3850a3586deb09cfba2a7a7837c4d9d1af712cc3bf5fd78dfdc411fb788a86eb

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-11-2024 09:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
Size

2.6MB
MD5

a71c301f4f5faf1fb2dd44a7c38dcf7b
SHA1

3fcbee9772ca415dcee61395c92fec7eab962480
SHA256

3850a3586deb09cfba2a7a7837c4d9d1af712cc3bf5fd78dfdc411fb788a86eb
SHA512

d54b1793e8620cae7c75b930848e2dbe441ef8a0410612387beb4f56dcf757900b6a995cf003172ab2e4d43d0003e1920358ab4911b5125b5ac6e530e1927bac
SSDEEP

24576:VVYbWzOnA80yE23Z5EU2elH1QnxBuabsM8KGH7Co0OLeGrIocE5lArjPPz:EWzOkyrZOU2elcu08KGbNLeGMb4unz

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 14 IoCs

Processes:

a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ja-JP\mircmIRC.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\scfilterWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\NDISCAPscfilter.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\mIRCmirc.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\tcpiptcpip.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\mircmIRC.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\NDISCAPscfilter.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\Windowstcpip6.1.7600.16385.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\mIRCmirc.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\wimfltrWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\wimfltrWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\tcpiptcpip.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\Windowstcpip6.1.7600.16385.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\scfilterWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe

Loads dropped DLL 64 IoCs

Processes:

a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe

pid	Process
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mircOffice = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe"	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Officemirc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe"	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 64 IoCs

Processes:

a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wbem\xml\MicrosoftWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\cs-CZ\WindowsManagement.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\it-IT\mircmirc6.34.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\powershelliseWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\image.inf_amd64_neutral_4a983035eaabe2f4\Operatingsonydcam.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\en-US\WindowsOperating.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\powershelliseMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wdmaudio.inf_amd64_neutral_423894ded0ba8fdf\SysFxUISystem6.1.7600.16385.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-International-Core-DL\OperatingWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\ja-JP\mircmIRC.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MUI\0411\MicrosoftRmscorees.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\replacementmanifests\Microsoft-Windows-TerminalServices-LicenseServer\MicrosoftWMIMigrationPlugin.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\fr-FR\DismCoreSystme6.1.7600.16385.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\replacementmanifests\microsoft-windows-shmig\OperatingMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-ADFS-DL\MicrosoftWindows6.1.7600.163857.0907131255.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00v.inf_amd64_neutral_86ff307c66080d00\Amd64\LexPCLUniPlugin.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\disrvcidisrvpp.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\pt-PT\mIRCmirc.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\microsoft-windows-iis-rm\InformationServices.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\crcdisk.inf_amd64_neutral_d10626d1f8b423c3\Windowscrcdisk6.1.7600.163857.0907131255.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\resourcesresources.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\it-IT\Sistemawbemcntl.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\da-DK\Windowsmsimsg6.2.9200.16492.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\fr-FR\mircmIRC.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migration\es-ES\mircmIRC.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\de\resourcesresources.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_neutral_db76873d4261eb11\Broadcomb44amd644.60.0.0.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwifibus.inf_amd64_neutral_9d0740f32ce81d24\OperatingWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-TextServicesFramework-Migration-DL\Windowsimkrmig.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\WindowsSearchEngine\WindowsWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-shmig-DL\Operatingshmig6.1.7601.1751471.1011191850.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-NetworkBridge\WindowsWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-International-Core-DL\OperatingWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msdsm.inf_amd64_neutral_be2b348981b2ef17\msdsmmsdsm.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\de-DE\MicrosoftBetriebssystem.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\ATBrokerSystem.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\Microsoftstreamci6.1.7600.163857.0907131255.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\Microsoft-Windows-TerminalServices-AppServer-Licensing\tsmigpluginOperating.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\arc.inf_amd64_neutral_11b52dec8e94d9aa\RAIDController.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\IME\IMEJP10\APPLETS\imjpcacMSHWJPN.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\com\ja-JP\MIGREGDBMicrosoft2001.12.8530.163857.0907131255.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\IME\shared\res\mircpadrs804.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\powershelliseWindows6.1.7600.16385.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ph6xib64c1.inf_amd64_neutral_68c99681343e9b68\Ph6xIBxxMVMacroVision.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-DHCPServerMigPlugin-DL\WindowsOperating.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidbth.inf_amd64_neutral_8a1323fc68ad84af\Microsofthidbth.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcxpv6.inf_amd64_neutral_f62ac4bd04e653d0\ModemModem.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmirmdm.inf_amd64_neutral_fadec14b0a37b637\WindowsOperating.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\ATBrokerSystem.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_neutral_b71dd3dadc5c3e27\eFE5b32eeFE5b32e.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\en-US\OperatingOperating.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\InstallShield\InstallShieldInstallShield.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja\WindowsSystem.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-IIS-DL\iismigInternet.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\0409\Microsoftmscorees.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-OfflineFiles-DL\WindowsMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\es\WindowsMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00g.inf_amd64_neutral_2926840e245f88f6\Amd64\EP0NM4RCPrinter.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\0410\mscoreesMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\WSMT\rras\replacementmanifests\Microsoft-Windows-RasServer-MigPlugin\WindowsWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudio.inf_amd64_neutral_ce7bc199c85ae0a0\Systemhdaudio.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sisraid2.inf_amd64_neutral_845e008c32615283\MicrosoftOperating.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMEJP10\APPLETS\WindowsmIRC.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\angel264.inf_amd64_neutral_04b54b6322607cce\AngelAngel2.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

Processes:

a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\WindowsSystme6.1.7600.16385.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\ado\ja-JP\SystemWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\msinfoWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Mail\es-ES\WindowsWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EURO\OfficeMicrosoft14.0.4756.1000.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\nonPDFicuuc361.0.0.1.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\es-ES\sbdropoperativo6.1.7600.163857.0907131255.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\SupportCustomer19178.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\datamatrixpmppdf417pmp2.8.8118.0.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\iedvtooljsprofilerui.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\MicrosoftHostAdapter.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\fr-FR\dexploitationsidebar.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\HXDSUIMicrosoft2.05.50727.4039.0507274000.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\HXDSUIMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\es-ES\MicrosoftWAB32res6.1.7600.16385.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\Ole DB\en-US\sqloledbMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\StudioVisual.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\StudioVisual.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\ja-JP\WAB32resWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\OfficeOffice.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Analysismsmdsrv.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iedvtoolVisual.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\VisualVSTOLoaderUI.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\operativomsinfo.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\it-IT\Windowsoperativo.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\Windowsmsadrh15.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\operativoWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\HelpMicrosoftR2.05.50727.4039.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\libraryVisual7.0.3300.0.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\EngineTTSEngineLoc.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DataSource.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\HelpMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\stintlstintl.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\de-DE\SystemWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\MicrosoftHXDSUI.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\operativomsinfo.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\es-ES\Windowsmsadcer.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\OperatingMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\de-DE\WAB32resBetriebssystem.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ipeditorOffice.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\msconv97Converters2010.1400.4730.1010.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\es-ES\msader15Microsoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\BootstrapperSmall.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\ToolsVisualStudio.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\MicrosoftMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\MicrosoftMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\ReachFrameworkUIAutomationClient.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\SourceOffice14.0.4730.1010.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VC\VisualVisual.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceserviceinstallermaintenanceservice105.0.3.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\productacewstr.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\NaturalComponents.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\oledb32rWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Defender\OperatingWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\OfficeFPSrvUtl14.0.4730.1010.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\SystemOperating.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\TranslationMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\osppcextOffice.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\de-DE\msader15Windows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\fr-FR\MicrosoftWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\resourcesresources3.0.4506.5420.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\en-US\Microsoftmsaddsr.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\InvestorRates.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\OrganizerClip.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

Processes:

a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\OperatingWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Configuration.Install.resources\2.0.0.0_it_b03f5f7f11d50a3a\Systemresources.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..docs-main.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_624083bd6bbe7667\WindowsWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_msbuild_b03f5f7f11d50a3a_3.5.7600.16385_none_8c3cf176a8e91487\MSBuildMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ncdprop_31bf3856ad364e35_6.1.7600.16385_none_afaaadda29b44241\MicrosoftOperating.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..mib-extension-agent_31bf3856ad364e35_6.1.7600.16385_none_6160b9ea27387d4c\WindowsWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-font-registrysettings_31bf3856ad364e35_6.1.7601.17514_none_fe2c02fcfc1cf640\muifontsetupMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-help-datalayer_31bf3856ad364e35_6.1.7600.16385_none_c490fde17faa7eaa\APDSWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mspaint.resources_31bf3856ad364e35_6.1.7601.17514_it-it_a7377e3b74bc957b\operativoMSPAINT.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_ricoh.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_af85e20316ac846e\MicrosoftWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-itvdata_31bf3856ad364e35_6.1.7601.17514_none_9d713d0f6f511c88\MicrosoftiTVData6.6.7601.17514.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_hdaudio.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ca3ec2f10ff44ef9\HDAudioWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b5fa959a738d6d74\msobjsSystem.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WindowsBase.resources\3.0.0.0_it_31bf3856ad364e35\resourcesFramework.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_be064cc3a640e167\OperatingWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_uiautomationclients..providers.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0407f9f70fbf2698\FrameworkUIAutomationClientsideProviders.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_ddores.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b860e3728a94f310\OperatingSystem.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-netshell-mui.resources_31bf3856ad364e35_6.1.7601.17514_en-us_ad1f7e0d511aad43\ncpaWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..omruntime.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d4aac73d55c29ea7\OperatingWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..dlinetool.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5ce2d365e8c378f5\BetriebssystemMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..nistrator.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6856263264d9f35c\MicrosoftWindowsBetriebssystem.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..iextensionsbinaries_31bf3856ad364e35_6.1.7600.16385_none_cd33d98d39773a5d\w3isapiServices.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B22c61a69#\4040994b0f6916a6cdecae442deb61d2\MicrosoftMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\SystemWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..ragelayer.resources_31bf3856ad364e35_6.1.7600.16385_es-es_fe01585d990a5c59\WindowsOperating.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_en_31bf3856ad364e35\SystemWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..rojection.resources_31bf3856ad364e35_6.1.7600.16385_en-us_70db4650bc249a91\OperatingNetwork.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-calc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e24d8d232fb2daa6\BetriebssystemCALC.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-wmpeffects_31bf3856ad364e35_6.1.7601.17514_none_5773ecb6a6113d69\Microsoftwmpeffects.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A3ec156ec#\f305d7d5c93da15933fbb44201c6e0f8\MicrosoftMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\9c17882ea083259c36cfd691f7c0835b\SystemSystem2.0.50727.5420.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..tebox-isv.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_64a7d743c904b676\DesktopServices.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-shimgvw.resources_31bf3856ad364e35_6.1.7600.16385_en-us_11cb45e722a8368f\Windowsshimgvw6.1.7600.163857.0907131255.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-netprofui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b01e4291a168ea19\MicrosoftWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..ragelayer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_fe35fb7998e36ab4\OperatingSystem.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..mmandline.resources_31bf3856ad364e35_6.1.7600.16385_en-us_908e3b2110ef94f2\wevtutilwevtutil6.1.7600.163857.0907131255.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..-dvdupgrd.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_1fb5b01120db22e2\DVDUpgrdWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-devicepairinghandler_31bf3856ad364e35_6.1.7600.16385_none_25f1deff415b9f17\MicrosoftWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-w..ig-registrar-wizard_31bf3856ad364e35_6.1.7600.16385_none_3d090e2060b5b3fc\SystemMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.7600.16385_ru-ru_03775985d5a48f63\WindowsMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data86569bbf#\98a4068512ff6a2566204bc1e759b0be\Microsoftsystem.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_6.1.7601.17514_nb-no_793d767b606b8577\MicrosoftWindows.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PresentationCoreXaml.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_6.1.7601.17514_zh-cn_1df73ac8bfb16d57\MicrosoftSystem.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.powershel..nsolehost.resources_31bf3856ad364e35_6.1.7601.17514_en-us_5dd36afa7c44c0ce\ConsoleHostOperating.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnlx00v.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ad4ac6158ec3af55\LexmarkComplemento.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\MicrosoftSoap.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-f12tools_31bf3856ad364e35_11.2.9600.16428_none_0f78b652edd1b7a5\F12ToolsExplorer.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_msbuild.resources_b03f5f7f11d50a3a_3.5.7601.17514_fr-fr_ce53794cefb4dada\resourcesFramework.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-twext.resources_31bf3856ad364e35_6.1.7601.17514_it-it_a0fb3529939d794f\twextMicrosoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..ndservice.resources_31bf3856ad364e35_6.1.7600.16385_it-it_63651abc8e803bb1\SistemaPlaySoundService.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-uiribbon.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_cbf8792bf6df54c7\Microsoftdexploitation.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer.resources_31bf3856ad364e35_6.1.7600.16385_de-de_658ad4c6e1804870\gameuxgameux.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..rpautoreg.resources_31bf3856ad364e35_6.1.7600.16385_de-de_31904980c1dd2d73\Windowspnrpauto.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_et-ee_09fac45c47d68317\comctl32Microsoft.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..ceruntime.resources_31bf3856ad364e35_6.1.7600.16385_it-it_c6738b3b92820837\wksprtWindows6.1.7600.16385.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..ncmdtools.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_048e922ff0bcb548\rpcinfoshowmount.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-qwave.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_190f5e0f558398eb\Systmeqwave.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_fr_31bf3856ad364e35\TaskSchedulerdexploitation.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-rmcast.resources_31bf3856ad364e35_6.1.7600.16385_it-it_d038de09b565c2bd\MicrosoftSistema.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_caa8f7c0e409a91f\ntkrnlmpWindows6.1.7601.21863.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-00000451_31bf3856ad364e35_6.1.7600.16385_none_4d8b4e5cb24a0251\WindowsOperating.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-csrss.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d908cfa0ee1aadb3\dexploitationWindows6.1.7600.16385.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-newdev.resources_31bf3856ad364e35_6.1.7600.16385_en-us_cf00a033363ace4b\newdevSystem5.2.3668.0.exe	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe

pid	Process
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
2196	a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EquationEditor.exe

Filesize
2.6MB

MD5
a71c301f4f5faf1fb2dd44a7c38dcf7b

SHA1
3fcbee9772ca415dcee61395c92fec7eab962480

SHA256
3850a3586deb09cfba2a7a7837c4d9d1af712cc3bf5fd78dfdc411fb788a86eb

SHA512
d54b1793e8620cae7c75b930848e2dbe441ef8a0410612387beb4f56dcf757900b6a995cf003172ab2e4d43d0003e1920358ab4911b5125b5ac6e530e1927bac

Download Submit
memory/2196-2384-0x00000000032B0000-0x00000000032F8000-memory.dmp

Filesize
288KB

Download
memory/2196-2499-0x0000000000700000-0x0000000000710000-memory.dmp

Filesize
64KB

Download
memory/2196-2498-0x0000000000700000-0x0000000000710000-memory.dmp

Filesize
64KB

Download
memory/2196-2497-0x0000000000700000-0x0000000000708000-memory.dmp

Filesize
32KB

Download
memory/2196-2496-0x0000000000700000-0x0000000000708000-memory.dmp

Filesize
32KB

Download
memory/2196-2495-0x0000000002830000-0x0000000002858000-memory.dmp

Filesize
160KB

Download
memory/2196-2500-0x0000000002830000-0x0000000002858000-memory.dmp

Filesize
160KB

Download
memory/2196-2513-0x0000000000700000-0x000000000070E000-memory.dmp

Filesize
56KB

Download
memory/2196-2512-0x0000000000700000-0x000000000070E000-memory.dmp

Filesize
56KB

Download
memory/2196-2537-0x0000000002830000-0x0000000002854000-memory.dmp

Filesize
144KB

Download
memory/2196-2536-0x0000000002830000-0x0000000002854000-memory.dmp

Filesize
144KB

Download
memory/2196-2627-0x0000000000700000-0x000000000070F000-memory.dmp

Filesize
60KB

Download
memory/2196-2626-0x0000000000700000-0x000000000070F000-memory.dmp

Filesize
60KB

Download
memory/2196-2641-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/2196-2640-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/2196-2639-0x00000000032B0000-0x00000000032F8000-memory.dmp

Filesize
288KB

Download
memory/2196-2644-0x0000000000700000-0x0000000000708000-memory.dmp

Filesize
32KB

Download
memory/2196-2643-0x0000000000700000-0x0000000000710000-memory.dmp

Filesize
64KB

Download
memory/2196-2642-0x0000000002830000-0x0000000002858000-memory.dmp

Filesize
160KB

Download
memory/2196-2659-0x0000000002830000-0x0000000002858000-memory.dmp

Filesize
160KB

Download
memory/2196-2658-0x0000000002830000-0x000000000284D000-memory.dmp

Filesize
116KB

Download
memory/2196-2657-0x0000000002830000-0x000000000284D000-memory.dmp

Filesize
116KB

Download
memory/2196-2656-0x0000000000700000-0x0000000000710000-memory.dmp

Filesize
64KB

Download
memory/2196-2694-0x00000000032B0000-0x0000000003308000-memory.dmp

Filesize
352KB

Download
memory/2196-2693-0x0000000000700000-0x000000000070E000-memory.dmp

Filesize
56KB

Download
memory/2196-2695-0x0000000002830000-0x0000000002854000-memory.dmp

Filesize
144KB

Download
memory/2196-2698-0x0000000002830000-0x0000000002841000-memory.dmp

Filesize
68KB

Download
memory/2196-2697-0x0000000002830000-0x0000000002854000-memory.dmp

Filesize
144KB

Download
memory/2196-2696-0x0000000002830000-0x0000000002841000-memory.dmp

Filesize
68KB

Download
memory/2196-2766-0x0000000000700000-0x000000000070F000-memory.dmp

Filesize
60KB

Download
memory/2196-2767-0x0000000002C70000-0x0000000002C9F000-memory.dmp

Filesize
188KB

Download
memory/2196-2765-0x0000000002C70000-0x0000000002C9F000-memory.dmp

Filesize
188KB

Download
memory/2196-2856-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/2196-2859-0x0000000003970000-0x00000000039BD000-memory.dmp

Filesize
308KB

Download
memory/2196-2858-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/2196-2857-0x0000000003970000-0x00000000039BD000-memory.dmp

Filesize
308KB

Download
memory/2196-2893-0x0000000002830000-0x000000000284D000-memory.dmp

Filesize
116KB

Download
memory/2196-2894-0x0000000002830000-0x000000000284D000-memory.dmp

Filesize
116KB

Download
memory/2196-2898-0x0000000002C80000-0x0000000002C98000-memory.dmp

Filesize
96KB

Download
memory/2196-2897-0x0000000002C80000-0x0000000002C95000-memory.dmp

Filesize
84KB

Download
memory/2196-2896-0x0000000002C80000-0x0000000002C98000-memory.dmp

Filesize
96KB

Download
memory/2196-2895-0x0000000002C80000-0x0000000002C95000-memory.dmp

Filesize
84KB

Download
memory/2196-2911-0x0000000002C80000-0x0000000002C84000-memory.dmp

Filesize
16KB

Download
memory/2196-2913-0x0000000002C80000-0x0000000002C84000-memory.dmp

Filesize
16KB

Download
memory/2196-2912-0x0000000003970000-0x00000000039BA000-memory.dmp

Filesize
296KB

Download
memory/2196-2910-0x0000000003970000-0x00000000039BA000-memory.dmp

Filesize
296KB

Download
memory/2196-2925-0x0000000002830000-0x0000000002841000-memory.dmp

Filesize
68KB

Download
memory/2196-2927-0x0000000002830000-0x0000000002841000-memory.dmp

Filesize
68KB

Download
memory/2196-2926-0x0000000002C80000-0x0000000002C89000-memory.dmp

Filesize
36KB

Download
memory/2196-2928-0x0000000002C80000-0x0000000002C89000-memory.dmp

Filesize
36KB

Download
memory/2196-2930-0x0000000002C80000-0x0000000002C9D000-memory.dmp

Filesize
116KB

Download
memory/2196-2929-0x0000000002C70000-0x0000000002C9F000-memory.dmp

Filesize
188KB

Download
memory/2196-2931-0x0000000003970000-0x00000000039BD000-memory.dmp

Filesize
308KB

Download
memory/2196-2934-0x00000000032B0000-0x00000000032F7000-memory.dmp

Filesize
284KB

Download
memory/2196-2933-0x0000000003970000-0x00000000039BD000-memory.dmp

Filesize
308KB

Download
memory/2196-2932-0x00000000032B0000-0x00000000032F7000-memory.dmp

Filesize
284KB

Download
memory/2196-2991-0x0000000002C80000-0x0000000002C98000-memory.dmp

Filesize
96KB

Download
memory/2196-2990-0x0000000002C80000-0x0000000002C95000-memory.dmp

Filesize
84KB

Download
memory/2196-2992-0x0000000002C80000-0x0000000002C95000-memory.dmp

Filesize
84KB

Download
memory/2196-2993-0x00000000032B0000-0x00000000032F9000-memory.dmp

Filesize
292KB

Download
memory/2196-2994-0x0000000002C80000-0x0000000002C98000-memory.dmp

Filesize
96KB

Download
memory/2196-2995-0x00000000032B0000-0x00000000032F9000-memory.dmp

Filesize
292KB

Download
memory/2196-2996-0x0000000003970000-0x00000000039BA000-memory.dmp

Filesize
296KB

Download
memory/2196-3052-0x0000000002C80000-0x0000000002C84000-memory.dmp

Filesize
16KB

Download
memory/2196-3054-0x0000000003970000-0x00000000039BA000-memory.dmp

Filesize
296KB

Download
memory/2196-3056-0x0000000002C80000-0x0000000002C89000-memory.dmp

Filesize
36KB

Download
memory/2196-3055-0x0000000002C80000-0x0000000002C84000-memory.dmp

Filesize
16KB

Download
memory/2196-3053-0x0000000002C80000-0x0000000002C89000-memory.dmp

Filesize
36KB

Download
memory/2196-3079-0x0000000002C80000-0x0000000002C89000-memory.dmp

Filesize
36KB

Download
memory/2196-3080-0x0000000002C80000-0x0000000002C89000-memory.dmp

Filesize
36KB

Download
memory/2196-3082-0x0000000002C80000-0x0000000002C9F000-memory.dmp

Filesize
124KB

Download
memory/2196-3081-0x0000000002C80000-0x0000000002C9F000-memory.dmp

Filesize
124KB

Download
memory/2196-3172-0x0000000002C80000-0x0000000002C9D000-memory.dmp

Filesize
116KB

Download
memory/2196-3171-0x00000000032B0000-0x000000000330A000-memory.dmp

Filesize
360KB

Download
memory/2196-3173-0x0000000002C80000-0x0000000002C9D000-memory.dmp

Filesize
116KB

Download
memory/2196-3174-0x00000000032B0000-0x000000000330A000-memory.dmp

Filesize
360KB

Download
memory/2196-3211-0x0000000002C80000-0x0000000002C92000-memory.dmp

Filesize
72KB

Download
memory/2196-3210-0x0000000002C80000-0x0000000002C92000-memory.dmp

Filesize
72KB

Download
memory/2196-3209-0x00000000032B0000-0x00000000032F7000-memory.dmp

Filesize
284KB

Download
memory/2196-3208-0x00000000032B0000-0x00000000032F7000-memory.dmp

Filesize
284KB

Download
memory/2196-3312-0x0000000002C80000-0x0000000002C8A000-memory.dmp

Filesize
40KB

Download
memory/2196-3311-0x00000000032B0000-0x00000000032F9000-memory.dmp

Filesize
292KB

Download
memory/2196-3314-0x0000000002C80000-0x0000000002C8A000-memory.dmp

Filesize
40KB

Download
memory/2196-3313-0x0000000002C80000-0x0000000002C8A000-memory.dmp

Filesize
40KB

Download
memory/2196-3315-0x0000000002C80000-0x0000000002C8E000-memory.dmp

Filesize
56KB

Download
memory/2196-3316-0x0000000002C80000-0x0000000002C8F000-memory.dmp

Filesize
60KB

Download
memory/2196-3559-0x0000000002C80000-0x0000000002C89000-memory.dmp

Filesize
36KB

Download
memory/2196-3593-0x0000000002C80000-0x0000000002C89000-memory.dmp

Filesize
36KB

Download
memory/2196-3594-0x00000000032B0000-0x0000000003339000-memory.dmp

Filesize
548KB

Download
memory/2196-3597-0x0000000002C80000-0x0000000002C9F000-memory.dmp

Filesize
124KB

Download
memory/2196-3596-0x0000000002C80000-0x0000000002C9F000-memory.dmp

Filesize
124KB

Download
memory/2196-3595-0x00000000032B0000-0x0000000003339000-memory.dmp

Filesize
548KB

Download
memory/2196-3643-0x0000000002C80000-0x0000000002C93000-memory.dmp

Filesize
76KB

Download
memory/2196-3642-0x0000000002C80000-0x0000000002C93000-memory.dmp

Filesize
76KB

Download
memory/2196-3645-0x00000000032B0000-0x000000000330A000-memory.dmp

Filesize
360KB

Download
memory/2196-3644-0x0000000002C80000-0x0000000002C9D000-memory.dmp

Filesize
116KB

Download