expiro | 330558405a5486392d856908bf7592473c817685d266289b425e93a676661bee

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2025 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
Size

618KB
MD5

644e4d14dc2e71ecc9d70a2da540a360
SHA1

16c218c345c43c62bc8521ca2ae6f6dafd0fc2dd
SHA256

330558405a5486392d856908bf7592473c817685d266289b425e93a676661bee
SHA512

ba6434209666d03aaeb921b0434b4dd5c27e816a3bb92a86f89abb03fb9b6bc8b9c3f9d18752f6e36fc84d82fe9138b3e65fa22921b0eb6f3d99f179f8762e4a
SSDEEP

12288:mbhv02bZop2mk2jALtaOWe6x9aGMjefpxlLpNjt6bVqyYSiOPAW:mb502b2pdkKARIe6qGIYxpjgVDYgF

Score

10^/10

expiro backdoor credential_access discovery evasion spyware stealer trojan

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/memory/1360-2-0x0000000001000000-0x000000000125A000-memory.dmp	family_expiro1

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 5 IoCs

pid	Process
3956	elevation_service.exe
2348	elevation_service.exe
3448	maintenanceservice.exe
1960	OSE.EXE
1980	ssh-agent.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3350944739-639801879-157714471-1000	elevation_service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3350944739-639801879-157714471-1000\EnableNotifications = "0"	elevation_service.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdgkfajodaliacghnafobjnclblcfmlm\1.0_0\manifest.json	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\Q:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\Q:	elevation_service.exe
File opened (read-only)	\??\X:	elevation_service.exe
File opened (read-only)	\??\E:	elevation_service.exe
File opened (read-only)	\??\G:	elevation_service.exe
File opened (read-only)	\??\Y:	elevation_service.exe
File opened (read-only)	\??\J:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\K:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\V:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\I:	elevation_service.exe
File opened (read-only)	\??\V:	elevation_service.exe
File opened (read-only)	\??\M:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\S:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\J:	elevation_service.exe
File opened (read-only)	\??\E:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\O:	elevation_service.exe
File opened (read-only)	\??\W:	elevation_service.exe
File opened (read-only)	\??\K:	elevation_service.exe
File opened (read-only)	\??\L:	elevation_service.exe
File opened (read-only)	\??\M:	elevation_service.exe
File opened (read-only)	\??\G:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\H:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\U:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\X:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\H:	elevation_service.exe
File opened (read-only)	\??\N:	elevation_service.exe
File opened (read-only)	\??\P:	elevation_service.exe
File opened (read-only)	\??\S:	elevation_service.exe
File opened (read-only)	\??\W:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\R:	elevation_service.exe
File opened (read-only)	\??\T:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\Y:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\Z:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\I:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\L:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\O:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\P:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\R:	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened (read-only)	\??\T:	elevation_service.exe
File opened (read-only)	\??\U:	elevation_service.exe
File opened (read-only)	\??\Z:	elevation_service.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\fxssvc.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	\??\c:\windows\system32\ggaidiim.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	\??\c:\windows\system32\WindowsPowerShell\v1.0\onopglhd.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\locator.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	\??\c:\windows\system32\jqideopp.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\vds.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\maiolibf.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\Appvclient.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	elevation_service.exe
File created	\??\c:\windows\system32\openssh\dfdgapod.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\SysWOW64\tieringengineservice.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	\??\c:\windows\system32\cjfopmfe.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	\??\c:\windows\SysWOW64\eofglcfn.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\SysWOW64\perfhost.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\SysWOW64\sgrmbroker.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	\??\c:\windows\system32\monaqeho.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\spectrum.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\locator.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\diagsvcs\diagnosticshub.standardcollector.service.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	elevation_service.exe
File created	\??\c:\windows\system32\bhlollho.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jdk-1.8\bin\eiknqqhf.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\moiajbka.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\llhhlfmg.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jdk-1.8\bin\fhmdllan.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\bhlnifll.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Microsoft Office\root\Client\icfmlqcp.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Internet Explorer\aglddoil.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jdk-1.8\bin\gnciljmn.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jdk-1.8\bin\fcbnjplg.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\odadaonc.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jdk-1.8\bin\fadcmdcc.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\7-Zip\afaqkaok.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\bmmoojdm.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\eehkqlfa.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Internet Explorer\iodfapig.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	elevation_service.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ckillgah.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jdk-1.8\bin\qqlagjep.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jdk-1.8\bin\phgiobhi.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmdchbdj.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Google\Chrome\Application\onnmbqjl.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jeoonppk.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jre-1.8\bin\nikalpei.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\fnlcopje.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jre-1.8\bin\ibcoebjm.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	\??\c:\program files\windows media player\dkceeppn.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\klonohhl.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kfefgkli.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\djgnqiea.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dmkcmlkj.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jre-1.8\bin\fcmpdicp.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jre-1.8\bin\ooqkhhjo.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File created	C:\Program Files\Java\jre-1.8\bin\aplfnjfi.tmp	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1360	JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
Token: SeTakeOwnershipPrivilege	3956	elevation_service.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	elevation_service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	elevation_service.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1360

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2348

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3448

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1960

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
00b7209c309570c5ce8e3a50f501edfd

SHA1
b8491e2edada4c1e50a1994ad1549d4282511a9b

SHA256
898a2ff02092af06ad587e78e823a2784e55040b755c6af39123b5411a40c004

SHA512
3cea806d4520d14f752ad4f8c127b563ac424727a356af685f9b3565fb1e09165a5cdd5716e2e9599c662803b8f9f64b27bc688929091cc92d3f7e75023bae2f

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
781KB

MD5
17b062e1055982aea7fe639f67b33a33

SHA1
30d3b8effbd8cc125b88633ef9c1388025f798de

SHA256
bb57d9cfbc3b9f4111bbb1c7e4e8bb8e2a2b65f56c7ae143695d9dc18e83509e

SHA512
6c063485994382c8ab23bd61c3a0a514afcf319143b50a2b226cf25c9b36aab60fe560ef6d52d8db7f787ec45260f309d0ee93bd21e80ac6960408b1e74accf0

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.1MB

MD5
3c6c9850d67dad538bf5e4ceea06623e

SHA1
7e0f7cb4f3c1cea2b53545fd8233a25338e72ff4

SHA256
9b45ce9c58dede2cc4c5170a0382214108937cd5786bcdcabc1aa8d58b434b8a

SHA512
a18e59c1c27f7b196678d202cab006cbf7d0d98dcc3ce976587bfa9d2d972801a9f60f5da638c744d91029b39acebbd2f6cab7a8afc435ab98b0e6d678fb6fbf

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
74ffb49eff4e2328ff1270b4010f03ec

SHA1
26e5b586d6dea5179d86b68853917793cd689b0a

SHA256
b895e7d3da5b13888d23f4dd98417f80f9d22a8b947c2b08b313cebf5ad1a851

SHA512
b9f5dc5f6ca0a4a5020f1d46aa4b90023dbd610bdfd6e1b8a225a32a6f7e6a94da20dcd82217fa839da9a9249913317f659d2e2da999eaf0d37a3105a49a59b5

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
1a3085653c40ba60cb5f09711f602a63

SHA1
1c79da40998d83c34d28de29d5cdecb549f5100e

SHA256
ffe242b19dfbb45db12f55289d32d1991b927a9fb9baa6e72b2fbe67efea79a2

SHA512
dc478151312e1a134a9ee7e14bbb9499335508e6843d9993c14de0f52276517072b96de2a66dac0a8dad6953412086c375d88c2bf9f7144633e4737cdd6d2bfa

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
832KB

MD5
7da83f9f541d80aadbff3f9338d5061a

SHA1
2ed33a7d7577a946e263a8e7103a941ab61c34b5

SHA256
4966a0a14b73aac3d332fe205dbe016f8a69c7226a3236b5b744e14e2f87778c

SHA512
9f27533dcb5b902a30247a652c7bbae1e4a9d24558ff985b6d04fe9e7a5e9d846550d4015ef21558edb4212b265df9156569ecf92602ac76ceec519e38d17a92

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
a203dd29dd35b8cc948f6c3a082780b2

SHA1
b72df21a2a3a734ceb07a6339c42219d2db9e044

SHA256
1dc143d818ead09dbaa49f232dd6f4308ae8ef1973547e480041e2ae2c0f2816

SHA512
cd30798a36d5329db9efba459076a463b7270a3f9922a5c2085439a43cee0e358e44317b1f3f25fd94bd09e8bfef52403364bc31fa18261eed20940607db51b5

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
898KB

MD5
413707758bcc8ca01d18edf949e36732

SHA1
e382175cbb5bd835d1f3e386aeaca0775533c12b

SHA256
5bc8bf66ceb23d05c6dabaf7c0ca4573d6e738f98ef0ec23b9c58ce317d5162c

SHA512
5789cd26df5bda22921d0701812d420e59353dbb8b4e2ad2e7c6700e50f3aea1df96864c18c5e9ba942809fe4af093bae7136ebd6403a6f334d3a551b9393bf2

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
261dff7e2665c08c3a3acd745dded40c

SHA1
1c34b8943fc3e63170b8f0e12af858fa7010e768

SHA256
96b1b067dd084b14eab6837848a28b5236c302918ba433b098d61faf5c2af610

SHA512
04d3af4e19cfd907576cec64b723a787073e71170d97e38c4ece36bb8833a674d28400d75e64694b7eff3ffc5d7e9753d30d6d6ef559b627c89d606dced5d976

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
c576286886fb447a9d57ac1e3c90d9b8

SHA1
e75036bf619ccdd7b1c465691bfbd370f25a141f

SHA256
67dfa4a16b9fda06d8a05d2286b7bedfdf9a7fe0f5ce9e678233eeb9215a45e1

SHA512
5428634d18d2377ef47898c49bbacddb370fdbbbfa6dbd87569e7f6e42cf45a457b3852e699dd2687bdb7d5807d95d75fa1d6f7ce6010ea99f74d90ef79df14e

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
797KB

MD5
4a5ae94735306ce1f8b596b29cccf414

SHA1
4cffcc7d990a26d9c04a94f70e1b5483f9e5d6ed

SHA256
1021c03eceb59a2b06c0fbba923f69e76d5c5be9e752147859d42be24d852d47

SHA512
b6a297962896a243a15bf0da50f594d0f3630927c86d8a6026654df177f4907f874a89b1d8ced06cf383f2c0ec52d82f9d3906fb570ffb727e67ae05ba6cd638

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\cpkcoelj.tmp

Filesize
4.6MB

MD5
f7bd44ddea55feb9d7ff663ace8db142

SHA1
14c4c7d466c3201dfc43533ac1179b92729c7a14

SHA256
f0c9f20f01c8dde26ec798c5aff2b9e085b21d4692f771e25b214e3b46f5f14f

SHA512
b40d872e07dcbdc57f21a6a4228c98744d4ec33449bf821e9d5fb6f1c0dd787f28cb91339321fbd7430fe36bf7be0fdb8a1a7f414cf2126ed7314751a503898a

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

Filesize
2.1MB

MD5
610ebbf01f9293e835bad92c8e142ddb

SHA1
66b7332b2e52f8008f4b59485f771fbea5d7f71b

SHA256
62acf5047c7f408dc1b0170471df5bbc3852c11715d30c7dc447cdaaf183a9c1

SHA512
2b6b74bb2561148f6d402711c9e8019ca14902c24c61ccfebf3ad243f1a88bd284f6254127040c87c3ef6216a640442213746176b23fad8f30fe75cde9240a86

Download Submit
C:\Program Files\Internet Explorer\iexplore.exe

Filesize
1.3MB

MD5
ccdce701d069517748939362c3e305b0

SHA1
a3a9f6851bd43c372644ccb6f60796505aa6048a

SHA256
330edf0ecd72713d91e50d4655d6e2be2d403218a8161d8055ddaaf4fc307769

SHA512
c635f2f66d068d015852b4cd9744bda5e7d7e7fe9cf066e1fb5032d346b1e9072f0ff95de067c8b760d9ecb0c329bc82a127754603e1df3030382eaf05b99c54

Download Submit
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Filesize
978KB

MD5
f8689e9dcd03542ce0717d8fc420126d

SHA1
489a4805c86b85f26518f2f9035aac93d9037d83

SHA256
9c9b1fe48004cbc4e56b7a4ee9f7953d466d04e1fb9d5be9b01ccdb2383def2c

SHA512
017bc57a10637d2730a0d13dba53e471be31d61a32dd23f74215399bdf9e39ee8c1ff8714152c3fea2d123af51901fa42e067b33672dda4e9e649cad20a1bf64

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
932KB

MD5
75a686e07568c4b8f45938453ce41bf9

SHA1
65b37680ba556ec685bcc566b76fa1fff3318815

SHA256
79f6d3e9c709771397fe91067886b715eb4b7b8e15c270ed3ce3245bb08528f9

SHA512
cb1f4a32e44a3079734270e6cbf4d88b84570b875bcd27ccee606c6546e40fbd96c75d652a0ace5d21c399543c6bf469244eccc94e459168d57a3fa7b40fc46e

Download Submit
C:\Windows\System32\jqideopp.tmp

Filesize
1.3MB

MD5
c91efbe70bcf6e6ab27ead1eacfb2aed

SHA1
e17e33ce05ab593309284abdb5ef6cda78cbc46e

SHA256
0d191f66d2c53188a9e32186a96f6963945999245e8f343ea9145c1d79ce9485

SHA512
924070091cefbe2da7fd521ad5651cc8520c55b6f1cd683da50a921a489133fd3702aef2097310efdf05373f6b302d853cf691dfb0419b97c407febae1a04188

Download Submit
\??\c:\program files\windows media player\wmpnetwk.exe

Filesize
1.5MB

MD5
230dbf6f7c86a439dcbd6e33884e215e

SHA1
dc7b84ec737c0b43bb9b87941528a245fcef4a3f

SHA256
bf8daef3f769b628f473010ad0c48303126c8f852970fb3464c95339b9c5cb37

SHA512
068210af07bf03d0818a4a0e333872e3ac79e6a1d41ee94679dd7afe9327cf5d6a8fd8c06f12686719894d2e8e2ca9e47aeb61b47c06fe2e233d960563aa2c0a

Download Submit
\??\c:\windows\system32\Agentservice.exe

Filesize
1.7MB

MD5
97efba296af37014ff3aac114526380c

SHA1
ac80dc05dc7da24ca04bc26674df36a238e39d6d

SHA256
06afb74b30145d64722cbc3677dcf8c0e262f742be5fabb75739e8f9d5b4096d

SHA512
97d13b5b96fc06928d5ffde4cab9704ff531c85c5992e2e4b1bedf61ba903f79e346287d60c0007d4d7c70ffd8748c6fc50acf37c1f490e1cf5f7c3945c0f1ea

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
1440c46fb43acc40d97d158e26bc8fe0

SHA1
35efd35eb198c12dfd7b179c3fb26917de78b628

SHA256
bcff342977d45520aafb85662e56a865fe0e3962a1839b1491dcb0ad1114e3f5

SHA512
e494a76ec96bcc0ca2847b41a44b1ea87ca7fdf8ae01dee95401349706fa39cd6f256f8b71497c1e391b397765f7c3380d4497368d68823dbcd85cb5bc06ce70

Download Submit
\??\c:\windows\system32\msdtc.exe

Filesize
700KB

MD5
cda3c46afebee1459d40aedf5a9c2bce

SHA1
c4501c07821e7036f1f1252dbd0e713ef0000c55

SHA256
870af49d0987a236700c067942f898532bddf8e3a93c3d0d283fce33628f6fec

SHA512
b4990461971f208496282e309f44b2d7cd5e8cffd15e23b7872d80ceca278b63a286543bb4f16660570b3c8ba4646aa4202c32ad3471e6f4ac0692c83b14780f

Download Submit
\??\c:\windows\system32\msiexec.exe

Filesize
623KB

MD5
310ecd35641978b91b6a2da276333543

SHA1
8ec283f187402163bd936dde8d1abfe1f5b4cbd0

SHA256
a73ac7fe63214b9477af2df528019b14dbb9884f6478b74d98ff44d6217a4e4c

SHA512
c5487ac59e99c586ecfb560f747533c5c93642da25d9375cb1d75a885782077e4281c1f28956dc708f4c7715b712495ae5acdb9a969647e740d5fc9fbd0eda33

Download Submit
\??\c:\windows\system32\snmptrap.exe

Filesize
572KB

MD5
446b984bd26c3a8073b803ed8e5f2d1d

SHA1
acebb8ecb844f58cb222d930a362e251a5ad8ce7

SHA256
a1c35622799d524ab9a5bbbdccb4c0d5889321f53290d88be6569b3db2ed7988

SHA512
a96dd0cc5962121365516a8b07a0508f29fbccfd3c885c2e2e8b4c7eeeb8d9ce3afcaccf2577d5f7abd05a02a8326cb04020027663e52e287ac5332503df49d1

Download Submit
\??\c:\windows\system32\wbengine.exe

Filesize
2.1MB

MD5
f841108307481b37cde472ced0986c0e

SHA1
6827fa3a011017c7b9051397d00840d85b266a8a

SHA256
98ebd6f6e5818bb03e7f81315179832f8b85b89046489dbff8561bc4743e3fc9

SHA512
db60a3226356c983c4eda387627a7faaae3207be63417612ca36a945512b19a53dde39f394227c1c4a00bd683201dffe4e865de875dfb9b1bf3e14fa17aa176a

Download Submit
memory/1360-2-0x0000000001000000-0x000000000125A000-memory.dmp

Filesize
2.4MB

Download
memory/1360-1-0x000000000100B000-0x000000000100D000-memory.dmp

Filesize
8KB

Download
memory/1360-0-0x0000000001000000-0x000000000125A000-memory.dmp

Filesize
2.4MB

Download
memory/1960-166-0x0000000140000000-0x00000001402B3000-memory.dmp

Filesize
2.7MB

Download
memory/1960-154-0x0000000140000000-0x00000001402B3000-memory.dmp

Filesize
2.7MB

Download
memory/1960-61-0x0000000140000000-0x00000001402B3000-memory.dmp

Filesize
2.7MB

Download
memory/1960-67-0x0000000140000000-0x00000001402B3000-memory.dmp

Filesize
2.7MB

Download
memory/1980-182-0x0000000140000000-0x00000001402E6000-memory.dmp

Filesize
2.9MB

Download
memory/1980-75-0x0000000140000000-0x00000001402E6000-memory.dmp

Filesize
2.9MB

Download
memory/2348-118-0x0000000140000000-0x000000014040F000-memory.dmp

Filesize
4.1MB

Download
memory/2348-29-0x0000000140000000-0x000000014040F000-memory.dmp

Filesize
4.1MB

Download
memory/2348-28-0x0000000140000000-0x000000014040F000-memory.dmp

Filesize
4.1MB

Download
memory/3448-59-0x0000000140000000-0x00000001402B3000-memory.dmp

Filesize
2.7MB

Download
memory/3448-37-0x0000000140000000-0x00000001402B3000-memory.dmp

Filesize
2.7MB

Download
memory/3448-36-0x0000000140000000-0x00000001402B3000-memory.dmp

Filesize
2.7MB

Download
memory/3956-117-0x0000000140000000-0x0000000140418000-memory.dmp

Filesize
4.1MB

Download
memory/3956-21-0x00000001400B2000-0x00000001400B3000-memory.dmp

Filesize
4KB

Download
memory/3956-20-0x0000000140000000-0x0000000140418000-memory.dmp

Filesize
4.1MB

Download