318c0595f19d2c2fcf40f9cdb7328eb31528296c1db6f08457efa0e4bdbd16a1

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
Size

414KB
MD5

d408ab2f240c659b1d2b9917d98345e9
SHA1

db39b16507c275af9a411f1350de9b77d558c262
SHA256

318c0595f19d2c2fcf40f9cdb7328eb31528296c1db6f08457efa0e4bdbd16a1
SHA512

3ee9f9595f369c53b15ef8be156c8d17adebfc285b436f4fa22c04b9aa99dd1f3712bcdebcbdbf22e12afd3a22fe8b396abb5b020f5dfb40a61fe49bc96a771a
SSDEEP

6144:aeNyES77DUhRMJj2/7JDJfo3/Sy5mRAZlwfSYppQ7omW0bI1fPKL1mDmt:aeNyEKLj2TJDJfE/lAGOppQ7lFofPhmt

Score

9^/10

discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Renames multiple (176) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Deletes itself 1 IoCs

pid	Process
2416	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
1724	Logo1_.exe
2904	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
2736	QvodSetupPlus3.exe

Loads dropped DLL 7 IoCs

pid	Process
2416	cmd.exe
2416	cmd.exe
2904	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
2904	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
2904	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
2308	MsiExec.exe
2308	MsiExec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2736-42-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/files/0x0007000000016d71-40.dat	upx
behavioral1/memory/2736-44-0x0000000000240000-0x0000000000297000-memory.dmp	upx
behavioral1/memory/2736-56-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2736-71-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2736-72-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2736-74-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2736-683-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2736-684-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2736-696-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2736-697-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2736-699-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2736-702-0x0000000000400000-0x0000000000457000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	Logo1_.exe
File created	C:\Program Files\Java\jre7\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe.Exe	Logo1_.exe
File created	C:\Program Files\7-Zip\7z.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\pack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe	Logo1_.exe
File created	C:\Program Files\Java\jre7\bin\klist.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre7\bin\policytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\klist.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmiregistry.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\WinMail.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	Logo1_.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f76ebb6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC71.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIECDF.tmp	msiexec.exe
File created	C:\Windows\uninstall\rundl132.exe	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe
File opened for modification	C:\Windows\Installer\f76ebb6.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QvodSetupPlus3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x0009000000016d31-24.dat	nsis_installer_2

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe
1724	Logo1_.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2784	msiexec.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2660	msiexec.exe
Token: SeTakeOwnershipPrivilege	2660	msiexec.exe
Token: SeSecurityPrivilege	2660	msiexec.exe
Token: SeCreateTokenPrivilege	2784	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2784	msiexec.exe
Token: SeLockMemoryPrivilege	2784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2784	msiexec.exe
Token: SeMachineAccountPrivilege	2784	msiexec.exe
Token: SeTcbPrivilege	2784	msiexec.exe
Token: SeSecurityPrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeLoadDriverPrivilege	2784	msiexec.exe
Token: SeSystemProfilePrivilege	2784	msiexec.exe
Token: SeSystemtimePrivilege	2784	msiexec.exe
Token: SeProfSingleProcessPrivilege	2784	msiexec.exe
Token: SeIncBasePriorityPrivilege	2784	msiexec.exe
Token: SeCreatePagefilePrivilege	2784	msiexec.exe
Token: SeCreatePermanentPrivilege	2784	msiexec.exe
Token: SeBackupPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeShutdownPrivilege	2784	msiexec.exe
Token: SeDebugPrivilege	2784	msiexec.exe
Token: SeAuditPrivilege	2784	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2784	msiexec.exe
Token: SeChangeNotifyPrivilege	2784	msiexec.exe
Token: SeRemoteShutdownPrivilege	2784	msiexec.exe
Token: SeUndockPrivilege	2784	msiexec.exe
Token: SeSyncAgentPrivilege	2784	msiexec.exe
Token: SeEnableDelegationPrivilege	2784	msiexec.exe
Token: SeManageVolumePrivilege	2784	msiexec.exe
Token: SeImpersonatePrivilege	2784	msiexec.exe
Token: SeCreateGlobalPrivilege	2784	msiexec.exe
Token: SeBackupPrivilege	2752	vssvc.exe
Token: SeRestorePrivilege	2752	vssvc.exe
Token: SeAuditPrivilege	2752	vssvc.exe
Token: SeBackupPrivilege	2660	msiexec.exe
Token: SeRestorePrivilege	2660	msiexec.exe
Token: SeRestorePrivilege	2996	DrvInst.exe
Token: SeRestorePrivilege	2996	DrvInst.exe
Token: SeRestorePrivilege	2996	DrvInst.exe
Token: SeRestorePrivilege	2996	DrvInst.exe
Token: SeRestorePrivilege	2996	DrvInst.exe
Token: SeRestorePrivilege	2996	DrvInst.exe
Token: SeRestorePrivilege	2996	DrvInst.exe
Token: SeLoadDriverPrivilege	2996	DrvInst.exe
Token: SeLoadDriverPrivilege	2996	DrvInst.exe
Token: SeLoadDriverPrivilege	2996	DrvInst.exe
Token: SeRestorePrivilege	2660	msiexec.exe
Token: SeTakeOwnershipPrivilege	2660	msiexec.exe
Token: SeRestorePrivilege	2660	msiexec.exe
Token: SeTakeOwnershipPrivilege	2660	msiexec.exe
Token: SeRestorePrivilege	2660	msiexec.exe
Token: SeTakeOwnershipPrivilege	2660	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2784	msiexec.exe
2736	QvodSetupPlus3.exe
2736	QvodSetupPlus3.exe
2736	QvodSetupPlus3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2736	QvodSetupPlus3.exe
2736	QvodSetupPlus3.exe
2736	QvodSetupPlus3.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2568	2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	30
PID 2136 wrote to memory of 2568	2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	30
PID 2136 wrote to memory of 2568	2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	30
PID 2136 wrote to memory of 2568	2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2596	2568	net.exe	32
PID 2568 wrote to memory of 2596	2568	net.exe	32
PID 2568 wrote to memory of 2596	2568	net.exe	32
PID 2568 wrote to memory of 2596	2568	net.exe	32
PID 2136 wrote to memory of 2416	2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	33
PID 2136 wrote to memory of 2416	2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	33
PID 2136 wrote to memory of 2416	2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	33
PID 2136 wrote to memory of 2416	2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	33
PID 2136 wrote to memory of 1724	2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	35
PID 2136 wrote to memory of 1724	2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	35
PID 2136 wrote to memory of 1724	2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	35
PID 2136 wrote to memory of 1724	2136	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	35
PID 2416 wrote to memory of 2904	2416	cmd.exe	36
PID 2416 wrote to memory of 2904	2416	cmd.exe	36
PID 2416 wrote to memory of 2904	2416	cmd.exe	36
PID 2416 wrote to memory of 2904	2416	cmd.exe	36
PID 2416 wrote to memory of 2904	2416	cmd.exe	36
PID 2416 wrote to memory of 2904	2416	cmd.exe	36
PID 2416 wrote to memory of 2904	2416	cmd.exe	36
PID 1724 wrote to memory of 2216	1724	Logo1_.exe	37
PID 1724 wrote to memory of 2216	1724	Logo1_.exe	37
PID 1724 wrote to memory of 2216	1724	Logo1_.exe	37
PID 1724 wrote to memory of 2216	1724	Logo1_.exe	37
PID 2216 wrote to memory of 2780	2216	net.exe	39
PID 2216 wrote to memory of 2780	2216	net.exe	39
PID 2216 wrote to memory of 2780	2216	net.exe	39
PID 2216 wrote to memory of 2780	2216	net.exe	39
PID 2904 wrote to memory of 2784	2904	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	40
PID 2904 wrote to memory of 2784	2904	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	40
PID 2904 wrote to memory of 2784	2904	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	40
PID 2904 wrote to memory of 2784	2904	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	40
PID 2904 wrote to memory of 2784	2904	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	40
PID 2904 wrote to memory of 2784	2904	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	40
PID 2904 wrote to memory of 2784	2904	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	40
PID 2904 wrote to memory of 2736	2904	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	41
PID 2904 wrote to memory of 2736	2904	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	41
PID 2904 wrote to memory of 2736	2904	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	41
PID 2904 wrote to memory of 2736	2904	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	41
PID 2904 wrote to memory of 2736	2904	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	41
PID 2904 wrote to memory of 2736	2904	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	41
PID 2904 wrote to memory of 2736	2904	d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe	41
PID 1724 wrote to memory of 2372	1724	Logo1_.exe	45
PID 1724 wrote to memory of 2372	1724	Logo1_.exe	45
PID 1724 wrote to memory of 2372	1724	Logo1_.exe	45
PID 1724 wrote to memory of 2372	1724	Logo1_.exe	45
PID 2372 wrote to memory of 2128	2372	net.exe	47
PID 2372 wrote to memory of 2128	2372	net.exe	47
PID 2372 wrote to memory of 2128	2372	net.exe	47
PID 2372 wrote to memory of 2128	2372	net.exe	47
PID 1724 wrote to memory of 1288	1724	Logo1_.exe	21
PID 1724 wrote to memory of 1288	1724	Logo1_.exe	21
PID 2660 wrote to memory of 2308	2660	msiexec.exe	50
PID 2660 wrote to memory of 2308	2660	msiexec.exe	50
PID 2660 wrote to memory of 2308	2660	msiexec.exe	50
PID 2660 wrote to memory of 2308	2660	msiexec.exe	50
PID 2660 wrote to memory of 2308	2660	msiexec.exe	50
PID 2660 wrote to memory of 2308	2660	msiexec.exe	50
PID 2660 wrote to memory of 2308	2660	msiexec.exe	50

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1288
- C:\Users\Admin\AppData\Local\Temp\d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe"
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2596
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$aC67A.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\setup.msi"
        5⤵
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:2784
    - - C:\QvodSetupPlus3.exe
        
        "C:\QvodSetupPlus3.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2736
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2216
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2780
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2372
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2128

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C7C0B2333CA1C1A415E696F5D9E1C4E4
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2308

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000002A8" "00000000000005AC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\QvodSetupPlus3.exe

Filesize
149KB

MD5
ae856c5755a11fdd5f22f6803a2fb3ca

SHA1
67428e0b59abe9025c13faca71c3f221a0c101ad

SHA256
714da13a4d3f6b66c48bd1054a594f54f7a452d07e637d90be868991985e5771

SHA512
79e2f8d03b64f47e22fee1c766b43dabf10e7ee8e4debbd91efc1308f0f5cfffd12abd61776f86e9a9330229d1a9d18b3927c62e9fb0603bb85c46d30329da94

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aC67A.bat

Filesize
614B

MD5
a1662ddb40044e9e88b1ba3dcd4d63b9

SHA1
6f021d0b7a25ba2936c655d56343ca4d49981570

SHA256
16c2025b9469733d6fba7296e306dc38f4c12de811aafb2696fc14217850b602

SHA512
3133f858e31cbc0616e6d4d8f3c6a3c16b6cc0cbe2d53e82d2e3f2eb16a4982e8afe0f9572bc0a8b3ef50cf03829a153e2e0eeeb7335770395e1fc788d97b9ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\d408ab2f240c659b1d2b9917d98345e9_JaffaCakes118.exe.exe

Filesize
352KB

MD5
29294ee1401c61b3690d3edad19f9312

SHA1
d8de1eb8889fa3fd0bdc77af0ff2721cc678aff8

SHA256
92f3538af6aa89dd61a7dc69a786111e0ebc37f651abf144f9312561c8ad3b05

SHA512
5e4b1a7471d3b34b116365e9c2fc374379a0072df3f9318b6cad96f2fc19ccda63b5418d2ce657eabcc960a49f0b9c44e801d5122fdabd44f55c4ac42d3994d7

Download Submit
C:\Windows\Installer\MSIEC71.tmp

Filesize
48KB

MD5
9067aad412defc0d2888479609041392

SHA1
36cfffc3bafeb24f88ad5886ca5787ca008b6ba9

SHA256
99f4e00b6908057a2fe5067ff6c8b6e32b5c07558ab79139dc4b998f1da4b517

SHA512
e69f259d78b02e6c1a5d9c45898b59372329a5288fff655dd741353f112b2b8eed18b01caa2bf312a91f5e314e1c0b036321b37c8efbebdcf3650ba6b12dee6a

Download Submit
C:\Windows\Logo1_.exe

Filesize
62KB

MD5
9210d7ba9fc214c04004fd8eee351604

SHA1
364b7974f7a0a3aba64aac0fc14a28e8fd9138b5

SHA256
d93e0cd4cded534c5f40ca98cba496528ccc6c4981e6f2b92784f408fe436701

SHA512
5bd25bed793b9c68f8e937160f5fbb7c52886e1676e3ed1fdc8026520e1b10098951e4ec72d70aa8ffa69b87d8328cb517a0e2ac4ce3849dfdb5249a707d6540

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
832B

MD5
7e3a0edd0c6cd8316f4b6c159d5167a1

SHA1
753428b4736ffb2c9e3eb50f89255b212768c55a

SHA256
1965854dfa54c72529c88c7d9f41fa31b4140cad04cf03d3f0f2e7601fcbdc6c

SHA512
9c68f7f72dfa109fcfba6472a1cced85bc6c2a5481232c6d1d039c88b2f65fb86070aeb26ac23e420c6255daca02ea6e698892f7670298d2c4f741b9e9415c7f

Download Submit
C:\setup.msi

Filesize
293KB

MD5
d1eab229dacabc6f0525bf355c03da28

SHA1
ce5a01c87dac27de72db9d44458466efd17c1bf4

SHA256
cf1bf1d59753496c8f620e0d47249baa9a6ba49d6b887f5c6940eae8a79288a6

SHA512
013da24222f3fee9c9bb23dbf167c17621a80f4544680d9d09a645473b935ff17ebec6726fe3a83fed880ad0313afa6b9c33d983f7bca53509aee885405d0a97

Download Submit
memory/1288-51-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download
memory/1724-54-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1724-22-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download
memory/1724-21-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2136-18-0x0000000000230000-0x000000000026F000-memory.dmp

Filesize
252KB

Download
memory/2136-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2136-19-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2136-17-0x0000000000230000-0x000000000026F000-memory.dmp

Filesize
252KB

Download
memory/2136-1-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download
memory/2736-44-0x0000000000240000-0x0000000000297000-memory.dmp

Filesize
348KB

Download
memory/2736-696-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2736-47-0x0000000003610000-0x0000000003814000-memory.dmp

Filesize
2.0MB

Download
memory/2736-45-0x0000000000240000-0x0000000000297000-memory.dmp

Filesize
348KB

Download
memory/2736-42-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2736-702-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2736-56-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2736-699-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2736-71-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2736-72-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2736-74-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2736-683-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2736-684-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2736-46-0x0000000003610000-0x0000000003814000-memory.dmp

Filesize
2.0MB

Download
memory/2736-697-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2904-39-0x0000000001F70000-0x0000000001FC7000-memory.dmp

Filesize
348KB

Download
memory/2904-55-0x0000000001F70000-0x0000000001FC7000-memory.dmp

Filesize
348KB

Download