neshta | 678674141b451bcdaf2a310c051222da0dc89fc6702d823e1cda52af4ef9cfd7

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-01-2025 08:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Size

1.3MB
MD5

63b273a1313b10097263f35529e8cd20
SHA1

3c818ee060befe46d05f8f7b52b8db89d9136e0a
SHA256

678674141b451bcdaf2a310c051222da0dc89fc6702d823e1cda52af4ef9cfd7
SHA512

0090335d5d1fff651beed959039a8ca0ea5dcde509522b159561fc23dd65330d1fa63959748981177a7d1088eca4deb8e8cae202c176b59b51c58a1c6480784d
SSDEEP

24576:oi/7tC5GPql69nfWRGKENMuOhJecdubAXc/C0yDkWDzW5/TP8lA9Lp9LF:V/7Y5aUGKSCUcUbAMB69Dq5/nL7LF

Score

10^/10

neshta discovery evasion persistence spyware stealer upx

Malware Config

Signatures

Detect Neshta payload 3 IoCs

resource	yara_rule
behavioral1/files/0x0001000000010314-10.dat	family_neshta
behavioral1/memory/2536-132-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2536-135-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta
Contacts a large (780) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2096	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\Wow6432Node\Wine	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe

Loads dropped DLL 2 IoCs

pid	Process
2536	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
2536	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\uTorrent = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3582-490\\JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe\" /MINIMIZED"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000016115-2.dat	upx
behavioral1/memory/2096-12-0x0000000000400000-0x000000000075B000-memory.dmp	upx
behavioral1/memory/2096-131-0x0000000000400000-0x000000000075B000-memory.dmp	upx
behavioral1/memory/2096-133-0x0000000000400000-0x000000000075B000-memory.dmp	upx
behavioral1/memory/2096-136-0x0000000000400000-0x000000000075B000-memory.dmp	upx
behavioral1/memory/2096-137-0x0000000000400000-0x000000000075B000-memory.dmp	upx
behavioral1/memory/2096-149-0x0000000000400000-0x000000000075B000-memory.dmp	upx
behavioral1/memory/2096-213-0x0000000000400000-0x000000000075B000-memory.dmp	upx
behavioral1/memory/2096-214-0x0000000000400000-0x000000000075B000-memory.dmp	upx
behavioral1/memory/2096-224-0x0000000000400000-0x000000000075B000-memory.dmp	upx
behavioral1/memory/2096-231-0x0000000000400000-0x000000000075B000-memory.dmp	upx
behavioral1/memory/2096-232-0x0000000000400000-0x000000000075B000-memory.dmp	upx
behavioral1/memory/2096-233-0x0000000000400000-0x000000000075B000-memory.dmp	upx
behavioral1/memory/2096-234-0x0000000000400000-0x000000000075B000-memory.dmp	upx
behavioral1/memory/2096-235-0x0000000000400000-0x000000000075B000-memory.dmp	upx
behavioral1/memory/2096-237-0x0000000000400000-0x000000000075B000-memory.dmp	upx
behavioral1/memory/2096-238-0x0000000000400000-0x000000000075B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe = "9000"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-appinst	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.torrent\ = "uTorrent"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\uTorrent\Content Type\ = "application/x-bittorrent"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.btskin	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.btskin\ = "uTorrent"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\uTorrent\shell\open\command	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\MIME\Database	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Magnet\ = "Magnet URI"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\uTorrent\DefaultIcon	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.torrent\Content Type = "application/x-bittorrent"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.btkey\ = "uTorrent"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\bittorrent\shell\open	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\FalconBetaAccount	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.btinstall	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\uTorrent\Content Type	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.btsearch\ = "uTorrent"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Magnet\shell\open	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.btapp	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.btapp\ = "uTorrent"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\bittorrent\Content Type = "application/x-bittorrent-protocol"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\uTorrent\shell\open	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Magnet\Content Type = "application/x-magnet"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.btinstall\ = "uTorrent"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\bittorrent\URL Protocol	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\bittorrent\shell\open\command	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\bittorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\uTorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\MIME\Database\Content Type	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.btkey\Content Type = "application/x-bittorrent-key"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-key	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\uTorrent	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Magnet\DefaultIcon	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-app	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-skin	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\FalconBetaAccount\remote_access_client_id = "6052752093"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.btsearch	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\bittorrent\shell	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\bittorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3582-490\\JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe\" \"%1\""	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Magnet	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\bittorrent\DefaultIcon	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Magnet\shell	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Magnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3582-490\\JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe\" \"%1\""	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.btskin\Content Type = "application/x-bittorrent-skin"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.torrent	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2096	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
2096	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2096	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2096	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2096	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
2096	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
2096	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2096	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
2096	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
2096	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2096	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
2096	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2096	2536	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe	30
PID 2536 wrote to memory of 2096	2536	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe	30
PID 2536 wrote to memory of 2096	2536	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe	30
PID 2536 wrote to memory of 2096	2536	JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe"
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2096

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
- System Location Discovery: System Language Discovery
PID:672

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
- System Location Discovery: System Language Discovery
PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab88B3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\utt86DC.tmp.new

Filesize
2KB

MD5
9014fd63b207e03dce7f14dda95ba4e8

SHA1
78ea2798354be99f74f8e6d2851af68046231306

SHA256
4b7d4e373adac532629e68f66698af7f6d11e8a85eb33696aebdaa42621aba44

SHA512
cdbb8d0ff24fd61c4c0d8efa3f6e480b81163709c80d9e949240a4b4550718cc6d24d37505d7c4a96cac3b13209f3f441b5c03fc2665fdc4ab4bfe56f275f595

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\apps\player.btapp

Filesize
275B

MD5
a073dc5c61063b30008ddf71cae8a1f3

SHA1
b81c8eaf59f6b6051b37a3fd73f8c30c956d7479

SHA256
61da84f27f17ee70994c0d89718981439c0344c9be77934fe184e6143efeb28c

SHA512
e7e1e2909d02b907545af51e358f5f36f45484c425bc40aee8803a540ae18cad5bac6aee7b07ae1ff14fbf6351aa549e09cbcb0825694901be48b755d22cc685

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\apps\plus.btapp

Filesize
768B

MD5
f9bcb8c14295ef3b2f00d899cd498265

SHA1
cac8128c852287d27c517ba1fac61af7d9c97113

SHA256
577a752fc88a37f310d0465619e998b21c83dc0e3fee6c1045bfcef719309286

SHA512
542245ba7dc96ac59c626b772133354237e6db086c5d6cbe7cf0193eaca0f253f12885e0b7a2a5a5a6f35aafa7c277da331d7b4083e6c703a5d461885a603cc8

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\apps\welcome-upsell.btapp

Filesize
275B

MD5
8cb9c9e2fb263fe54790e5a200851945

SHA1
f6b6eda49dbd56cb7b536b4469d42a633ed7b050

SHA256
bf62475b4cea2d15df254c4526009888d6dad6a7bc918d197563c89ced9efea9

SHA512
ee08338f9e7fd101a5f8b0aef7f5b97fa32fd4e92d58d4d58ea95c2d3bd96b1435b320e2905c802f36b91de08303b9ae32b874ac619fd6e2c098a10570e38d41

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\dlimagecache\165F6EF40A81DD175FFAEA69E77ABFD30B27E71C

Filesize
1KB

MD5
4280089022fce23da2c64031bf137c08

SHA1
0380334f420bc6677795fda8f5201c1fb7355c1c

SHA256
ec9e7c253d599175af470832da851cf4f59614a4c4d4e37183159801b13abf5f

SHA512
9eafb6f30baf09a32601b1f9da1316e1fcc44256784221da85f54718de6f0539c2bb601feba194c2ba801c8b95834f5029c93e3508f79daddf8c3343fc848a05

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat.old

Filesize
7KB

MD5
dc098cdbba0236f0ec4706e28b3c5e32

SHA1
1ee772fd066d3f3bb670f7e887f35e24387dd669

SHA256
0bad0837cb6682a77a25f52794f3ca8e392f2e5196440be07d749b9a05780355

SHA512
6356a08fd67ae823fcba7c998f131fd88929ecc213c464a3f18f5ab6485e4bab2888a5fb4ddb290fdefbe1a4a9902fe4e9542db8726db83cc953a12607f6dab8

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\toolbar.benc.new

Filesize
36KB

MD5
3ecbf853fdc90d95cd20a180e975f5ee

SHA1
e9b382a521702f5d5b19de57be0804d6c0b917aa

SHA256
790434a46c1b3051f13fc612543c6285fd98a7eb11ff141e027543c79e6d0a67

SHA512
475390912633c50211321cc138fb68114bda4f0f54d3618aef61f456e5bb5f0b2d850bd78b6e17488f34062099ddde2600bf8f5dffee706441db65c24924c5f5

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_63b273a1313b10097263f35529e8cd20.exe

Filesize
1.3MB

MD5
0d64dffe07413bd446ee18afd410fde4

SHA1
7dc045b4f5ab145e20cd78eed06660b728530081

SHA256
1358d110f059d8eb133d2574976ed81fe654a24b514bc6f7e42509b560f7a3bc

SHA512
8c529df34901b75b5b40759fabd32bd2dede9d27ad9c096006ed611308035956f2096acf7d637c2c6b4216e7709e33d686cc102b9d6c7bc87189ecb858510f35

Download Submit
memory/2096-137-0x0000000000400000-0x000000000075B000-memory.dmp

Filesize
3.4MB

Download
memory/2096-213-0x0000000000400000-0x000000000075B000-memory.dmp

Filesize
3.4MB

Download
memory/2096-136-0x0000000000400000-0x000000000075B000-memory.dmp

Filesize
3.4MB

Download
memory/2096-133-0x0000000000400000-0x000000000075B000-memory.dmp

Filesize
3.4MB

Download
memory/2096-238-0x0000000000400000-0x000000000075B000-memory.dmp

Filesize
3.4MB

Download
memory/2096-149-0x0000000000400000-0x000000000075B000-memory.dmp

Filesize
3.4MB

Download
memory/2096-131-0x0000000000400000-0x000000000075B000-memory.dmp

Filesize
3.4MB

Download
memory/2096-237-0x0000000000400000-0x000000000075B000-memory.dmp

Filesize
3.4MB

Download
memory/2096-12-0x0000000000400000-0x000000000075B000-memory.dmp

Filesize
3.4MB

Download
memory/2096-235-0x0000000000400000-0x000000000075B000-memory.dmp

Filesize
3.4MB

Download
memory/2096-214-0x0000000000400000-0x000000000075B000-memory.dmp

Filesize
3.4MB

Download
memory/2096-224-0x0000000000400000-0x000000000075B000-memory.dmp

Filesize
3.4MB

Download
memory/2096-234-0x0000000000400000-0x000000000075B000-memory.dmp

Filesize
3.4MB

Download
memory/2096-231-0x0000000000400000-0x000000000075B000-memory.dmp

Filesize
3.4MB

Download
memory/2096-232-0x0000000000400000-0x000000000075B000-memory.dmp

Filesize
3.4MB

Download
memory/2096-233-0x0000000000400000-0x000000000075B000-memory.dmp

Filesize
3.4MB

Download
memory/2536-11-0x0000000002D90000-0x00000000030EB000-memory.dmp

Filesize
3.4MB

Download
memory/2536-135-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2536-130-0x0000000002D90000-0x00000000030EB000-memory.dmp

Filesize
3.4MB

Download
memory/2536-132-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download