:	zgrjiskzpg.exe
File opened (read-only)	\??\x:	zgrjiskzpg.exe
File opened (read-only)	\??\e:	txldnnww.exe
File opened (read-only)	\??\q:	txldnnww.exe
File opened (read-only)	\??\j:	txldnnww.exe
File opened (read-only)	\??\l:	txldnnww.exe
File opened (read-only)	\??\p:	txldnnww.exe
File opened (read-only)	\??\s:	txldnnww.exe
File opened (read-only)	\??\t:	txldnnww.exe
File opened (read-only)	\??\u:	txldnnww.exe
File opened (read-only)	\??\l:	txldnnww.exe
File opened (read-only)	\??\n:	txldnnww.exe
File opened (read-only)	\??\s:	txldnnww.exe
File opened (read-only)	\??\n:	zgrjiskzpg.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	zgrjiskzpg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	zgrjiskzpg.exe

AutoIT Executable 53 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1056-0-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2236-38-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1260-37-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1056-23-0x0000000002EC0000-0x0000000002F60000-memory.dmp	autoit_exe
behavioral1/memory/1056-48-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1632-87-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2716-91-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2236-90-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2884-89-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1260-88-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2716-93-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2884-95-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1260-97-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2236-98-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1632-96-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1260-99-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2236-100-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1260-103-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2236-104-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1632-102-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1260-106-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2236-107-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1632-105-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1632-108-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1260-109-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2236-110-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1260-113-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2236-114-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1632-112-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1632-115-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2236-117-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1260-116-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1632-118-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2236-120-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1260-119-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1260-122-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2236-123-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1632-121-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1632-143-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1260-144-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2236-145-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1632-146-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2236-148-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1260-147-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1632-149-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2236-151-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1260-150-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1632-152-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1260-153-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2236-154-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1632-155-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1260-156-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2236-157-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\zgrjiskzpg.exe	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\leinjbjlfecnrhk.exe	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\txldnnww.exe	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\arcbrzgtpczqq.exe	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\arcbrzgtpczqq.exe	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\zgrjiskzpg.exe	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\leinjbjlfecnrhk.exe	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\txldnnww.exe	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	zgrjiskzpg.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	txldnnww.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	txldnnww.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	txldnnww.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	txldnnww.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	txldnnww.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	txldnnww.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	txldnnww.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	txldnnww.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	txldnnww.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	txldnnww.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	txldnnww.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	txldnnww.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	txldnnww.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	txldnnww.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	txldnnww.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mydoc.rtf	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	zgrjiskzpg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	zgrjiskzpg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	zgrjiskzpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	zgrjiskzpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32302C7F9D5283556A3577D370562DAD7C8E64DE"	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB9FAB1F964F197837A3B4386EA39E4B08902F14312034EE2CC42E808A1"	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E89FCFC485A85139041D62D7D92BC90E63259446636623FD6EC"	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1939C70C14E0DAC4B8BE7C92EDE534CB"	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	zgrjiskzpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	zgrjiskzpg.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7FD6BC5FE6D21ADD20FD0A78A7E9060"	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	zgrjiskzpg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	zgrjiskzpg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	zgrjiskzpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	zgrjiskzpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	zgrjiskzpg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	zgrjiskzpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB0B05B47E2399F53BFBADC3392D4BE"	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2584	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
1260	leinjbjlfecnrhk.exe
1260	leinjbjlfecnrhk.exe
1260	leinjbjlfecnrhk.exe
1260	leinjbjlfecnrhk.exe
1260	leinjbjlfecnrhk.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
1632	zgrjiskzpg.exe
1632	zgrjiskzpg.exe
1632	zgrjiskzpg.exe
1632	zgrjiskzpg.exe
1632	zgrjiskzpg.exe
2884	txldnnww.exe
2884	txldnnww.exe
2884	txldnnww.exe
2884	txldnnww.exe
2716	txldnnww.exe
2716	txldnnww.exe
2716	txldnnww.exe
2716	txldnnww.exe
1260	leinjbjlfecnrhk.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
1260	leinjbjlfecnrhk.exe
1260	leinjbjlfecnrhk.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
1260	leinjbjlfecnrhk.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
1260	leinjbjlfecnrhk.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
1260	leinjbjlfecnrhk.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
1260	leinjbjlfecnrhk.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
1260	leinjbjlfecnrhk.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
1260	leinjbjlfecnrhk.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
1260	leinjbjlfecnrhk.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
1260	leinjbjlfecnrhk.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
1260	leinjbjlfecnrhk.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
1260	leinjbjlfecnrhk.exe
1260	leinjbjlfecnrhk.exe
1260	leinjbjlfecnrhk.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
1632	zgrjiskzpg.exe
1632	zgrjiskzpg.exe
1632	zgrjiskzpg.exe
2884	txldnnww.exe
2884	txldnnww.exe
2884	txldnnww.exe
2716	txldnnww.exe
2716	txldnnww.exe
2716	txldnnww.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
1260	leinjbjlfecnrhk.exe
1260	leinjbjlfecnrhk.exe
1260	leinjbjlfecnrhk.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
2236	arcbrzgtpczqq.exe
1632	zgrjiskzpg.exe
1632	zgrjiskzpg.exe
1632	zgrjiskzpg.exe
2884	txldnnww.exe
2884	txldnnww.exe
2884	txldnnww.exe
2716	txldnnww.exe
2716	txldnnww.exe
2716	txldnnww.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2584	WINWORD.EXE
2584	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1632	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	28
PID 1056 wrote to memory of 1632	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	28
PID 1056 wrote to memory of 1632	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	28
PID 1056 wrote to memory of 1632	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	28
PID 1056 wrote to memory of 1260	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	29
PID 1056 wrote to memory of 1260	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	29
PID 1056 wrote to memory of 1260	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	29
PID 1056 wrote to memory of 1260	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	29
PID 1056 wrote to memory of 2884	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	30
PID 1056 wrote to memory of 2884	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	30
PID 1056 wrote to memory of 2884	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	30
PID 1056 wrote to memory of 2884	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	30
PID 1056 wrote to memory of 2236	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	31
PID 1056 wrote to memory of 2236	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	31
PID 1056 wrote to memory of 2236	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	31
PID 1056 wrote to memory of 2236	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	31
PID 1632 wrote to memory of 2716	1632	zgrjiskzpg.exe	32
PID 1632 wrote to memory of 2716	1632	zgrjiskzpg.exe	32
PID 1632 wrote to memory of 2716	1632	zgrjiskzpg.exe	32
PID 1632 wrote to memory of 2716	1632	zgrjiskzpg.exe	32
PID 1056 wrote to memory of 2584	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	33
PID 1056 wrote to memory of 2584	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	33
PID 1056 wrote to memory of 2584	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	33
PID 1056 wrote to memory of 2584	1056	3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe	33
PID 2584 wrote to memory of 1920	2584	WINWORD.EXE	37
PID 2584 wrote to memory of 1920	2584	WINWORD.EXE	37
PID 2584 wrote to memory of 1920	2584	WINWORD.EXE	37
PID 2584 wrote to memory of 1920	2584	WINWORD.EXE	37

C:\Users\Admin\AppData\Local\Temp\3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e80d28328e3ef6aebdb83964111abec_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\zgrjiskzpg.exe
  zgrjiskzpg.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\txldnnww.exe
    C:\Windows\system32\txldnnww.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2716
- C:\Windows\SysWOW64\leinjbjlfecnrhk.exe
  leinjbjlfecnrhk.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1260
- C:\Windows\SysWOW64\txldnnww.exe
  txldnnww.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2884
- C:\Windows\SysWOW64\arcbrzgtpczqq.exe
  arcbrzgtpczqq.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2236
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
404795044fb1e0d52901a893f355f990

SHA1
2424a8f0dd6f61bccc2d62005cfda11f1749967c

SHA256
966074bbe1281971753e6805e959c9cc5bbd1e44b9b3219717109b9a36383622

SHA512
01bb5790c4df261166c00924e8d48f19be01c199ad51b9e303e57477308bc111c2e2894df7bc3a197e528a089f95ea1dd9a5e5950a459d406ca365cdbc55e7e0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
7492e6a5464de6aad653568c4c4ceb94

SHA1
79f64b8269b6390b4e9e365c346b8dd1428f7b12

SHA256
93339b46a73f3b7bcd4b46edbd7b4f8643f736793597854d9eb15c5f45817814

SHA512
d51b1fd792e61db929dc3f0c9dbdfd0a7e27089fb8f3c12bec3cfce4cd579b62ef35059cbc68e1f6a97153210b9dc1df6da0ce9da4a38e4d9d3b529857b56e76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
20KB

MD5
b5b7626fcfa24226719434fc63b1e2c7

SHA1
c11a25f1e5b8ff3779ca376556ed68a5ae61db94

SHA256
b230df8712c1ba521de2deaa41bb6c09ecfabd9fb206546cc8c1dca820356fbb

SHA512
da69969f0396b5a09d8b3a96a5d67cc4bb74599be0538ccc9c2ffe3686f908398d20a284092eccc7a0e225c33dcb7391cdb05ab99a8b036c4bbdae4cdfe56bd4

Download Submit
C:\Windows\SysWOW64\leinjbjlfecnrhk.exe

Filesize
255KB

MD5
5be32ddb1d3df6fedcd36dacb4b9e966

SHA1
07e11e06fa8421eb9fb3051b7a4d8e67396d64d4

SHA256
5ac2b709b27df781fcc027b1a74858000d9acbd896fb9bccb13b1a68e50aab61

SHA512
e55a732261b6b08c63f9db940b15aae2e7069f009c72d7714267f06c843a275c16b1721d32868ad803488e0129e563a026f208393329f754ba0d1b2c27f824ee

Download Submit
C:\Windows\SysWOW64\txldnnww.exe

Filesize
255KB

MD5
917d21fd8cdefb95385db9a9a38cf999

SHA1
f43d3c4634874114ec955586729994e1fc6827d4

SHA256
ba398dbbc572e45368b037995659ea337093c309e59b39888a5d1ff306fd4a22

SHA512
9181f8c2cd3988cf2d774039dd4635b168f52e320e42d6ddcb8720be7570b33d3d4310a02800ed5a41c3aa14d11bb1326d8fd53fbd344e9d4e27f68a3b7726e3

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\arcbrzgtpczqq.exe

Filesize
255KB

MD5
39a72117113d0a0e0650b559c67e037a

SHA1
a9da1dbf07be0a42c55837bcd8c5784e53500a1c

SHA256
a8008651bcb3d729e91a8259b0b5bc21d428202a31e533b987d974039d48ff60

SHA512
b32078bf14378103cc3f36f100fbd341c684e52d1a6a3832b26bf2a79ed37b0e9da449969cfb0a31f1ebe54c475dcedefeb20011ac36e9b099865ae3bb62387e

Download Submit
\Windows\SysWOW64\zgrjiskzpg.exe

Filesize
255KB

MD5
f0ee49c5d00da4cd6226686cc9264920

SHA1
b8ab660142808a6fee2b8ca52a0f9b71ac5744df

SHA256
562a7b701434f0c03fccc512113cf44097cdc55f91b5155c8a177d6a9c127edc

SHA512
0d4b864962b37316cdb43df87d784ed1f998e0a427cbbe376c62613d898dfb1b0d199d994b78554a908af4eca110537beea781ff8ff13da83b15f321299eb96d

Download Submit
memory/1056-29-0x0000000002EC0000-0x0000000002F60000-memory.dmp

Filesize
640KB

Download
memory/1056-48-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1056-23-0x0000000002EC0000-0x0000000002F60000-memory.dmp

Filesize
640KB

Download
memory/1056-0-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1260-156-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1260-119-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1260-37-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1260-103-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1260-153-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1260-150-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1260-122-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1260-144-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1260-116-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1260-88-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1260-113-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1260-109-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1260-97-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1260-106-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1260-147-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1260-99-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1632-102-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1632-155-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1632-25-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1632-96-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1632-149-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1632-146-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1632-105-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1632-108-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1632-143-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1632-87-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1632-121-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1632-152-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1632-112-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1632-115-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1632-118-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2236-120-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2236-157-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2236-114-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2236-90-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2236-154-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2236-123-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2236-100-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2236-110-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2236-104-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2236-117-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2236-151-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2236-145-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2236-107-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2236-148-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2236-38-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2236-98-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2584-49-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2584-142-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2716-93-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2716-46-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2716-91-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2884-89-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2884-39-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2884-95-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download