ee994d3fa5f9f1181463552baebe0625ea385d677fc7649971959e628b2e8d88

Analysis

max time kernel
4s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
Size

15KB
MD5

ea7cc83a0236e197be8d3ad0854408e5
SHA1

7ae698f0850ddc071e3167c05d221245152940b1
SHA256

ee994d3fa5f9f1181463552baebe0625ea385d677fc7649971959e628b2e8d88
SHA512

a5cad2fba7afa4aed846089d0373df3d0cf2fdc6a5b8334e727a3fbc6ffc5e2b4dd9d4bee2a9f5a2c7ca6940666510e4cba7330c0bf5fdb1c6f51d172e635659
SSDEEP

384:Ie766GhJWeI8ZeIra/0s2v9dpHKjV0ESWzRvpnBRhApnBRhr:i/0eItua/0s2ztuV0ErRvRhAvRhr

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3144	isdsasrv.exe
3244	isdsasrv.exe
5720	isdsasrv.exe
5804	isdsasrv.exe

Loads dropped DLL 8 IoCs

pid	Process
2600	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
2600	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
3144	isdsasrv.exe
3144	isdsasrv.exe
3244	isdsasrv.exe
3244	isdsasrv.exe
5720	isdsasrv.exe
5720	isdsasrv.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87FD640A-158F-48AC-FD14-1597F14A9778}	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{87FD640A-158F-48AC-FD14-1597F14A9778}\ = "mndshsrv.dll"	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87FD640A-158F-48AC-FD14-1597F14A9778}	isdsasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{87FD640A-158F-48AC-FD14-1597F14A9778}\ = "mndshsrv.dll"	isdsasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87FD640A-158F-48AC-FD14-1597F14A9778}	isdsasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{87FD640A-158F-48AC-FD14-1597F14A9778}\ = "mndshsrv.dll"	isdsasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87FD640A-158F-48AC-FD14-1597F14A9778}	isdsasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{87FD640A-158F-48AC-FD14-1597F14A9778}\ = "mndshsrv.dll"	isdsasrv.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mndshsrv.dll	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\isdsasrv.exe	isdsasrv.exe
File opened for modification	C:\Windows\SysWOW64\mndshsrv.dll	isdsasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\smdsbsrv.sys	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\isdsasrv.exe	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\isdsasrv.exe	isdsasrv.exe
File opened for modification	C:\Windows\SysWOW64\smdsbsrv.sys	isdsasrv.exe
File opened for modification	C:\Windows\SysWOW64\isdsasrv.exe	isdsasrv.exe
File opened for modification	C:\Windows\SysWOW64\smdsbsrv.sys	isdsasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	isdsasrv.exe
File created	C:\Windows\SysWOW64\mndshsrv.dll	isdsasrv.exe
File created	C:\Windows\SysWOW64\isdsasrv.exe	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mndshsrv.dll	isdsasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	isdsasrv.exe
File created	C:\Windows\SysWOW64\mndshsrv.dll	isdsasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	isdsasrv.exe
File opened for modification	C:\Windows\SysWOW64\smdsbsrv.sys	isdsasrv.exe
File opened for modification	C:\Windows\SysWOW64\mndshsrv.dll	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	isdsasrv.exe
File opened for modification	C:\Windows\SysWOW64\mndshsrv.dll	isdsasrv.exe
File opened for modification	C:\Windows\SysWOW64\mndshsrv.dll	isdsasrv.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	isdsasrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	isdsasrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	isdsasrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	isdsasrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87FD640A-158F-48AC-FD14-1597F14A9778}\InprocServer32\ = "C:\\Windows\\SysWow64\\mndshsrv.dll"	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87FD640A-158F-48AC-FD14-1597F14A9778}\InprocServer32	isdsasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87FD640A-158F-48AC-FD14-1597F14A9778}\InprocServer32	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87FD640A-158F-48AC-FD14-1597F14A9778}\InprocServer32\ThreadingModel = "Apartment"	isdsasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87FD640A-158F-48AC-FD14-1597F14A9778}\InprocServer32\ = "C:\\Windows\\SysWow64\\mndshsrv.dll"	isdsasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87FD640A-158F-48AC-FD14-1597F14A9778}\InprocServer32	isdsasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87FD640A-158F-48AC-FD14-1597F14A9778}\InprocServer32\ThreadingModel = "Apartment"	isdsasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87FD640A-158F-48AC-FD14-1597F14A9778}	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87FD640A-158F-48AC-FD14-1597F14A9778}\InprocServer32	isdsasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87FD640A-158F-48AC-FD14-1597F14A9778}\InprocServer32\ = "C:\\Windows\\SysWow64\\mndshsrv.dll"	isdsasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87FD640A-158F-48AC-FD14-1597F14A9778}\InprocServer32\ThreadingModel = "Apartment"	isdsasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87FD640A-158F-48AC-FD14-1597F14A9778}\InprocServer32\ThreadingModel = "Apartment"	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87FD640A-158F-48AC-FD14-1597F14A9778}\InprocServer32\ = "C:\\Windows\\SysWow64\\mndshsrv.dll"	isdsasrv.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2600	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
3144	isdsasrv.exe
3244	isdsasrv.exe
3244	isdsasrv.exe
3244	isdsasrv.exe
3244	isdsasrv.exe
3244	isdsasrv.exe
3244	isdsasrv.exe
3244	isdsasrv.exe
5720	isdsasrv.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
Token: SeDebugPrivilege	3144	isdsasrv.exe
Token: SeDebugPrivilege	3244	isdsasrv.exe
Token: SeDebugPrivilege	5720	isdsasrv.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2016	2600	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe	30
PID 2600 wrote to memory of 2016	2600	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe	30
PID 2600 wrote to memory of 2016	2600	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe	30
PID 2600 wrote to memory of 2016	2600	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe	30
PID 2600 wrote to memory of 3144	2600	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe	32
PID 2600 wrote to memory of 3144	2600	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe	32
PID 2600 wrote to memory of 3144	2600	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe	32
PID 2600 wrote to memory of 3144	2600	ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe	32
PID 3144 wrote to memory of 3216	3144	isdsasrv.exe	33
PID 3144 wrote to memory of 3216	3144	isdsasrv.exe	33
PID 3144 wrote to memory of 3216	3144	isdsasrv.exe	33
PID 3144 wrote to memory of 3216	3144	isdsasrv.exe	33
PID 3144 wrote to memory of 3244	3144	isdsasrv.exe	35
PID 3144 wrote to memory of 3244	3144	isdsasrv.exe	35
PID 3144 wrote to memory of 3244	3144	isdsasrv.exe	35
PID 3144 wrote to memory of 3244	3144	isdsasrv.exe	35
PID 3244 wrote to memory of 3340	3244	isdsasrv.exe	36
PID 3244 wrote to memory of 3340	3244	isdsasrv.exe	36
PID 3244 wrote to memory of 3340	3244	isdsasrv.exe	36
PID 3244 wrote to memory of 3340	3244	isdsasrv.exe	36
PID 3244 wrote to memory of 5720	3244	isdsasrv.exe	38
PID 3244 wrote to memory of 5720	3244	isdsasrv.exe	38
PID 3244 wrote to memory of 5720	3244	isdsasrv.exe	38
PID 3244 wrote to memory of 5720	3244	isdsasrv.exe	38
PID 5720 wrote to memory of 5780	5720	isdsasrv.exe	39
PID 5720 wrote to memory of 5780	5720	isdsasrv.exe	39
PID 5720 wrote to memory of 5780	5720	isdsasrv.exe	39
PID 5720 wrote to memory of 5780	5720	isdsasrv.exe	39
PID 5720 wrote to memory of 5804	5720	isdsasrv.exe	41
PID 5720 wrote to memory of 5804	5720	isdsasrv.exe	41
PID 5720 wrote to memory of 5804	5720	isdsasrv.exe	41
PID 5720 wrote to memory of 5804	5720	isdsasrv.exe	41
PID 5804 wrote to memory of 5852	5804	isdsasrv.exe	42
PID 5804 wrote to memory of 5852	5804	isdsasrv.exe	42
PID 5804 wrote to memory of 5852	5804	isdsasrv.exe	42
PID 5804 wrote to memory of 5852	5804	isdsasrv.exe	42

C:\Users\Admin\AppData\Local\Temp\ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea7cc83a0236e197be8d3ad0854408e5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259434108.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2016
- C:\Windows\SysWOW64\isdsasrv.exe
  C:\Windows\system32\isdsasrv.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259434373.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3216
- - C:\Windows\SysWOW64\isdsasrv.exe
    C:\Windows\system32\isdsasrv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259434420.bat
      4⤵
      System Location Discovery: System Language Discovery
      PID:3340
  - - C:\Windows\SysWOW64\isdsasrv.exe
      C:\Windows\system32\isdsasrv.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5720
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259434607.bat
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
    - - C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5804
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259434670.bat
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5852
      - C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        6⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259460800.bat
        7⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        7⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259461299.bat
        8⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        8⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259461564.bat
        9⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        9⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259463312.bat
        10⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        10⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259464154.bat
        11⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        11⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259465371.bat
        12⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        12⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259505042.bat
        13⤵
        
        PID:304
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        13⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259505151.bat
        14⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        14⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259505260.bat
        15⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        15⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259505697.bat
        16⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        16⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259506321.bat
        17⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        17⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259508458.bat
        18⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        18⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259508973.bat
        19⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        19⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259509410.bat
        20⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        20⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259510986.bat
        21⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        21⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259512234.bat
        22⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        22⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259512998.bat
        23⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        23⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259513638.bat
        24⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        24⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259514308.bat
        25⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        25⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259517023.bat
        26⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        26⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259518271.bat
        27⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        27⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259519503.bat
        28⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        28⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259524105.bat
        29⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        29⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259526118.bat
        30⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        30⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259527069.bat
        31⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        31⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259527537.bat
        32⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        32⤵
        
        PID:776
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259528333.bat
        33⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        33⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259529222.bat
        34⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        34⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259529799.bat
        35⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        35⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259530532.bat
        36⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        36⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259531032.bat
        37⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        37⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259532264.bat
        38⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        38⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259533091.bat
        39⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        39⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259535228.bat
        40⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        40⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259535602.bat
        41⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\isdsasrv.exe
        
        C:\Windows\system32\isdsasrv.exe
        41⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259556912.bat
        18⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259554354.bat
        17⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259546850.bat
        16⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259538286.bat
        15⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259535712.bat
        14⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259535665.bat
        13⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259535602.bat
        12⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259496446.bat
        11⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259494605.bat
        10⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259493966.bat
        9⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259494340.bat
        8⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259491797.bat
        7⤵
        
        PID:3984
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259491173.bat
        6⤵
        
        PID:3716
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259470956.bat
        5⤵
        
        PID:6096
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259466588.bat
      4⤵
      PID:4004
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259470956.bat
    3⤵
    PID:5988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259465355.bat
  2⤵
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~DFD259434108.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD259465355.bat

Filesize
225B

MD5
7ed01ef9e4d45b0ff2644a2fd2a547ef

SHA1
ef194f1176589efd9bbd8c29c2f064a15bfa71ed

SHA256
8bd56e1817969b13b6cf0bc264a8aafb92091571501ed690ec2aa2115c773ac5

SHA512
689a23c821836d8941cebb3c5e37df828def9e97aaa9338bd3745f2de3c71c9ee0cca79498dd913758850f4f0b58966377410715258ddde21249ce4cf3cc1473

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD259466588.bat

Filesize
121B

MD5
5701d035687e6ca240819f7f9d25f6db

SHA1
677a510e47b8bbe1cb686063e1ca8dc06b24ba45

SHA256
8c4e45e855c1050bc6efae76f15aff8415c0a9ba71fc88e81eb1be13c30afe04

SHA512
a8eb8532e596e4e7875f99914dec95e6927be36e6547091217215769a6c8687da68ff9d162eeb14e78439896bfc5a6addc5f610d62127881a53e52298742341d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD259470956.bat

Filesize
242B

MD5
467758a5dca44874084a050452a90bf1

SHA1
c6dcab82ca2cdd1791ba0064a18c6213af3a20bb

SHA256
d7d8d3f1cd4021f822e38f242df43049bde9359b1da4652db246ae3afed4971c

SHA512
8e38c2c8ffc6caf5861e3504564a20305303575b1e11f0589733194ca67e78a00c0396e37df5718dc90b5435eb097c4ac0708c3c93dc3f6c864d6a885fb0dda8

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD259535602.bat

Filesize
242B

MD5
fc7dfbcfd26239466da97ba9d41b392f

SHA1
87642665620f0c4088ba74cf367b35efc2eb5e9a

SHA256
477abd88528b367091518bd232dd10fddbde707fc9b91ed33e8317455013e8ee

SHA512
d1ff6af4bac33cf13008eb1b5eb459c3cb46230ce6a7c15ae5ee7f361a2bb7f7bad74987c34b073a3d834bd36ad817932711cd1679ea69d200a151f0932ad0cc

Download Submit
C:\Windows\SysWOW64\mndshsrv.dll

Filesize
521KB

MD5
0850ed1f6c442f6afab11224b4672e29

SHA1
2cdcf3bf0b156afd8ff9d1a8315c5071ed6764bf

SHA256
1c67e34b126dda52bfd0270fd72ffb0c6b4806f9ecf632a53440b83681ae1195

SHA512
32630fed66118ff438b0c1ef62f03186252898ded4d51807df0823becd7397524a7265328d5d41dad7947dbc8bbbce6b09aa82e5790710a318357ca4f7d08935

Download Submit
C:\Windows\SysWOW64\mndshsrv.dll

Filesize
521KB

MD5
f7ac3ef0b3175c131f0a92fc9b168606

SHA1
a5d610a021b50bda9a73b75eaeb71162a4bed9eb

SHA256
91a383cdc4e1943fe7e65d7ad3a9092314b32288f3d08f2a137c64d2b0d36ef2

SHA512
9eaf1497d32a5920f7317bca2f71e2811374b7791958b1dee22e801f3e370393ac36647b1504a2ac51e2660db7e8fb0b908938c9118ffc2658ecd4c46128ebfa

Download Submit
C:\Windows\SysWOW64\smdsbsrv.sys

Filesize
520B

MD5
1b11094c2d70a8a8c346806ea3b763e5

SHA1
04b90eb56639ab42cd5cd453c96693fac9226260

SHA256
9e7cdd42bbe7aeca9f4164d0650780e4fc6cb2476b9e6631bc39ec52ee0ad3b4

SHA512
ee290e1df7a0a0a9554fcd5a21e96ddc1aa27f59b7359ab6074e204abb17725ee8db1fe6246ff80a9f818f18e4cdfdb25a003bde83e4dad36188860ef4367d3f

Download Submit
\Windows\SysWOW64\isdsasrv.exe

Filesize
15KB

MD5
ea7cc83a0236e197be8d3ad0854408e5

SHA1
7ae698f0850ddc071e3167c05d221245152940b1

SHA256
ee994d3fa5f9f1181463552baebe0625ea385d677fc7649971959e628b2e8d88

SHA512
a5cad2fba7afa4aed846089d0373df3d0cf2fdc6a5b8334e727a3fbc6ffc5e2b4dd9d4bee2a9f5a2c7ca6940666510e4cba7330c0bf5fdb1c6f51d172e635659

Download Submit
memory/776-25660-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/776-25659-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/1856-10392-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/1856-10393-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/1856-7335-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/1936-9373-0x0000000000420000-0x0000000000439000-memory.dmp

Filesize
100KB

Download
memory/1936-12429-0x0000000000420000-0x0000000000439000-memory.dmp

Filesize
100KB

Download
memory/1936-9372-0x0000000000420000-0x0000000000439000-memory.dmp

Filesize
100KB

Download
memory/1936-12430-0x0000000000420000-0x0000000000439000-memory.dmp

Filesize
100KB

Download
memory/2412-6310-0x0000000000270000-0x0000000000289000-memory.dmp

Filesize
100KB

Download
memory/2412-6299-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2412-9370-0x0000000000270000-0x0000000000289000-memory.dmp

Filesize
100KB

Download
memory/2412-9371-0x0000000000270000-0x0000000000289000-memory.dmp

Filesize
100KB

Download
memory/2412-6311-0x0000000000270000-0x0000000000289000-memory.dmp

Filesize
100KB

Download
memory/2600-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2600-1031-0x00000000003E0000-0x00000000003F9000-memory.dmp

Filesize
100KB

Download
memory/2600-2777-0x00000000003E0000-0x00000000003F9000-memory.dmp

Filesize
100KB

Download
memory/2600-2771-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2600-2772-0x00000000003E0000-0x00000000003F9000-memory.dmp

Filesize
100KB

Download
memory/2712-9374-0x0000000000420000-0x0000000000439000-memory.dmp

Filesize
100KB

Download
memory/2712-6319-0x0000000000420000-0x0000000000439000-memory.dmp

Filesize
100KB

Download
memory/2756-21592-0x00000000002F0000-0x0000000000309000-memory.dmp

Filesize
100KB

Download
memory/2756-19557-0x00000000002F0000-0x0000000000309000-memory.dmp

Filesize
100KB

Download
memory/2756-19558-0x00000000002F0000-0x0000000000309000-memory.dmp

Filesize
100KB

Download
memory/2756-21591-0x00000000002F0000-0x0000000000309000-memory.dmp

Filesize
100KB

Download
memory/2844-21593-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/2844-25661-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/2968-13448-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download
memory/2968-16623-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download
memory/2968-16624-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download
memory/2968-13449-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download
memory/3144-2778-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download
memory/3144-1033-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3144-1048-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download
memory/3244-1049-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3244-2069-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download
memory/3244-2068-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download
memory/3244-2781-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download
memory/3244-2780-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download
memory/3272-23626-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/3272-23627-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/4236-11410-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/4236-11409-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/4236-8353-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/4236-8352-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/4236-7336-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4244-6298-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/4244-8354-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/4588-18541-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/4588-16503-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/4588-18540-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/4588-16502-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/4616-10391-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/4616-10390-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/4616-13447-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/4616-13307-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/4636-17522-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/4636-17521-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/4636-14467-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/4636-14466-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/4636-13450-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4732-15485-0x0000000000270000-0x0000000000289000-memory.dmp

Filesize
100KB

Download
memory/4732-12428-0x0000000000270000-0x0000000000289000-memory.dmp

Filesize
100KB

Download
memory/4732-15484-0x0000000000270000-0x0000000000289000-memory.dmp

Filesize
100KB

Download
memory/4732-12427-0x0000000000270000-0x0000000000289000-memory.dmp

Filesize
100KB

Download
memory/5372-5544-0x00000000002F0000-0x0000000000309000-memory.dmp

Filesize
100KB

Download
memory/5372-5574-0x00000000002F0000-0x0000000000309000-memory.dmp

Filesize
100KB

Download
memory/5372-5543-0x00000000002F0000-0x0000000000309000-memory.dmp

Filesize
100KB

Download
memory/5372-5575-0x00000000002F0000-0x0000000000309000-memory.dmp

Filesize
100KB

Download
memory/5436-5570-0x00000000003E0000-0x00000000003F9000-memory.dmp

Filesize
100KB

Download
memory/5436-5173-0x00000000003E0000-0x00000000003F9000-memory.dmp

Filesize
100KB

Download
memory/5504-5572-0x00000000002F0000-0x0000000000309000-memory.dmp

Filesize
100KB

Download
memory/5504-5573-0x00000000002F0000-0x0000000000309000-memory.dmp

Filesize
100KB

Download
memory/5504-5542-0x00000000002F0000-0x0000000000309000-memory.dmp

Filesize
100KB

Download
memory/5504-5541-0x00000000002F0000-0x0000000000309000-memory.dmp

Filesize
100KB

Download
memory/5564-5557-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download
memory/5564-5556-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download
memory/5564-3125-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download
memory/5564-3124-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download
memory/5648-4154-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/5720-2070-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5720-2770-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/5720-2782-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/5720-2783-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/5724-20299-0x0000000000270000-0x0000000000289000-memory.dmp

Filesize
100KB

Download
memory/5804-5545-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/5804-3112-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/6168-15486-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/6168-18538-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/6196-14468-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/6196-11411-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/6344-24643-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/6808-22609-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/6808-22610-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/6828-20575-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/6828-18539-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download