cybergate | e4de1fc0ad64e962e9745874be7c5b897788c93ce4f57ff6436784f9fb81a58b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aabac9c2092fac518f9208a52e30408c_JaffaCakes118.exe
Size 1.1MB
Sample240819-m14b9stcpl
SHA256 e4de1fc0ad64e962e9745874be7c5b897788c93ce4f57ff6436784f9fb81a58b
MD5 aabac9c2092fac518f9208a52e30408c
SHA1 6385151868274bf69912980374386c1913e1505a
SHA512 913f6f9cef36c51b30fcc32d216e56154143a6c07b19db9764c275e081a000fc0ec90f4ec5a29f6826131e169cbef7fdb31153e34e1468373fff3c3b747aa55e
SSDEEP 24576:L2gEU1vNHM2pIvCYJGeKejfAR8IZF3mwyT5avC:/M2p76GPezeOoC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cybergate vítima discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.7 Beta 02

Botnet

vítima

bokbokbokbk.no-ip.org:300

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
123
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Appe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	Appe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Appe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	Appe.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{P0NI4058-PRIC-35CL-283X-O32W8YAWKE38}	Appe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{P0NI4058-PRIC-35CL-283X-O32W8YAWKE38}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	Appe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{P0NI4058-PRIC-35CL-283X-O32W8YAWKE38}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{P0NI4058-PRIC-35CL-283X-O32W8YAWKE38}\StubPath = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	Appe.exe

Executes dropped EXE 5 IoCs

pid	Process
4784	Appe.exe
2744	Appe.exe
5304	Appe.exe
4092	server.exe
4656	server.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2744-9-0x0000000000400000-0x00000000004B0000-memory.dmp	upx
behavioral2/memory/2744-12-0x0000000000400000-0x00000000004B0000-memory.dmp	upx
behavioral2/memory/2744-14-0x0000000000400000-0x00000000004B0000-memory.dmp	upx
behavioral2/memory/2744-13-0x0000000000400000-0x00000000004B0000-memory.dmp	upx
behavioral2/memory/2744-42-0x0000000000400000-0x00000000004B0000-memory.dmp	upx
behavioral2/memory/2744-1376-0x0000000000400000-0x00000000004B0000-memory.dmp	upx
behavioral2/memory/4656-1922-0x0000000000400000-0x00000000004B0000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	Appe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	Appe.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\install\server.exe	Appe.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	Appe.exe
File opened for modification	C:\Windows\SysWOW64\install\	Appe.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	server.exe
File opened for modification	C:\Windows\SysWOW64\Appe.exe	aabac9c2092fac518f9208a52e30408c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Appe.exe	Appe.exe
File created	C:\Windows\SysWOW64\install\server.exe	Appe.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4784 set thread context of 2744	4784	Appe.exe	86
PID 4092 set thread context of 4656	4092	server.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3548	4656	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Appe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aabac9c2092fac518f9208a52e30408c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Appe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Appe.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Appe.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2744	Appe.exe
2744	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe
5304	Appe.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5304	Appe.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5304	Appe.exe
Token: SeDebugPrivilege	5304	Appe.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2744	Appe.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3808	aabac9c2092fac518f9208a52e30408c_JaffaCakes118.exe
4784	Appe.exe
4092	server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 4784	3808	aabac9c2092fac518f9208a52e30408c_JaffaCakes118.exe	84
PID 3808 wrote to memory of 4784	3808	aabac9c2092fac518f9208a52e30408c_JaffaCakes118.exe	84
PID 3808 wrote to memory of 4784	3808	aabac9c2092fac518f9208a52e30408c_JaffaCakes118.exe	84
PID 4784 wrote to memory of 2744	4784	Appe.exe	86
PID 4784 wrote to memory of 2744	4784	Appe.exe	86
PID 4784 wrote to memory of 2744	4784	Appe.exe	86
PID 4784 wrote to memory of 2744	4784	Appe.exe	86
PID 4784 wrote to memory of 2744	4784	Appe.exe	86
PID 4784 wrote to memory of 2744	4784	Appe.exe	86
PID 4784 wrote to memory of 2744	4784	Appe.exe	86
PID 4784 wrote to memory of 2744	4784	Appe.exe	86
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55
PID 2744 wrote to memory of 3392	2744	Appe.exe	55

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:800
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1020

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:780
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:3100
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3796
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3896
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3956
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:4056
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:428
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:2244
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:1732
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:2416
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3620
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:2552
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4416
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4880
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:5172
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:1452
- C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
  C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
  2⤵
  PID:2132
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:504
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:6056
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:5412
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:5988
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:6396
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4972
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:3216
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:1600
- C:\Windows\system32\BackgroundTaskHost.exe
  "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
  2⤵
  PID:3748
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:1416

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:508

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1132
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1460
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:1668

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2784

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2872

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3392
- C:\Users\Admin\AppData\Local\Temp\aabac9c2092fac518f9208a52e30408c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\aabac9c2092fac518f9208a52e30408c_JaffaCakes118.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\SysWOW64\Appe.exe
    C:\Windows\system32\Appe.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Windows\SysWOW64\Appe.exe
      C:\Windows\SysWOW64\Appe.exe
      4⤵
      Adds policy Run key to start application
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2744
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        System Location Discovery: System Language Discovery
        
        PID:4144
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:5268
    - - C:\Windows\SysWOW64\Appe.exe
        
        "C:\Windows\SysWOW64\Appe.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:5304
      - C:\Windows\SysWOW64\install\server.exe
        
        "C:\Windows\system32\install\server.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4092
        
        C:\Windows\SysWOW64\install\server.exe
        
        C:\Windows\SysWOW64\install\server.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 560
        8⤵
        Program crash
        
        PID:3548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2864

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4380

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe dde21e8d20f2ee22875cf6d5c8d954ee ppMUIc1cKU23ZEXx9/0oLw.0.1.0.0.0
1⤵
PID:3992
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:3192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:2104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4656 -ip 4656
  2⤵
  PID:316

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:5472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XX--XX--XX.txt

Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Size 602KB
SHA256 06a2f5f8d4ecd13c60177dcea18f1c821a77508105de6762bc0772740d3598ab
MD5 bc2becb23826d72a7e76716eef4f31c3
SHA1 48396bd5387c057d129e5db2de0b31ce3e7513f6
SHA512 29684de0e168d9421ae8776e6b23d454fe288f55c9acc21993d65ebb9fe6509d69248b09a3e2b78d4f34fdbf8efd4d97c3e5b8e96f1e9e658118c6cdd0961636
SSDEEP 12288:If2GFNT0X8rQvhsEhLLQMoAMHVB66EYAUTS9D/ksSzARI:I2GF+XfvFVLQrBzTaDMsAARI
MD5 SHA1 SHA512 SSDEEP

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 6fd46cf1b46a5d04ffee480ab1eafaabc0ca6813a730dfbb9368206505656e49
MD5 6c505a18e1bffc7efe1274f0e6d51e84
SHA1 939dfdff7356fef9c244fb0c88cffbcc1a352e61
SHA512 5f893eb1f40050199408a6731387f06100ba8166fc265bbb15c55d7187a7c9a0335bcd613c7bc9b090f6b69bfbafe3419d8a0ccffa9af0da11d32b1574889378
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 53625c3d8a3b7fb492d19688fa11c4cd30c02e17eb30ddc782a250c6c8088600
MD5 a7179c0564b93a6b32f7185b3b1c037d
SHA1 bea3920efcad8bc292a554c75e03918d194dc0fb
SHA512 e5b7d456ef61a457ba0eb940c228c32f8b55f49d3ec688c92986c9047813297d88f8e5285e62e2eeccf6d7ae815b0e1e38007bd03b8a90001f82ecf224fbdbb3
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 69133dd19cc5921b82c7b8f74f16e65f4877b7cfcbe3e87bc90685d27faa5cbe
MD5 98cb8a77527d82841d4b485278dffcd2
SHA1 088cde87e094721c03592682400091bc7c491739
SHA512 301aa6715ebf2f61dbb41f471fa5fdc9bedf84d0c91f96ef7dc085711bb032c3b92f8e11b80024649af688530e886dc431a46a16936c72ce56f77585cec24770
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 fe1a062950b82d80fdab4ce8847c1d199cbb1aad9842a8eebc4a47d569c8d662
MD5 d788988265f0f13dd331fea2c529ab13
SHA1 eea5c9560ca1bc29b7157991de129015d31cd541
SHA512 db1be2058051efd7f357e9cdaa351e744084862b669c0b57ee22e1621b9a34891e00d352c23fae242c88bd7c7d993b89660960e1312064b14a08de2ef67afc01
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 3e2178d21dcb6a1a90296b0369fc5baa3096ea4b543a9d4bfbe17e16c5bb2606
MD5 c03df24760e3fabd9e1aa48988c8fdbd
SHA1 e37302c6e0f3dee26b76aa61cf9b71c63041e702
SHA512 3281d5b0e2f6650725dd3159ad0354343e6bfb222f73870ed86f201005b6417077d7ef2148616029a6ed8841914462043ca364c52712956b5da36bd44ba5b38b
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 f437aded1052908ffb08d1e93a98427b91c330e9313f7e52e2a72dec4b04cb82
MD5 6e6735136138bceec2f3ee7d16af9a57
SHA1 1f924c838f788fe9788c7218c036aadfa0fc16f4
SHA512 f24839c0fe25efddc5488d3c100f14800d5ea63946b8e0aa8fb84b251d3c82b54dc1812aef521683a40f8ab8d5cc0327e40e385c15a5b2ae77a0d9c1ad1ef43c
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 7956acd25ef901c50554f47c65fbbddfc7a6b6836f7a1a138aef1a593089dea9
MD5 8d2448f3983a5e845a527fbfee1d8183
SHA1 d00d84dc894b103bc574121c4d30c0a93a1ab48b
SHA512 225f9225aa5ffe49966a29a76c06dfaa85bb998adc2930b5af379001c380fd7d98fd4ba6b059380ead41baf2e26338c74dd5c5a166b3dff5bb6089748a638ee7
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 2c8d8339502f70eed942aef51f37c2c3fa10bc2239f8c763e99bc0c370eb0883
MD5 6e458969da40d42d4e51ab190f6de7e3
SHA1 120d333f07d881ecba40120bcac373d041698566
SHA512 ef9b02ee8c3ce77537e58ef96fd456e9e702b0e3ae56c64937f5c28a6657fc039038a6d3f996c70392a881b5663c6ef533f6d28919aa5931d5cfbc99ae28ed70
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 1fef0880b22c00a02c869c25113884c55e2c22e5d33c65d44abacba7e118c72c
MD5 10613439a100b3b4f96a46f439f5e069
SHA1 7032404d3e9e0f2201494fbab2e0d7657cb8912a
SHA512 6c76479282ae942c403f3b9c34f03ad19c5006d02eead1c44a7a501e9154343202bd4ab415ae5fa61fed38e77ce7385ff5e6fcfb9bef994da46655c49c4158b9
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 82923e3d5f7eab01a970cc2a3f6ba53f5bf65fb1a2ce8670d3f4e06dacddba36
MD5 a178f68a05a5810f659e8ed1471b8508
SHA1 40ba948bf9f7665fd5baeb5f2a993ae412247f4b
SHA512 5affe441d6805f68368c72df8b6b89d7f0b63902a4b6f6efaa2f97ee34a18224cc0276ae0cf7c0d5759cfe4ff643c14fd9ec73abebf962ca503db4394af7499f
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 d233cc45f414df7023d8da5f35fe036938fe6f6e85acb4805aecff95dfe9899d
MD5 4c4f7358101587ed8906ebfdf7d76357
SHA1 574ab48f1adec445761d99f4ffe6fa7f8cec4030
SHA512 99518a29a53ea820b24c3f2fd52bbeb6a8911be92e5fdfc4a86c5018a71fb864bb90de73bdacb3ac1c2d57e04ae553ddb231feaf1e9f9951c8a745f7d987280c
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 1448ac13ad786ebdece1e2258c4caa038c25a5e8db49e955fed58c0b022dc1b5
MD5 9b14edfebdf92cd6064b7569b7512ff8
SHA1 153662bb8e8607aa7fd7701382e7363485325871
SHA512 e68cdb21a7283e242f2eb342f56776fad946355408b1b5f4a9330cee859eba03b9dc48b15bfb895c243104141c676ec864b55613a642de28433614cb0a3b5b4c
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 076d9ccfca73845e10a0a238cffb607b0b5de99f56b37d08d678a3831c8e1d28
MD5 fbb6fae1df1d3855a29ea997ca79f3c2
SHA1 d774b34bc52d9c59d6e2895966dde1119125f14b
SHA512 778cdeeb318d786f1ad803043deab5915152640855dda6b517f03ccfeb924695c74af4428e13b54d13594fefe909a6e9f674f50978b556e82e089002f894ee4f
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 8f511f4cd171c083309ded625b5c39508b37a0718b8a472aec0d225446dc0bb8
MD5 ded5f41f1f5befcdce394885aa43c56f
SHA1 b26e9bde71b2a09d9757888d25e543d0305cb57a
SHA512 ec43fcd8de765abe3f082a11820ff7727396e04015ff7a4e8c6b442964ad311513e6db0e87130a63c1a54ad09e46b7738a259a01cc731ca4c167c36dca570f30
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 ec7e44eb659639aec777ab332e20a145032c43be517f4b0b7ddf0d7ab02b0df7
MD5 2fd1dadf910cb4a2164fde593b0a9f70
SHA1 5e222c0e540d2604ab14e1c0f180911bcff799c1
SHA512 ff7c9c208268ab5470576ef4905ad596f5b9ac9e57c427628f76f8315794f56aebef55f9f1ee048c3aa51f417352d794a707856acf0b70e3739032b759a3b6fe
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 8e5fff61dea759d3f1d391e257676e971ef0603fb959f4cf8fd516065ca3f21b
MD5 b277117c82aff34aa3f3aa707bfca861
SHA1 cdb5cb9763f35ab86aefb48c27f68ccfb5fd9b13
SHA512 e331cb248c4dfd429b0d362363e1147cec4203d411558d8b917e30c6977d2fa35525f2b7c73461be85b628607178691e27b8d7975db0918cd2dac1e4ccd57264
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 a4af1adbcf689448983719a609209a319c780404076de51d7f23ecc2a4e16bdb
MD5 d35967da4ee97156e7bfa3349564d655
SHA1 55b7ec911861b8c8fac7a7e30ab9476545d065de
SHA512 0c904bdfd2131bc33fcc0fba47d92c767e560e72b0b3d285ba2b09f23b46287ef6daf1c08d1edddd3731ce8664cd2e61e4a97ada66e75841441adbf0d882be1d
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 08338347115ce5ae97d291a6103f8486d349ae1c8a0b9ddff6fb7a51ac5e30e1
MD5 5ba5cd7007c13592c56d4b01e1389fc6
SHA1 1624a57d3abaf43a2213908d0a4f65e0b297f75c
SHA512 4aafd9aac37628841e452b0c39e6a70fb301390dfaca35f972f8c49c0f58d6825187083be22e593379158b780d9c5ad7de2130a7583d6475aa4c4a6a01ef441a
MD5 SHA1 SHA512

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\logs.dat
Size 15B
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314
MD5 SHA1 SHA512

Submit Download

Appe.exe

Path C:\Windows\SysWOW64\Appe.exe
Size 844KB
SHA256 48e81fe4ac43e6ebd1755d461e8533ab476d7ea8e9dd3a174cc1b34fe0249050
MD5 afa0030a42de37ede08254bc97f9329a
SHA1 20a5c8c1b104b37c30cbdceb7f6ad46bbba8ed38
SHA512 5847306486d9efc72a2d880d5fb2691b758acd1f5e3fa4140b263a11e35fe87db1545b63eccf77aa7631642deffe0fbfa92ae49cb3e83967565e0b893596561e
SSDEEP 12288:sM2sdII0jqCFGUu9GD0hKI+CjfARNNDSRIZF3mGmv4yTWhmNarjCug:sM2pIvCYJGeKejfAR8IZF3mwyT5avCT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2744-1376-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/2744-42-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/2744-24-0x0000000010470000-0x00000000104CC000-memory.dmp

Download

memory/2744-18-0x0000000010410000-0x000000001046C000-memory.dmp

Download

memory/2744-13-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/2744-14-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/2744-9-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/2744-12-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/4144-694-0x0000000010470000-0x00000000104CC000-memory.dmp

Download

memory/4144-2055-0x0000000010470000-0x00000000104CC000-memory.dmp

Download

memory/4144-26-0x0000000000640000-0x0000000000641000-memory.dmp

Download

memory/4144-25-0x0000000000380000-0x0000000000381000-memory.dmp

Download

memory/4656-1922-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/5304-1377-0x0000000010530000-0x000000001058C000-memory.dmp

Download

memory/5304-2056-0x0000000010530000-0x000000001058C000-memory.dmp

Download