Malware Analysis Report

2025-01-02 02:46

Sample ID 240719-xxgzzawakp
Target 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118
SHA256 b8640645abeba0210c7bb760d5241cec41c188580c8e9274f5a57e982dd9ac47
Tags
xtremerat persistence rat spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b8640645abeba0210c7bb760d5241cec41c188580c8e9274f5a57e982dd9ac47

Threat Level: Known bad

The file 5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

xtremerat persistence rat spyware

XtremeRAT

Detect XtremeRAT payload

Boot or Logon Autostart Execution: Active Setup

Molebox Virtualization software

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-19 19:13

Signatures

Molebox Virtualization software

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-19 19:13

Reported

2024-07-19 19:16

Platform

win7-20240704-en

Max time kernel

148s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe"

Signatures

Detect XtremeRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

XtremeRAT

persistence spyware rat xtremerat

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{86EYSQD3-MO6B-NY00-214Q-3P72B7FTBLB8}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart" C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{86EYSQD3-MO6B-NY00-214Q-3P72B7FTBLB8} C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe" C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe" C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\InstallDir\Server.exe C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\InstallDir\Server.exe C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1692 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1692 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1692 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1692 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1692 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1692 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 1692 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 biladi2000.no-ip.info udp

Files

memory/1692-4-0x0000000076301000-0x0000000076302000-memory.dmp

memory/1692-3-0x0000000077720000-0x0000000077721000-memory.dmp

memory/1692-2-0x0000000000320000-0x000000000036E000-memory.dmp

memory/1692-0-0x0000000000230000-0x0000000000231000-memory.dmp

memory/1692-1-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/1692-8-0x00000000762F0000-0x0000000076400000-memory.dmp

memory/2528-12-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/2528-9-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/2528-13-0x00000000762F0000-0x0000000076400000-memory.dmp

memory/2528-14-0x00000000762F0000-0x0000000076400000-memory.dmp

memory/1692-16-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/1692-17-0x0000000000320000-0x000000000036E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-19 19:13

Reported

2024-07-19 19:16

Platform

win10v2004-20240709-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe"

Signatures

Detect XtremeRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XtremeRAT

persistence spyware rat xtremerat

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{86EYSQD3-MO6B-NY00-214Q-3P72B7FTBLB8} C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86EYSQD3-MO6B-NY00-214Q-3P72B7FTBLB8}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart" C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{86EYSQD3-MO6B-NY00-214Q-3P72B7FTBLB8} C:\Windows\SysWOW64\InstallDir\Server.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86EYSQD3-MO6B-NY00-214Q-3P72B7FTBLB8}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart" C:\Windows\SysWOW64\InstallDir\Server.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{86EYSQD3-MO6B-NY00-214Q-3P72B7FTBLB8} C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86EYSQD3-MO6B-NY00-214Q-3P72B7FTBLB8}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart" C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\InstallDir\Server.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\InstallDir\Server.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe N/A

Molebox Virtualization software

Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe" C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe" C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe" C:\Windows\SysWOW64\InstallDir\Server.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe" C:\Windows\SysWOW64\InstallDir\Server.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe" C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe" C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\InstallDir\Server.exe N/A
File opened for modification C:\Windows\SysWOW64\InstallDir\Server.exe C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe N/A
File opened for modification C:\Windows\SysWOW64\InstallDir\Server.exe C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\InstallDir\Server.exe C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\InstallDir\Server.exe N/A

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4400 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 4400 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 4400 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 4400 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 4400 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 4400 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\InstallDir\Server.exe
PID 4400 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\InstallDir\Server.exe
PID 4400 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe C:\Windows\SysWOW64\InstallDir\Server.exe
PID 3116 wrote to memory of 1476 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\svchost.exe
PID 3116 wrote to memory of 1476 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\svchost.exe
PID 3116 wrote to memory of 1476 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\svchost.exe
PID 3116 wrote to memory of 3628 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 3628 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 3628 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 3628 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 552 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 552 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 552 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 552 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 4656 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 4656 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 4656 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 4656 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 4756 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 4756 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 4756 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 4756 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 1808 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 1808 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 1808 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 1808 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe
PID 3116 wrote to memory of 2160 N/A C:\Windows\SysWOW64\InstallDir\Server.exe C:\Windows\SysWOW64\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\5d4a74baedaf1de6584d15a2c80fa3ee_JaffaCakes118.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\InstallDir\Server.exe

"C:\Windows\system32\InstallDir\Server.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe

"C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 174.117.168.52.in-addr.arpa udp
US 8.8.8.8:53 biladi2000.no-ip.info udp
US 8.8.8.8:53 udp

Files

memory/4400-0-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

memory/4400-6-0x0000000076250000-0x0000000076251000-memory.dmp

memory/4400-7-0x0000000076230000-0x0000000076320000-memory.dmp

memory/4400-5-0x00000000022A0000-0x00000000022B0000-memory.dmp

memory/4400-4-0x0000000077DB2000-0x0000000077DB3000-memory.dmp

memory/4400-3-0x0000000002320000-0x0000000002330000-memory.dmp

memory/4400-2-0x0000000000BF0000-0x0000000000C3E000-memory.dmp

memory/4400-1-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/4400-8-0x0000000076230000-0x0000000076320000-memory.dmp

memory/4400-9-0x0000000076230000-0x0000000076320000-memory.dmp

memory/4400-10-0x0000000076230000-0x0000000076320000-memory.dmp

memory/4400-11-0x0000000076230000-0x0000000076320000-memory.dmp

memory/1568-15-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/4108-17-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/2072-19-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/2560-21-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/4352-23-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/5080-25-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/4336-27-0x0000000000C80000-0x0000000000CA2000-memory.dmp

C:\Windows\SysWOW64\InstallDir\Server.exe

MD5 5d4a74baedaf1de6584d15a2c80fa3ee
SHA1 9ce1c7cd2bff9972009979ca8b2001991bc836bb
SHA256 b8640645abeba0210c7bb760d5241cec41c188580c8e9274f5a57e982dd9ac47
SHA512 2d30930cd749bf2886fee6cf745926d516ec6967d5044d88ea0f2d550277a41ccf61fad711ed25b447820dd2c4d4241213e4d658326e35bab5fabe54d1df0987

memory/4400-39-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/3116-42-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/4400-41-0x0000000000BF0000-0x0000000000C3E000-memory.dmp

memory/4400-40-0x0000000076230000-0x0000000076320000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rDBVX7j.cfg

MD5 ed9f7e62dac66369ada3f7b1462dfbf5
SHA1 9bb5db22fea46add7e825bd169ed19bfeb52cc0f
SHA256 c4acb275967d5c738a1de0addea1472b0e287076157976ed2b7fc9d348ad5c9c
SHA512 2a14ad0a6555e89a55a33952d3f5a6f676be117e4e113537e39daccc687656cb6ed10277ceb52cc3bd11e59dc4f6f329b42ce3de5b4b0ce544f0c7bca70d390a

memory/3628-47-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/552-49-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/4656-51-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/4756-53-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/1808-55-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/2160-57-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/4176-59-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/3116-71-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/4484-72-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/2296-77-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/3744-79-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/3484-81-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/2040-83-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/4380-85-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/3372-87-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/4484-90-0x0000000000C80000-0x0000000000CA2000-memory.dmp