expiro | 8c03c5e1a08e28b3e57c6d109739c452ce95c68703497681ed85de7ea82df6fe

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2025 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
Size

625KB
MD5

9ecd412f605a3e0e5e659d3b4f8f01b4
SHA1

aff493179d0ce163d58ad38a83f8ed8ac4a14d70
SHA256

8c03c5e1a08e28b3e57c6d109739c452ce95c68703497681ed85de7ea82df6fe
SHA512

ab78b29480199cd2bd3497f4d11138fb218f3c0fbbe416acb1e2b66c09642eadf055898004ad054316028395b38e1ddeff6f07eb5f975c54a48b4a9f67996a2b
SSDEEP

12288:fVt+w8wyv/G66WoJMZZWj8E2wYRTrYYQKQ:Nt+w5yWDJoWj8hNV

Score

10^/10

expiro backdoor discovery evasion trojan

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 5 IoCs

backdoor

resource	yara_rule
behavioral1/memory/1756-0-0x00000000004BC000-0x000000000054F000-memory.dmp	family_expiro1
behavioral1/memory/1756-1-0x0000000000400000-0x000000000054F000-memory.dmp	family_expiro1
behavioral1/memory/1756-3-0x0000000000400000-0x000000000054F000-memory.dmp	family_expiro1
behavioral1/memory/1756-48-0x00000000004BC000-0x000000000054F000-memory.dmp	family_expiro1
behavioral1/memory/1756-56-0x0000000000400000-0x000000000054F000-memory.dmp	family_expiro1

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 9 IoCs

pid	Process
1480	alg.exe
1556	DiagnosticsHub.StandardCollector.Service.exe
2248	fxssvc.exe
4160	elevation_service.exe
4180	elevation_service.exe
2336	maintenanceservice.exe
4772	msdtc.exe
2412	msiexec.exe
1728	TrustedInstaller.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3442511616-637977696-3186306149-1000	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3442511616-637977696-3186306149-1000\EnableNotifications = "0"	alg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\M:	alg.exe
File opened (read-only)	\??\N:	alg.exe
File opened (read-only)	\??\Q:	alg.exe
File opened (read-only)	\??\K:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\S:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\T:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\X:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\H:	alg.exe
File opened (read-only)	\??\Y:	alg.exe
File opened (read-only)	\??\Z:	alg.exe
File opened (read-only)	\??\N:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\O:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\G:	alg.exe
File opened (read-only)	\??\R:	alg.exe
File opened (read-only)	\??\H:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\I:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\R:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\E:	alg.exe
File opened (read-only)	\??\K:	alg.exe
File opened (read-only)	\??\U:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\V:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\W:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\S:	alg.exe
File opened (read-only)	\??\T:	alg.exe
File opened (read-only)	\??\V:	alg.exe
File opened (read-only)	\??\G:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\M:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\E:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\J:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\L:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\I:	alg.exe
File opened (read-only)	\??\J:	alg.exe
File opened (read-only)	\??\L:	alg.exe
File opened (read-only)	\??\U:	alg.exe
File opened (read-only)	\??\X:	alg.exe
File opened (read-only)	\??\O:	alg.exe
File opened (read-only)	\??\P:	alg.exe
File opened (read-only)	\??\W:	alg.exe
File opened (read-only)	\??\P:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\Q:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened (read-only)	\??\Y:	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\njlpceih.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\windows\system32\nknnmfja.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\windows\system32\gmaacjmn.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	alg.exe
File opened for modification	\??\c:\windows\system32\locator.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\windows\system32\ojoadhpg.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\SysWOW64\openssh\ssh-agent.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\system32\alg.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\SysWOW64\Appvclient.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\windows\system32\pnnofjee.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\system32\locator.exe	alg.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	alg.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\windows\system32\perceptionsimulation\pgiddjdo.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\SysWOW64\spectrum.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\windows\system32\diagsvcs\jpocbonf.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\SysWOW64\sensordataservice.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\windows\system32\jadhkoob.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\SysWOW64\tieringengineservice.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\system32\vds.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\windows\SysWOW64\lqjpfpdd.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\windows\system32\mjmhcibe.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\SysWOW64\Agentservice.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\windows\SysWOW64\gbmlkfid.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\windows\system32\emdnjqaf.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	alg.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	alg.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\windows\system32\WindowsPowerShell\v1.0\eekngbfi.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\windows\SysWOW64\mnllcimq.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\windows\system32\phapelhb.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\SysWOW64\sgrmbroker.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\windows\SysWOW64\dinblfef.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	alg.exe
File created	\??\c:\windows\system32\bekiclbl.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\windows\system32\nodfiloa.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	alg.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	alg.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	alg.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	alg.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	alg.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\pgildlkb.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\program files\google\chrome\Application\123.0.6312.123\elevation_service.exe	alg.exe
File created	C:\Program Files\7-Zip\gkooamha.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\lbhckibj.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\olemadei.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\source engine\ose.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	C:\Program Files\Internet Explorer\kjkookie.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\program files\google\chrome\Application\123.0.6312.123\elevation_service.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ifpcoece.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\papfoeie.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	C:\Program Files\7-Zip\nccafaqk.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\onbaidqf.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\lgamkbac.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\jmofaklb.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\mnmjadqg.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\occlljkq.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\program files\windows media player\jmloepad.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\nkhpbini.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	alg.exe
File created	C:\Program Files\Internet Explorer\hfoijjjp.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jipjcfed.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\program files\common files\microsoft shared\source engine\ggibochf.tmp	alg.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\mgecidfd.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ekchdkjb.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	C:\Program Files\dotnet\ddnfppgh.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\jkgaipki.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\program files\google\chrome\Application\123.0.6312.123\gjfjpnfa.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\llkohemg.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\miqfjfol.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\dddilmae.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clmaedbq.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\iilmmhmc.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	alg.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	alg.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	\??\c:\windows\servicing\gbmaeomg.tmp	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
File created	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe
1480	alg.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1756	JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
Token: SeAuditPrivilege	2248	fxssvc.exe
Token: SeTakeOwnershipPrivilege	1480	alg.exe
Token: SeSecurityPrivilege	2412	msiexec.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	alg.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9ecd412f605a3e0e5e659d3b4f8f01b4.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1480

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4300

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2248

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4180

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2336

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4772

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2412

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
1.9MB

MD5
bb6fe4bf576b30dc13ac2314e95ccdc5

SHA1
e93db6e99bd8ffa098ba0bdac9ed1313f3fed3c7

SHA256
678d2986ce058ef5db14ee89d087530b5b0bfb3c861df9248250c21b7f2d493c

SHA512
193d706ce107ef694078df4d0174983e4e71629d287a3a42abfd6d1883fe55532cb5edfb4e38938a46b4550a33f051fe17584bfb06a349dc34aa41c54567f4af

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
621KB

MD5
b1fde5c39ebfa605e47e914e4d7b83b2

SHA1
9075556297ebe5064ad04b6a75da0b3ce0a2f600

SHA256
a1c9513f4e357aa3752f564029a92fad6f223829deb90c9cb4d09a94bc520d08

SHA512
95730ecca07ab1d62a7e6e5db209021b1d655a37cc81a318da3ed7acc18d3c7acf744cccbffe26642ef2b2717adc6315d7bb301c2c61efd03299df868b444ced

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
940KB

MD5
669b18d7e00cbdd7f86d401467dd1e79

SHA1
961ed652e5894b1b8972ad91f460164262d4a7dc

SHA256
e75f48a67738cc2eb4e106c027cc8e3fb304e7d3558a801f1fa1d54186645bab

SHA512
e16243deb9151a1711c6583ef6d1679d48d07c7c121a18d637e068d8518b6a81c530e5b61d2efd839c03bda278285cb312450859985c6dca9e6348cec60b27f1

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.3MB

MD5
a21cfa56a9b099ba4c8b3f8b76b8fd82

SHA1
b1de5924aa72ac8c6ae29c02f557e995f1e110a4

SHA256
a7e58fd22769a6fba63ccb069c7386e4f95b8459749be0fbd6353b3835b75f07

SHA512
45712055515aedcfd9670bbd629486233b762c0448d1a82ac034823fc3056b4ad172ea8e9d27703cdaf2953770751927ca6392bfb6ffe05416098634f1db8ef8

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.1MB

MD5
9abeb586bda66450d9dc0e6339196fcd

SHA1
8171e51662ebe745366bc3eb49de60ef9bb00802

SHA256
1ea217d23199121914fb7353a6b16890bb2c3227db7e6293c8adfb7176f99f97

SHA512
d10c74fa1169685e80b834eda619c7a13514733df5c9502e01300f738d82e91e00db8b007a4ecdffcee92a92bc922737af3ccbc16a6046d1f016491a19bb1368

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
410KB

MD5
c449c106910d57b5b809fe31d8a35cd7

SHA1
8c974573841306632ed0d2700e3c888acae870fe

SHA256
5eb07cbc130d1e53cf03a06e14deae0c3aca802337d21ca7e90a15b593096153

SHA512
1e9be9368c220f4b9993b1922561074f9d64090086ddc5bd1c0a7e9c7e3802db9398badbd7171022f72241a2866bfa17ba421f27fc2904d28be466174c9b8144

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
672KB

MD5
5365fa406d711393dedf28dc60176c7f

SHA1
7fca5f00ea549b4e6e8a142ca9ec5978a7bba207

SHA256
488fe34265f04a8de8bdc60c0853d4a5dee7b5d44654d0e11d8db4a5cd1bac15

SHA512
821052a0f9f7e477170b1d3a36821dd353dfba296f1763714a5ac4b07d3e97bb0c682730faca3d78e1490b4db0c83d8af669d3715053f457b1cd683ee80e22f3

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.5MB

MD5
ea45e01f605f327cf2772a9eb6f080bc

SHA1
afeea69e714810040bc3431f638691cdddbafee3

SHA256
317ee219c367fa6e8ac1fb91c8d8ff0433c7f83e0d4cda722d2d145ef24ebe13

SHA512
937d6a0ad3f0272a4dbb3b6f6ce315337653a61e317271484a4116c226fa58b2287f899ff03af8853664e156dbc87ef32e70c530a5bd6acc88a30ccb74632931

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
738KB

MD5
931d1981051faf0445def9733fbf532a

SHA1
89cd3ff3e627306237a550bc00c3907c4a6c2fe7

SHA256
ee61b0727c2a0523e8b0ead757d8847986d89a25d39bcdd3a6ea826fe88afb74

SHA512
2d945357a0bbdf510b202850456c0fb4294cce59a940ddfb827982d18da3e4c0b8d824a34c982b2c3c6be30639c32ef9cf2f9be49e2ad7c9d28177bad9756d11

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
23.8MB

MD5
84238632e65665af92c79837e40cf143

SHA1
b994c83ee6263b4f9264ce4adfcaff9c33ebcc7a

SHA256
4501c322e6dd5ec1710d8f8029ca9b0793b16fc1aa3c0c020ff8df448b7d73e5

SHA512
123db3415e4643620cdf12c695ba3ddefd95054f80ae68576cd74eade908795030644a98892b07b295dc812fda46694cc7c03b70d35d68bceb03a745a4132780

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.5MB

MD5
7c27b1f5e1632ab5ad7d1e84e0e69b0d

SHA1
33d1514fe23d5439429f66a39e7af0f0863ed8b6

SHA256
c55b660507cf3344ef4751e7873e7de5097aa4ce1d14db066ace043158dbb638

SHA512
7bf21f9532d2e07a687d42c0c7c13cc5bd33158eaf68fe86064061db79d3e219e87689831fc57577fa40e65a6168e3aadafdd2c7d3e09a6845dc85aa2960e50c

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\ggibochf.tmp

Filesize
637KB

MD5
518d60073667aaf7fb10f74fe692141e

SHA1
5b190eed0ee8e2477965888794e851a5a7eae9b1

SHA256
da51600a77eb2fca01582a1f5991231f25c4b5229d1699fe9d09da072f346919

SHA512
74d68fa833e1101e77be3dde4263d5b9e94a908d6267163b6c139b7e8d7edf9a8e90ba1f0e1c0f6bcbbedfc9cb18b08b5d854522653fb26e688715576658c2ce

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

Filesize
2.0MB

MD5
33af68089d289cf996e86a40818885bd

SHA1
6d3eed363eb0490186ad096fb95ff2ce18009af9

SHA256
603fd46a45ebd98c9ec811897d4d6fa4368970d6d23c44d65b71ce5e1798c855

SHA512
bb38685d17fb20b8da8dd52cd150cad5a005987e2810e2517a7bcd4c367922fda0c8ecaf856d02d01ddafa50a56c0371db6abc8606cc31bebf79a241b7631272

Download Submit
C:\Users\Admin\AppData\Local\kbkknajm\lkpqcmbp.tmp

Filesize
625KB

MD5
955a5b61ec1847e06ddd539c9ecf396f

SHA1
28230096829beb859ba40daeeed0197c70af4b29

SHA256
24ecbf4b5d5a251c85c9bb8000bd477448348aa451bc4f97cc545506f3c2c6d9

SHA512
0be405292c40f6c3d0b13e72529c6a5cddcfe46f503ce53fd139ee670b8472b57721845f1df8e61a19e8943ee5c2a54ff1d9c2eaa529a89778740b9af376da8b

Download Submit
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Filesize
818KB

MD5
a093934ff89d81f1cb26c3d27d920da1

SHA1
f783153f4e98bebae92e0b65d07f5528cb1f5b2f

SHA256
fef254fe35d7975e5e2b98d309767daa39f9301a8238eed552000e99da001a2b

SHA512
d501a10f570770e03130f33a0807e93193e7d4e7355c9936a875103942ec7a30813a091c07572ce5befe05fce4c59b7db1cd38716985443be175a810f47e437d

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
487KB

MD5
eac68c0cc053ff062949c4285bd6eb43

SHA1
574cbf694175657c75d3b5ac1dfb91c1c3e20874

SHA256
c268560d55a1a8bfc80338aaac28f11e42d5adb7af55ea47f6717da1cb3ef45f

SHA512
8c520d6635e8e95ac09ceb69af2968a0c9eb9c0fde6e0ddb558333725242387ff9a5985f153d92107658ccfa448183a66555b4e17e9442a94dd00b3809f2858d

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.0MB

MD5
e47aa53c54ae2abde269a70ee8c4891c

SHA1
b60bace3f34932e7e5b617dfd14d724a4c87773a

SHA256
2b613191e3f383dfd28e5b7250216a2779b52a9360237931cc1599121954fb0d

SHA512
5d4f254da24ff39c7b376f4f7e8d56567c26a05c94e46abe188121522eb35f5936039af9a5191fcdd0b5109b15204cf33978d79fbc43b7b826e1bad66f333bd0

Download Submit
C:\Windows\System32\alg.exe

Filesize
489KB

MD5
dedf3f0faef6006063c92a72b4bd7727

SHA1
db696aaad8fd8ef0467475b919c6272ba6adf3f0

SHA256
18747656b42e19d1c5f44f13dbd8574d36ccae4dc430091b1ccbb29f00cf2209

SHA512
f2b3e63830f77c03c2a0e3a572618a2f76f8134e7982642d082cbdda8b25ad5443d82b780dd413808433a1e6f4e8d4fe0badf7b3eff475728517b5ed28b8bca9

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
540KB

MD5
4a325f5b4d238465fbe9c8faa9ec2719

SHA1
53ef9a9d427317bc67a91abb242b4c96363788e0

SHA256
a3637993024348265a27818e876a805fe949f91db937095356e3052aa54e6ac8

SHA512
1a6287114a2cfbaca7ab1050de97b9a560260bd66232fc97c16434ea4461c5c4f18c02e96da249fe9e84772cef4e87d878a122c5292000390025e2997f420b0f

Download Submit
C:\Windows\servicing\TrustedInstaller.exe

Filesize
193KB

MD5
805418acd5280e97074bdadca4d95195

SHA1
a69e4f03d775a7a0cc5ed2d5569cbfbb4d31d2d6

SHA256
73684e31ad4afe3fdc525b51ccaacc14d402c92db9c42e3fcbfe1e65524b1c01

SHA512
630a255950c0ae0983ae907d20326adea36ce262c7784428a0811b04726849c929bc9cea338a89e77447a6cec30b0889694158327c002566d3cf5be2bb88e4de

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
463KB

MD5
b0a651967e353875e811f4a0bc8c887f

SHA1
8a4e7792f515bd333dbd70d6eb9a825a87ca5614

SHA256
7234377ed80bb8a2e9288ebd19474b32c40c0f15360e3060f8af637939121785

SHA512
7577d66479edacd79fa66e7b125039fd669a32175b2b0c2297990f30385d4038c9d5c6b3e393fe321f242ed9781cf45059c386c23635cafb8740ae51b60dc231

Download Submit
\??\c:\windows\system32\Appvclient.exe

Filesize
1.1MB

MD5
af364187afdd1681bc4dd906518ccbad

SHA1
7a9d7b37f529bda9a2f94269514f883405cf5353

SHA256
2eed26b0337f403bba5e10f71646162e9d19f164b5639ea5a53b49a1ec1bbf80

SHA512
ee80a11826376c7f058d07f886a9d84489a43f0ea9b4be73579124c2ede9f17e2e3b359d6392229442dd6f04def5550d03aea7ff782bb3e7fc60792c377a4101

Download Submit
memory/1480-65-0x000000014000D000-0x000000014001C000-memory.dmp

Filesize
60KB

Download
memory/1480-63-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/1480-23-0x000000014000D000-0x000000014001C000-memory.dmp

Filesize
60KB

Download
memory/1556-40-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/1556-80-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/1756-48-0x00000000004BC000-0x000000000054F000-memory.dmp

Filesize
588KB

Download
memory/1756-0-0x00000000004BC000-0x000000000054F000-memory.dmp

Filesize
588KB

Download
memory/1756-56-0x0000000000400000-0x000000000054F000-memory.dmp

Filesize
1.3MB

Download
memory/1756-3-0x0000000000400000-0x000000000054F000-memory.dmp

Filesize
1.3MB

Download
memory/1756-1-0x0000000000400000-0x000000000054F000-memory.dmp

Filesize
1.3MB

Download
memory/2248-47-0x0000000140000000-0x00000001401C2000-memory.dmp

Filesize
1.8MB

Download
memory/2248-49-0x0000000140000000-0x00000001401C2000-memory.dmp

Filesize
1.8MB

Download