latentbot | f09cf7cb375f58f221f25f1f537d512466d38541190e0b52e86bddaf8f3e0745

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c926e15ab45183004d7e77a54dc9525_JaffaCakes118.exe
Size

168KB
MD5

2c926e15ab45183004d7e77a54dc9525
SHA1

9aa66e4479b57a5d00ab78db378720defb84281d
SHA256

f09cf7cb375f58f221f25f1f537d512466d38541190e0b52e86bddaf8f3e0745
SHA512

b6f13f52d22b69fbca254b39a624b0e9ebb227a35f49c90451622862d4e916e3d81342a45461763b8b79a90d1ed83ae95cbc3aba9835748416aa688858ba0a04
SSDEEP

3072:CQFvHWYPM6jKn/+QC8iL/aLTll9ZP8Lcg+LUoFjnwt5jeZUHmHb:CyPM6jU/+TL/aLTl7ZP+cgFoFjn+QqHw

Score

10^/10

latentbot discovery persistence trojan upx

Malware Config

Extracted

Family

latentbot

butterfly43452.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000d000000023b88-37.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
4944	1.exe
2560	zZpJ5YG.pif

Loads dropped DLL 4 IoCs

pid	Process
3028	2c926e15ab45183004d7e77a54dc9525_JaffaCakes118.exe
2560	zZpJ5YG.pif
2108	regsvr32.exe
2560	zZpJ5YG.pif

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JZNoWxtQQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\zZpJ5YG.pif\""	1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sAWk48 = "\"C:\\Users\\Admin\\AppData\\Roaming\\zZpJ5YG.pif\""	1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JZNoWxtQQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\zZpJ5YG.pif\""	zZpJ5YG.pif
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ajL0OiI99 = "\"C:\\Users\\Admin\\AppData\\Roaming\\zZpJ5YG.pif\""	zZpJ5YG.pif

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\win.com	1.exe
File opened for modification	C:\Windows\SysWOW64\zlib.dll	zZpJ5YG.pif
File opened for modification	C:\Windows\SysWOW64\mswinsck.ocx	zZpJ5YG.pif

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3028-0-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/files/0x000b000000023b82-15.dat	upx
behavioral2/memory/4944-17-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/3028-21-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/4944-31-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2560-39-0x0000000010000000-0x0000000010014000-memory.dmp	upx
behavioral2/files/0x000d000000023b88-37.dat	upx
behavioral2/memory/2560-119-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2560-120-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2560-122-0x0000000010000000-0x0000000010014000-memory.dmp	upx
behavioral2/memory/2560-139-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2560-155-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2560-157-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2560-168-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2560-178-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2560-198-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2560-205-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2560-207-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2560-209-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2560-211-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2560-213-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2560-217-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2560-221-0x0000000000400000-0x0000000000458000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2780	3028	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c926e15ab45183004d7e77a54dc9525_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zZpJ5YG.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4944	1.exe
4944	1.exe
4944	1.exe
4944	1.exe
4944	1.exe
4944	1.exe
4944	1.exe
4944	1.exe
4944	1.exe
4944	1.exe
3384	msedge.exe
3384	msedge.exe
1952	msedge.exe
1952	msedge.exe
3100	identity_helper.exe
3100	identity_helper.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3028	2c926e15ab45183004d7e77a54dc9525_JaffaCakes118.exe
4944	1.exe
2560	zZpJ5YG.pif
2560	zZpJ5YG.pif

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 5096	3028	2c926e15ab45183004d7e77a54dc9525_JaffaCakes118.exe	84
PID 3028 wrote to memory of 5096	3028	2c926e15ab45183004d7e77a54dc9525_JaffaCakes118.exe	84
PID 3028 wrote to memory of 4944	3028	2c926e15ab45183004d7e77a54dc9525_JaffaCakes118.exe	90
PID 3028 wrote to memory of 4944	3028	2c926e15ab45183004d7e77a54dc9525_JaffaCakes118.exe	90
PID 3028 wrote to memory of 4944	3028	2c926e15ab45183004d7e77a54dc9525_JaffaCakes118.exe	90
PID 4944 wrote to memory of 1952	4944	1.exe	92
PID 4944 wrote to memory of 1952	4944	1.exe	92
PID 1952 wrote to memory of 2156	1952	msedge.exe	93
PID 1952 wrote to memory of 2156	1952	msedge.exe	93
PID 4944 wrote to memory of 2560	4944	1.exe	94
PID 4944 wrote to memory of 2560	4944	1.exe	94
PID 4944 wrote to memory of 2560	4944	1.exe	94
PID 2560 wrote to memory of 2108	2560	zZpJ5YG.pif	95
PID 2560 wrote to memory of 2108	2560	zZpJ5YG.pif	95
PID 2560 wrote to memory of 2108	2560	zZpJ5YG.pif	95
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 1956	1952	msedge.exe	96
PID 1952 wrote to memory of 3384	1952	msedge.exe	97
PID 1952 wrote to memory of 3384	1952	msedge.exe	97
PID 1952 wrote to memory of 636	1952	msedge.exe	98
PID 1952 wrote to memory of 636	1952	msedge.exe	98
PID 1952 wrote to memory of 636	1952	msedge.exe	98
PID 1952 wrote to memory of 636	1952	msedge.exe	98
PID 1952 wrote to memory of 636	1952	msedge.exe	98
PID 1952 wrote to memory of 636	1952	msedge.exe	98
PID 1952 wrote to memory of 636	1952	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\2c926e15ab45183004d7e77a54dc9525_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c926e15ab45183004d7e77a54dc9525_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\2c926e15ab45183004d7e77a54dc9525_JaffaCakes118.exe"
  2⤵
  PID:5096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 520
  2⤵
  - Program crash
  PID:2780
- C:\Users\Admin\AppData\Roaming\1.exe
  C:\Users\Admin\AppData\Roaming\1.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.google.de/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe63f446f8,0x7ffe63f44708,0x7ffe63f44718
      4⤵
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11939504756849936526,3165418926020881650,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
      4⤵
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,11939504756849936526,3165418926020881650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,11939504756849936526,3165418926020881650,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
      4⤵
      PID:636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11939504756849936526,3165418926020881650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11939504756849936526,3165418926020881650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
      4⤵
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11939504756849936526,3165418926020881650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,11939504756849936526,3165418926020881650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,11939504756849936526,3165418926020881650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11939504756849936526,3165418926020881650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
      4⤵
      PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11939504756849936526,3165418926020881650,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11939504756849936526,3165418926020881650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:1028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11939504756849936526,3165418926020881650,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
      4⤵
      PID:60
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11939504756849936526,3165418926020881650,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5400 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5088
- - C:\Users\Admin\AppData\Roaming\zZpJ5YG.pif
    C:\Users\Admin\AppData\Roaming\zZpJ5YG.pif
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\system32\mswinsck.ocx"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3028 -ip 3028
1⤵
PID:3884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
0e59cb3e825bdbece5eddf7492b85683

SHA1
3e4423de29812db8e1ee574d6d56f4fc1858c519

SHA256
9c3692273e9e1530d71777e0f69136ead17728969ded9f73ac1c2573e3f0513f

SHA512
beb40521401fd3a1fbbc1e5d765a720a20411ed70da9c5ee7035b593fea4d8945e745bed7d1dae824780e196c4154814a8c174c5a8e481963773bcf1109102f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a57253a9ab1895d8906a1ab1a06d0e50

SHA1
50f13dfbeba60790134de7d11b9601275439ed8b

SHA256
18e8196fdb08fe5f526df1bb900ef1ef962673e748571a4932ef8912ab5e8006

SHA512
ed26a6410d6119718eb64333520595c72977c4015f4c34ce5a8c20a3da636999248fd8745feabfa128a3cd3de32324fd92499a7a306ddcc87e7ed3b88bdbbd60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97838e5d3db48847e8f96489371883cf

SHA1
08a95f937081545187a470f62d4e23cd8e562548

SHA256
e95cbe5734e690e33d2ccec4179c8793d690d4a770956b41cf1936b66d126326

SHA512
c1d63054efefb618d8d3cd401b7aaff37d0cc376fb4f997e10447d9b223dae9dd1eea4539233ad6be278a3448dfff565bc4a4c55bc7cfda0cdff0f51897b8b36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0194dcdfdc18585e008089cca0ac494d

SHA1
efbb30c965c1cf6fbdad0410d78062e3f3d36180

SHA256
44e3342652c5c7539b0af85705186224c11b1153d3806bda26bc8e9bbd9eeec6

SHA512
e61ebad376f5a64f11b459ffc9f785d066de06b30f9d84b2f60d54cd8f8806b162d688c51989e924ee59ef9a857d4627785646cf760cabe68a2a7f5e25a6bdd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8042a5ddc5d9cb97a7dee76cb76ae457

SHA1
1b107585d5261e70d58be222a09f271dbe7f0540

SHA256
4af10e408c73d3cf8d8d5a694308fa224911960c49afe96eac5997b1c1b90e4e

SHA512
70f400e981b07da2a1cd48ffd99934fbd5ca7b2e23c458387a5b74a574b421912c5576b97cda0c45dbf543128f038cbfdf83fa3bcb0b78c5c0244c997b44574a

Download Submit
C:\Users\Admin\AppData\Roaming\1.exe

Filesize
150KB

MD5
564211c8776acb25d576cbec38ffa8a8

SHA1
d508c77bf7e439ff442244552e1d6a3267c3c7fb

SHA256
87d3a3562b355146f3dd1c5c76272fa156853b80f4df4564d25c1e6959562e24

SHA512
0bcb1738ab8f759e2fd4b5b12b57a42e5ea0ae7f628a79f668758721870fbb3c07ddd57506a9267d106a0322609787728408d01b5121123e4f9d0473a6ff310f

Download Submit
C:\Users\Admin\AppData\Roaming\kernel33.dll

Filesize
625KB

MD5
358611b92e360a749054fdc7b6b076ea

SHA1
d6d2224161fee024ab3767a81ed57f7e57d0c1ce

SHA256
79782a87dfd093a0e4196d6f0aa4d46a55c0290f6145f5f8fa60e53c540f89b4

SHA512
0986c84ed52b42b3aeb96479032e188165d1fa1d5c7018e240b444e03eb6317365ea51fc0233263f7e97f099cd3ca3094ab0b177c0405816bc800b41f42523ad

Download Submit
C:\Windows\SysWOW64\mswinsck.ocx

Filesize
105KB

MD5
9484c04258830aa3c2f2a70eb041414c

SHA1
b242a4fb0e9dcf14cb51dc36027baff9a79cb823

SHA256
bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

SHA512
9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

Download Submit
C:\Windows\SysWOW64\zlib.dll

Filesize
27KB

MD5
200d52d81e9b4b05fa58ce5fbe511dba

SHA1
c0d809ee93816d87388ed4e7fd6fca93d70294d2

SHA256
d4fe89dc2e7775f4ef0dfc70ed6999b8f09635326e05e08a274d464d1814c617

SHA512
7b1df70d76855d65cf246051e7b9f7119720a695d41ace1eb00e45e93e6de80d083b953269166bdee7137dbd9f3e5681e36bb036f151cea383c10d82957f39c5

Download Submit
memory/2560-122-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2560-207-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2560-119-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2560-120-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2560-221-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2560-39-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2560-217-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2560-139-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2560-213-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2560-155-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2560-157-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2560-168-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2560-178-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2560-198-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2560-211-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2560-205-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2560-40-0x00000000029A0000-0x00000000029C7000-memory.dmp

Filesize
156KB

Download
memory/2560-209-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3028-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3028-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4944-17-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4944-31-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download