cybergate | 6f669947ca45a6020ca7405d33f20f4fbff77c6c772147481b81f298edc6a5f1

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 18:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Size 1.1MB
Sample240909-wq1castglc
SHA256 6f669947ca45a6020ca7405d33f20f4fbff77c6c772147481b81f298edc6a5f1
MD5 d6d825f2f2c75876fde0a34908862e02
SHA1 5099063852d11c5db95e9ef46c756cdce33b180f
SHA512 5f512c9f2f88fee3e4d7030f6df295d76e7982fd38e617c8cb132bd01a48b8daccdd719c30e074a7ee3cad3314412d88db8010f4aa282156d48e37d3c0f179d2
SSDEEP 24576:WNr+giHWlMUKfb3QUi1Cqn21DEEZ6yh0E07WnZ12Y7d+:Wh+gi4Mr8UXsQQEJCs98
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cybergate darkcomet guest16 bootkit discovery persistence rat stealer trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

yesyoa.no-ip.biz:1337

Mutex

DC_MUTEX-LUX4R7L

Attributes

gencode
WcMbkP7iz216
install
false
offline_keylogger
true
persistence
false

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	STEAMGAMEUNLOCKERV.5.2.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Server.exe"	STEAMGAMEUNLOCKERV.5.2.EXE
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	STEAMGAMEUNLOCKERV.5.2.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Server.exe"	STEAMGAMEUNLOCKERV.5.2.EXE

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{P74FPJ5E-TAP1-21J6-6EN2-A58TN2X6BAGT}	STEAMGAMEUNLOCKERV.5.2.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{P74FPJ5E-TAP1-21J6-6EN2-A58TN2X6BAGT}\StubPath = "C:\\Windows\\system32\\WinDir\\Server.exe Restart"	STEAMGAMEUNLOCKERV.5.2.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{P74FPJ5E-TAP1-21J6-6EN2-A58TN2X6BAGT}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{P74FPJ5E-TAP1-21J6-6EN2-A58TN2X6BAGT}\StubPath = "C:\\Windows\\system32\\WinDir\\Server.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{P74FPJ5E-TAP1-21J6-6EN2-A58TN2X6BAGT}	STEAMGAMEUNLOCKERV.5.2.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{P74FPJ5E-TAP1-21J6-6EN2-A58TN2X6BAGT}\StubPath = "C:\\Windows\\system32\\WinDir\\Server.exe Restart"	STEAMGAMEUNLOCKERV.5.2.EXE

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	STEAMGAMEUNLOCKERV.5.2.EXE

Executes dropped EXE 4 IoCs

pid	Process
5844	STEAMGAMEUNLOCKERV.5.2.EXE
5988	STEAMGAMEUNLOCKERV.5.2.EXE
6648	STEAMGAMEUNLOCKERV.5.2.EXE
7864	Server.exe

Loads dropped DLL 1 IoCs

pid	Process
6616	STEAMGAMEUNLOCKERV.5.2.EXE

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5844-2957-0x0000000010410000-0x0000000010471000-memory.dmp	upx
behavioral2/memory/5844-2959-0x0000000010480000-0x00000000104E1000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe"	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\Server.exe"	STEAMGAMEUNLOCKERV.5.2.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\Server.exe"	STEAMGAMEUNLOCKERV.5.2.EXE

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WinDir\Server.exe	STEAMGAMEUNLOCKERV.5.2.EXE
File opened for modification	C:\Windows\SysWOW64\WinDir\Server.exe	STEAMGAMEUNLOCKERV.5.2.EXE
File created	C:\Windows\SysWOW64\WinDir\Server.exe	STEAMGAMEUNLOCKERV.5.2.EXE
File opened for modification	C:\Windows\SysWOW64\WinDir\Server.exe	STEAMGAMEUNLOCKERV.5.2.EXE
File opened for modification	C:\Windows\SysWOW64\WinDir\	STEAMGAMEUNLOCKERV.5.2.EXE
File created	C:\Windows\SysWOW64\WinDir\Server.exe	STEAMGAMEUNLOCKERV.5.2.EXE

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2644 set thread context of 8724	2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	91
PID 8724 set thread context of 5328	8724	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
7996	6616	WerFault.exe	101
8068	7864	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	STEAMGAMEUNLOCKERV.5.2.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	STEAMGAMEUNLOCKERV.5.2.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	STEAMGAMEUNLOCKERV.5.2.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	STEAMGAMEUNLOCKERV.5.2.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	STEAMGAMEUNLOCKERV.5.2.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6648	STEAMGAMEUNLOCKERV.5.2.EXE

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeSecurityPrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeSystemtimePrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeBackupPrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeRestorePrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeShutdownPrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeDebugPrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeUndockPrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeManageVolumePrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeImpersonatePrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: 33	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: 34	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: 35	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: 36	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
Token: SeDebugPrivilege	6648	STEAMGAMEUNLOCKERV.5.2.EXE
Token: SeDebugPrivilege	6648	STEAMGAMEUNLOCKERV.5.2.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5844	STEAMGAMEUNLOCKERV.5.2.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
8724	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 8724	2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	91
PID 2644 wrote to memory of 8724	2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	91
PID 2644 wrote to memory of 8724	2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	91
PID 2644 wrote to memory of 8724	2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	91
PID 2644 wrote to memory of 8724	2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	91
PID 2644 wrote to memory of 8724	2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	91
PID 2644 wrote to memory of 8724	2644	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	91
PID 8724 wrote to memory of 5328	8724	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	92
PID 8724 wrote to memory of 5328	8724	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	92
PID 8724 wrote to memory of 5328	8724	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	92
PID 8724 wrote to memory of 5328	8724	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	92
PID 8724 wrote to memory of 5328	8724	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	92
PID 8724 wrote to memory of 5328	8724	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	92
PID 8724 wrote to memory of 5328	8724	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	92
PID 8724 wrote to memory of 5328	8724	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	92
PID 8724 wrote to memory of 5328	8724	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	92
PID 8724 wrote to memory of 5328	8724	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	92
PID 8724 wrote to memory of 5328	8724	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	92
PID 8724 wrote to memory of 5328	8724	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	92
PID 8724 wrote to memory of 5328	8724	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	92
PID 8724 wrote to memory of 5328	8724	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	92
PID 5328 wrote to memory of 5844	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	93
PID 5328 wrote to memory of 5844	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	93
PID 5328 wrote to memory of 5844	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	93
PID 5328 wrote to memory of 5988	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	94
PID 5328 wrote to memory of 5988	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	94
PID 5328 wrote to memory of 5988	5328	d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe	94
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56
PID 5844 wrote to memory of 3444	5844	STEAMGAMEUNLOCKERV.5.2.EXE	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3444
- C:\Users\Admin\AppData\Local\Temp\d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Users\Admin\AppData\Local\Temp\d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
    3⤵
    - Adds Run key to start application
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:8724
  - - C:\Users\Admin\AppData\Local\Temp\d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d6d825f2f2c75876fde0a34908862e02_JaffaCakes118.exe
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\STEAMGAMEUNLOCKERV.5.2.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\STEAMGAMEUNLOCKERV.5.2.EXE"
        5⤵
        Adds policy Run key to start application
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5844
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        System Location Discovery: System Language Discovery
        
        PID:6036
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\STEAMGAMEUNLOCKERV.5.2.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\STEAMGAMEUNLOCKERV.5.2.EXE"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:6648
        
        C:\Windows\SysWOW64\WinDir\Server.exe
        
        "C:\Windows\system32\WinDir\Server.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:7864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7864 -s 564
        8⤵
        Program crash
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\STEAMGAMEUNLOCKERV.5.2.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\STEAMGAMEUNLOCKERV.5.2.EXE"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5988
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\STEAMGAMEUNLOCKERV.5.2.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\STEAMGAMEUNLOCKERV.5.2.EXE"
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:6616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6616 -s 984
        7⤵
        Program crash
        
        PID:7996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6616 -ip 6616
1⤵
PID:7828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7864 -ip 7864
1⤵
PID:7960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

STEAMGAMEUNLOCKERV.5.2.EXE

Path C:\Users\Admin\AppData\Local\Temp\STEAMGAMEUNLOCKERV.5.2.EXE
Size 276KB
SHA256 80f31e0f725eeeb10e42a457f6cc7222c5dccd5757dac302f6d9b6214a866071
MD5 0ea57b120a2e7b95c92b631dc5fca5fd
SHA1 ea907d061a89d4c81b03274b97a3fbfda9ea5f87
SHA512 974c8a68810e519bea878083978a16b04a7eac2dca004e7be6bdbfba2690550d9896c92781371053b22f0922335f61747a6ded06581794154d577f11eded66fa
SSDEEP 6144:/4ABF94fpAuO/50BTnqPd0Mpz7qhh4nXjjf8MZ9BKXKQ:wUxGLE0kuGnESBQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

XX--XX--XX.txt

Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Size 222KB
SHA256 dda69d2292bf59c4b950b6c0a472b960055d691593867801e47d666481fe8b10
MD5 970a2585d68403a0003aff12fb47349f
SHA1 26e49caf9191887867a3fc59a94af564b171f7d2
SHA512 5230b2cbe7ed7a5db51cf9cf3862d2a126797fbeb27b4d3234712ad260efe30439104a037e138e5819177fa2bc3cc5ded24054260d08e6ffc49c91c8b3f480a9
SSDEEP 6144:SpAuO/50BTnqPd0Mpz7qhh4nXjjf8MZ9BKXK7:ZGLE0kuGnESB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 b9ff6287481d1d7c3535ce3d7dba04e4f6b927c748aa41f43fd59372b9025af9
MD5 eab84ba1157c2a3cf6606350d785d476
SHA1 5277065c55af83461434fd1a34e9f3b9b16bfee0
SHA512 cd666bda7c156e61cf413e49707d12eded608662c202092f7a9214d68b93295c0aa02bda9c7711dec65cf852da93cfd014ac4e1a184a110da51ecd986bce5b4b
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 3a4344860cd8ec34b12f2f4b4f232ff5ad583ebeeffe494c7693180776fa2a36
MD5 253c1abddd60603fed1a4acab84f7e0e
SHA1 5540794081e1c30c57a055a0e453cbbe3b747b3a
SHA512 71888a11c8540c3d8606a974b567d08003ed380396622c495f6d5ed187641347f71b99f78c5690db71c80ebc1fc3394f7f447dbc6ca26845e31b6442d6cd9958
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 68a2f7490bfb7bf45097c575fc3428a3333f6f0549e41ce2374dc27b6b4598b0
MD5 7433dec15ed18c8a8acae939c20de1e6
SHA1 eba36b91294552a27acb55f905c50e6e0bef884f
SHA512 73704fe2c429cb0e67f16ba3d3ba79dd28ff45da384ab4d14b446df3c51b2f839b59a8f123f160454d47b8dd72de0d18cc3d27f1379c9a6e8228d82b5aa8cd77
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 e37d5c5aa7038d4346462bc55d880a1e68709954b70704e4fc46711033c96dc2
MD5 48fcb8b5e494a28badcf7a360899856a
SHA1 4abdd23c24430951626e9844f3328a120fb31039
SHA512 4295c0f5ffc8e47c2490f488f470b21db51e50bb2531a066baee67cb207c90a4cd6e608184ba9fb18334b49af530218c3a3f49f6c9ff73070b01f988a7424fa6
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 465ee903818a8c7263e0ca7bd85cfc4743debc4c39499c7c6081e17536d8b0f1
MD5 73b11ce997a8aab66000323c2c745867
SHA1 f3db7f5153ad44506c443899ea8390e5bb72bf24
SHA512 c171901f8bb8bb55f90a4c38d52a0163d5c3c7abb86d035db6f88e48fae42a6ee65d63628a790433beaf3f98dc4f2faf7340cd77966e35d75f84ff0b68850988
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 63f3bd1c26e0371e14cc9830e30b4d5b6a541d0c8a787164ad93e2e4acd297a4
MD5 8f822e9dd6e07ca73069d102ea50ebd5
SHA1 e8d029dccfaee4bddcd82f4bd44f2d10c661738f
SHA512 85b2de8f07a216a38a702b4b6bed66502150ad541377fe33f23e4a133175909aa201c166155fe716e312bb1dc70b6717dfcde6e35a2be63cd2013483b4ff1605
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 e11f4fa1483e88dc01f23c28d19a1989af14a46cd3fea9163a2559f7d9886cc4
MD5 eb120310a221c3b1992909652f77f0ef
SHA1 15cadc145a00c64c9d12b0c648b626f7568737e7
SHA512 30b2a526344bf7f756972e2c18e4e620d3a437f69e6c63273890fa518883f5b071dd6949e440166e7550efd878bafb7f1269e816ec841bb9bcfe7fbc1cc2cce8
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 16c75924b7c545db9b3d54b1e62a810f772e6f84b0410229118d357aefba1a17
MD5 0ed4f31420fe55a28eb3c3e65644e6d1
SHA1 5c83e3cc2753034a7d692442a135c2927629d5ae
SHA512 335bc03b8920bada654b96085c0e958d50c1fb496091a648d14d98ad65073b63c5f19b57cf21381d4f68a84d9c32861cbd6aca2ebec59d8aebe74e24cf9fa000
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 5e06841803a028db954130a934a612a5de76ddfd7b7ddb7391de254998c6a11a
MD5 963909ff7c8245155ff62b08164e26c9
SHA1 a9d974560fade8e18e6fed33a5769c90cbc15e33
SHA512 2b61cc41fad5b2ba255e9ab89acdefd9711116128e69654b97a53a85b1e3ca6601f3b7eeb9b042b37850d817659c9b4ca319b4487b1160079db211bce9772e84
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 b5f56aa13969e79fda8baae3b8febbc976441b7c8d424231680037b7b2c572d9
MD5 bb39ca5de48743fa796507c83aaadd51
SHA1 33aaec7c0c5d74bda14ddba5594e30f219bb6318
SHA512 3e60dd27a8aa36866d1b891c6bea325145fec9de2cc87e6196da614ab855b1f874844e20bd4f70a0b1686327949e4a2a139ddc3fccd16d6d685d509af1fbb6c9
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 147167bf6a9797f504c52609c96f4bfd1ae500bd665a8b8b95a7af61b7e37107
MD5 f124bb28dcef43e875ae3b88f1e0c677
SHA1 75abd9a226d25ab5794b35ebcb14851654e0df97
SHA512 c2b8a1ff58aac084de7609e44901c4c5380f711033a6fb4d2ddc2cf3b166b0742be2a20fbe8c3ebaedbe73f15de82cd7b4d1c3c9c3b36362f9ce025436d7c9d8
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 ec566aebf825c491015e3e3fd1f46b51fbf0af71c415d1787c2b6507852157f6
MD5 1e53279d600fa9916331a37ec3130519
SHA1 14115105015605c758dd995c352218b0316f33fc
SHA512 cbfb5ed738e6d3da6ee4425e32da314fbc09d12df027ac99a98efcbc20b31469330d7c4da8b3ecff6bf2c66e13fba1dcf40899993b672926b6565f68eb1260c8
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 9b15ecf24a63afade500f36269a62adf1d611cfec44b1dddaab05245a0466ee2
MD5 2c1a55a21315278bf38f3fe7a47c9859
SHA1 d4fa8847d988d2e0279e7dbfa9448cd39fee68d8
SHA512 195fffd1ff35174e10f93ed2a6d989379735f2d76fd0359c356623d58df6d93b9e26251b9073c0537c7b6c45cc4aa3e9750a366d6a9400059d11484f675294cd
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 a42d897273a0df60be147d88718a4415ff7c62dce26b720a875d0b7d7efff09a
MD5 870807724e598ee9e7b3f8e693fb44fc
SHA1 ac7a4addae6b2842cebfe68b931638afba3612ce
SHA512 8772c891c89c2bfc93d57fb394093d2d06e6542ca9c22c3af7558050fb49f789446ad27075c93763c46ce1d1bd22ec16f44c08f65cfebbe085f5d5d3fa0590a9
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 c909d68fb66466625c056011a856555503a3783097a72d69dbb9722d12751c66
MD5 6d1d34cce17a5b172b298af9a56c8e93
SHA1 60bdf712412e5e262bc4bcb093a4055eb2503de2
SHA512 2f71e410da20e00b839ec766ee850e8f6fb1f31b656a9af11b899231c2f0c9a14521c7e1c6e58a708818d9edf9dd68d0bc3d534660729567a2c2809f0902efc5
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 d19e3fcb44947b255c3733b7ca53e101fe2d70e603ff7cda2c451d44743a5545
MD5 e37d951907a4767f98f4293c52dc7ac8
SHA1 b65840f58a4ceebf4c01e2e8fb0f31713474e6b7
SHA512 a3fb86823f25812c8e2ae4552cede50ad5a1a51510fc3aba63f2c5c6a8ffa5cd70b2cdd2c2da082a59ce835d05d79edb7e91d1afc4572ad1cadad6e7b6b22cf8
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 838b4e99a9652d0fe2fc20dd1473bfcfa080fce806b3431a2651c841d234d961
MD5 88918e6478f1d537ab1de6d3c112928a
SHA1 fa60d1729c2eb4bab3929d148156141265cb6a8e
SHA512 83448d0235efcd8cb0b9b04d16b36bf5f104070ff69fe2939588d000ad5740a7dfb950c9bd8a1c7c5a1f0a35ff8167707bdb6a304d4263d96ca0797889c9a5c1
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 b816a04c3e035930760c361d3798c74644ffbc7c2d1c28d0d5ce763205375b2e
MD5 dc1f5d29a31dbb39f70190af7ecc5951
SHA1 1511c91a0f31d3aa145514a8d9aa2b5d812cb5ee
SHA512 2180bf0349661a524788541ec86937a1bea4a42158ec54dba2f014412ccf813f8250bfaebcf27f6d80367fa80d48acb7dfa37bf24d75b45316af02f33a1656a7
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 6b2988886e320c75d3c3110b9c2725bc6e62e989123870bd324068ef51dd23c0
MD5 b40354f1d3d4a2f90d0024585e713612
SHA1 12254b09cf1a9939108e43417110cfd027eb2e28
SHA512 6cec5f79842ec0b293d6f7617de77693f1dc760f5cd4634ba1f20af8889efe4bf1befb392421e05125fd0a6e51900423e417a6721b744104208f6d0030bcaad8
MD5 SHA1 SHA512

Submit Download

cglogs.dat

Path C:\Users\Admin\AppData\Roaming\cglogs.dat
Size 15B
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314
MD5 SHA1 SHA512

Submit Download

memory/5328-2952-0x0000000000400000-0x00000000004FA000-memory.dmp

Download

memory/5328-2951-0x0000000000400000-0x00000000004FA000-memory.dmp

Download

memory/5328-3185-0x0000000000400000-0x00000000004FA000-memory.dmp

Download

memory/5328-3183-0x0000000000400000-0x00000000004FA000-memory.dmp

Download

memory/5328-2939-0x0000000000400000-0x00000000004FA000-memory.dmp

Download

memory/5328-2938-0x0000000000400000-0x00000000004FA000-memory.dmp

Download

memory/5328-2937-0x0000000000400000-0x00000000004FA000-memory.dmp

Download

memory/5328-2936-0x0000000000400000-0x00000000004FA000-memory.dmp

Download

memory/5328-2935-0x0000000000400000-0x00000000004FA000-memory.dmp

Download

memory/5844-2957-0x0000000010410000-0x0000000010471000-memory.dmp

Download

memory/5844-2959-0x0000000010480000-0x00000000104E1000-memory.dmp

Download

memory/6036-2960-0x00000000003B0000-0x00000000003B1000-memory.dmp

Download

memory/6036-2961-0x0000000000670000-0x0000000000671000-memory.dmp

Download

memory/8724-2607-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/8724-2610-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/8724-2612-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/8724-2611-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/8724-2945-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/8724-2614-0x0000000000400000-0x0000000000453000-memory.dmp

Download