xtremerat | 8fc739fba82f000c0bb27db6abb8219bb5f29f36dc0d176d740beb178fca5dea

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
29-01-2025 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe
Size

73KB
MD5

575b96ec9b4804a85c93c1efbdaf3a07
SHA1

5b660efedac9fb706486b124b44772d5f4cf7c55
SHA256

8fc739fba82f000c0bb27db6abb8219bb5f29f36dc0d176d740beb178fca5dea
SHA512

d3c4218796edded5fc6ba1559af79b3c886a1cf09e76d3a7e5e9fa1ae2f80a71475f06c6e1a163fa769b33595350b4d2740ea3313368e4bdf21a49c4cd497b5d
SSDEEP

1536:bTxHaFqdW7weEwzJWSLwIZVcOzB2AziNNLS6M6Tzm:HxHaFqdW7weEwzJBZVcYB2uuS6MKm

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 6 IoCs

resource	yara_rule
behavioral1/memory/2380-61-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2380-69-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2380-74-0x00000000031F0000-0x00000000031FD000-memory.dmp	family_xtremerat
behavioral1/memory/2380-76-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1128-145-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1836-213-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Executes dropped EXE 48 IoCs

pid	Process
2628	Server.exe
1128	Server.exe
1916	Server.exe
1836	Server.exe
1536	Server.exe
2356	Server.exe
2816	Server.exe
2380	Server.exe
2700	Server.exe
1128	Server.exe
1824	Server.exe
2440	Server.exe
1716	Server.exe
2848	Server.exe
2492	Server.exe
1728	Server.exe
2088	Server.exe
768	Server.exe
2352	Server.exe
2784	Server.exe
2928	Server.exe
916	Server.exe
1468	Server.exe
2856	Server.exe
2816	Server.exe
2976	Server.exe
972	Server.exe
1376	Server.exe
1216	Server.exe
1296	Server.exe
1444	Server.exe
1400	Server.exe
2064	Server.exe
768	Server.exe
2180	Server.exe
564	Server.exe
1576	Server.exe
2836	Server.exe
1376	Server.exe
2356	Server.exe
2132	Server.exe
2644	Server.exe
1620	Server.exe
2132	Server.exe
2368	Server.exe
1520	Server.exe
2856	Server.exe
3308	Server.exe

Loads dropped DLL 3 IoCs

pid	Process
2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe
2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe
2628	Server.exe

Suspicious use of SetThreadContext 25 IoCs

description	pid	Process	procid_target
PID 2540 set thread context of 2380	2540	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	31
PID 2628 set thread context of 1128	2628	Server.exe	41
PID 1916 set thread context of 1836	1916	Server.exe	51
PID 1536 set thread context of 2356	1536	Server.exe	61
PID 2816 set thread context of 2380	2816	Server.exe	71
PID 2700 set thread context of 1128	2700	Server.exe	81
PID 1824 set thread context of 2440	1824	Server.exe	91
PID 1716 set thread context of 2848	1716	Server.exe	101
PID 2492 set thread context of 1728	2492	Server.exe	111
PID 2088 set thread context of 768	2088	Server.exe	121
PID 2352 set thread context of 2784	2352	Server.exe	131
PID 2928 set thread context of 916	2928	Server.exe	141
PID 1468 set thread context of 2856	1468	Server.exe	151
PID 2816 set thread context of 2976	2816	Server.exe	161
PID 972 set thread context of 1376	972	Server.exe	171
PID 1216 set thread context of 1296	1216	Server.exe	181
PID 1444 set thread context of 1400	1444	Server.exe	191
PID 2064 set thread context of 768	2064	Server.exe	201
PID 2180 set thread context of 564	2180	Server.exe	211
PID 1576 set thread context of 2836	1576	Server.exe	221
PID 1376 set thread context of 2356	1376	Server.exe	231
PID 2132 set thread context of 2644	2132	Server.exe	241
PID 1620 set thread context of 2132	1620	Server.exe	251
PID 2368 set thread context of 1520	2368	Server.exe	261
PID 2856 set thread context of 3308	2856	Server.exe	271

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2380-57-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2380-60-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2380-62-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2380-61-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2380-69-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2380-74-0x00000000031F0000-0x00000000031FD000-memory.dmp	upx
behavioral1/memory/2380-76-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1128-140-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1128-145-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1836-210-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1836-213-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File created	C:\Windows\InstallDir\Server.exe	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
2540	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe
2628	Server.exe
1916	Server.exe
1536	Server.exe
2816	Server.exe
2700	Server.exe
1824	Server.exe
1716	Server.exe
2492	Server.exe
2088	Server.exe
2352	Server.exe
2928	Server.exe
1468	Server.exe
2816	Server.exe
972	Server.exe
1216	Server.exe
1444	Server.exe
2064	Server.exe
2180	Server.exe
1576	Server.exe
1376	Server.exe
2132	Server.exe
1620	Server.exe
2368	Server.exe
2856	Server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2380	2540	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	31
PID 2540 wrote to memory of 2380	2540	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	31
PID 2540 wrote to memory of 2380	2540	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	31
PID 2540 wrote to memory of 2380	2540	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	31
PID 2540 wrote to memory of 2380	2540	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	31
PID 2540 wrote to memory of 2380	2540	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	31
PID 2540 wrote to memory of 2380	2540	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	31
PID 2540 wrote to memory of 2380	2540	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	31
PID 2540 wrote to memory of 2380	2540	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	31
PID 2380 wrote to memory of 2892	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	32
PID 2380 wrote to memory of 2892	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	32
PID 2380 wrote to memory of 2892	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	32
PID 2380 wrote to memory of 2892	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	32
PID 2380 wrote to memory of 2892	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	32
PID 2380 wrote to memory of 2812	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	33
PID 2380 wrote to memory of 2812	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	33
PID 2380 wrote to memory of 2812	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	33
PID 2380 wrote to memory of 2812	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	33
PID 2380 wrote to memory of 2812	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	33
PID 2380 wrote to memory of 3024	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	34
PID 2380 wrote to memory of 3024	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	34
PID 2380 wrote to memory of 3024	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	34
PID 2380 wrote to memory of 3024	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	34
PID 2380 wrote to memory of 3024	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	34
PID 2380 wrote to memory of 2720	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	35
PID 2380 wrote to memory of 2720	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	35
PID 2380 wrote to memory of 2720	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	35
PID 2380 wrote to memory of 2720	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	35
PID 2380 wrote to memory of 2720	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	35
PID 2380 wrote to memory of 2768	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	36
PID 2380 wrote to memory of 2768	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	36
PID 2380 wrote to memory of 2768	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	36
PID 2380 wrote to memory of 2768	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	36
PID 2380 wrote to memory of 2768	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	36
PID 2380 wrote to memory of 2868	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	37
PID 2380 wrote to memory of 2868	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	37
PID 2380 wrote to memory of 2868	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	37
PID 2380 wrote to memory of 2868	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	37
PID 2380 wrote to memory of 2868	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	37
PID 2380 wrote to memory of 1232	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	38
PID 2380 wrote to memory of 1232	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	38
PID 2380 wrote to memory of 1232	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	38
PID 2380 wrote to memory of 1232	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	38
PID 2380 wrote to memory of 1232	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	38
PID 2380 wrote to memory of 2744	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	39
PID 2380 wrote to memory of 2744	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	39
PID 2380 wrote to memory of 2744	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	39
PID 2380 wrote to memory of 2744	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	39
PID 2380 wrote to memory of 2628	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	40
PID 2380 wrote to memory of 2628	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	40
PID 2380 wrote to memory of 2628	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	40
PID 2380 wrote to memory of 2628	2380	JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe	40
PID 2628 wrote to memory of 1128	2628	Server.exe	41
PID 2628 wrote to memory of 1128	2628	Server.exe	41
PID 2628 wrote to memory of 1128	2628	Server.exe	41
PID 2628 wrote to memory of 1128	2628	Server.exe	41
PID 2628 wrote to memory of 1128	2628	Server.exe	41
PID 2628 wrote to memory of 1128	2628	Server.exe	41
PID 2628 wrote to memory of 1128	2628	Server.exe	41
PID 2628 wrote to memory of 1128	2628	Server.exe	41
PID 2628 wrote to memory of 1128	2628	Server.exe	41
PID 1128 wrote to memory of 1388	1128	Server.exe	42
PID 1128 wrote to memory of 1388	1128	Server.exe	42
PID 1128 wrote to memory of 1388	1128	Server.exe	42

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2892
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2812
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:3024
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2720
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2768
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2868
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:1232
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2744
- - C:\Windows\InstallDir\Server.exe
    "C:\Windows\InstallDir\Server.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1128
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1388
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2992
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2184
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2840
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:828
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:3000
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2984
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2212
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1916
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1836
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2044
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1764
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1656
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:900
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:336
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1528
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1068
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1488
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1536
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2548
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2544
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1700
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2036
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2560
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2016
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2292
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2932
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2816
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2380
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2280
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1144
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2396
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2472
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2156
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2372
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1104
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1572
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2700
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1128
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2160
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1944
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2196
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2312
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1660
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1368
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1204
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2504
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1824
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2440
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:1896
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2288
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:848
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2328
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2488
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:1912
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2448
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2304
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1716
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2848
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2468
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2668
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1688
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2688
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:112
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2580
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2636
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2748
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2492
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1728
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:1900
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:1884
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2096
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2388
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2080
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:1120
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:948
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:1828
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2088
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:768
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1372
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1768
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2440
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2316
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1328
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1524
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2384
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2284
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2352
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2784
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2112
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2704
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2960
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2536
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2964
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:1196
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:752
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:1172
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2928
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:916
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1020
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1916
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1684
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2832
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:956
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1292
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1704
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1552
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1468
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2856
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2756
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2736
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2568
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2900
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2052
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:3044
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2632
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2352
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2816
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2976
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2144
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2072
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1736
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1752
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1320
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1644
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1680
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:976
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:972
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1376
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2880
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2588
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:1716
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:1640
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:1464
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:1092
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2676
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2532
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1216
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1296
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:3064
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2200
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2608
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:1160
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:908
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:1968
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:1472
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2088
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1444
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1400
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2920
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2708
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2784
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:536
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:836
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2076
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2924
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2940
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2064
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:768
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2556
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2324
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2500
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2220
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2780
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2844
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:1468
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2540
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2180
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:564
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:1296
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2716
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:1532
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2464
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:1980
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:1536
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:1608
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:1604
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1576
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2836
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:568
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:3020
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:580
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:868
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:776
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1628
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2860
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:768
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1376
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2456
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2348
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2216
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:968
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2620
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2116
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2684
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:320
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2132
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2644
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:1652
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2808
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:1128
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:436
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2976
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2792
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2852
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:924
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2132
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:1728
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:1484
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:1216
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:1648
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:2180
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:2008
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:2836
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:672
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2368
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1520
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:1620
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:2336
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:2752
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:2424
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:2968
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3016
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:2816
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:2628
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        49⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2856
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3308
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3352
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3364
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3372
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lBu0Ct4bC.cfg

Filesize
1KB

MD5
d37f9483517d05a64eece28a35070923

SHA1
a1aeee2536d1bedcaaa9193fd8ac03429e283f3d

SHA256
40f3799229c84686c0450962d104f8aaf09ee61af1029a7b52c22218c992dc51

SHA512
2d4ffbeb50627b1c1f23214b96f629faf3efcd61da89ba4be3ccc473a54f1cf64c8471b689e1814f29c365de51c9fcc91d113282e5c1bc4190691c7c2f617a5a

Download Submit
\Windows\InstallDir\Server.exe

Filesize
73KB

MD5
575b96ec9b4804a85c93c1efbdaf3a07

SHA1
5b660efedac9fb706486b124b44772d5f4cf7c55

SHA256
8fc739fba82f000c0bb27db6abb8219bb5f29f36dc0d176d740beb178fca5dea

SHA512
d3c4218796edded5fc6ba1559af79b3c886a1cf09e76d3a7e5e9fa1ae2f80a71475f06c6e1a163fa769b33595350b4d2740ea3313368e4bdf21a49c4cd497b5d

Download Submit
memory/972-969-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1128-140-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1128-145-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1376-1347-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1444-1094-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1468-841-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1536-274-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1576-1283-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1716-525-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1836-213-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1836-210-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1916-207-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1916-147-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2088-652-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2180-1220-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2368-1535-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2380-76-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2380-57-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2380-74-0x00000000031F0000-0x00000000031FD000-memory.dmp

Filesize
52KB

Download
memory/2380-69-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2380-61-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2380-62-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2380-60-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2492-589-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2540-44-0x0000000002590000-0x00000000025A0000-memory.dmp

Filesize
64KB

Download
memory/2540-25-0x0000000000430000-0x0000000000440000-memory.dmp

Filesize
64KB

Download
memory/2540-28-0x0000000000460000-0x0000000000470000-memory.dmp

Filesize
64KB

Download
memory/2540-29-0x0000000000470000-0x0000000000480000-memory.dmp

Filesize
64KB

Download
memory/2540-30-0x0000000000480000-0x0000000000490000-memory.dmp

Filesize
64KB

Download
memory/2540-31-0x0000000000490000-0x00000000004A0000-memory.dmp

Filesize
64KB

Download
memory/2540-32-0x00000000004A0000-0x00000000004B0000-memory.dmp

Filesize
64KB

Download
memory/2540-33-0x00000000004B0000-0x00000000004C0000-memory.dmp

Filesize
64KB

Download
memory/2540-34-0x00000000004C0000-0x00000000004D0000-memory.dmp

Filesize
64KB

Download
memory/2540-35-0x00000000004E0000-0x00000000004F0000-memory.dmp

Filesize
64KB

Download
memory/2540-36-0x00000000004F0000-0x0000000000500000-memory.dmp

Filesize
64KB

Download
memory/2540-37-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2540-38-0x0000000000510000-0x0000000000520000-memory.dmp

Filesize
64KB

Download
memory/2540-39-0x0000000000520000-0x0000000000530000-memory.dmp

Filesize
64KB

Download
memory/2540-40-0x0000000002550000-0x0000000002560000-memory.dmp

Filesize
64KB

Download
memory/2540-41-0x0000000002560000-0x0000000002570000-memory.dmp

Filesize
64KB

Download
memory/2540-42-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/2540-43-0x0000000002580000-0x0000000002590000-memory.dmp

Filesize
64KB

Download
memory/2540-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2540-45-0x00000000025A0000-0x00000000025B0000-memory.dmp

Filesize
64KB

Download
memory/2540-46-0x00000000025B0000-0x00000000025C0000-memory.dmp

Filesize
64KB

Download
memory/2540-47-0x00000000025C0000-0x00000000025D0000-memory.dmp

Filesize
64KB

Download
memory/2540-48-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/2540-49-0x00000000025E0000-0x00000000025F0000-memory.dmp

Filesize
64KB

Download
memory/2540-50-0x0000000002630000-0x0000000002640000-memory.dmp

Filesize
64KB

Download
memory/2540-51-0x0000000002640000-0x0000000002650000-memory.dmp

Filesize
64KB

Download
memory/2540-52-0x0000000002650000-0x0000000002660000-memory.dmp

Filesize
64KB

Download
memory/2540-53-0x0000000002660000-0x0000000002670000-memory.dmp

Filesize
64KB

Download
memory/2540-54-0x0000000002670000-0x0000000002680000-memory.dmp

Filesize
64KB

Download
memory/2540-26-0x0000000000440000-0x0000000000450000-memory.dmp

Filesize
64KB

Download
memory/2540-58-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2540-27-0x0000000000450000-0x0000000000460000-memory.dmp

Filesize
64KB

Download
memory/2540-24-0x0000000000420000-0x0000000000430000-memory.dmp

Filesize
64KB

Download
memory/2540-23-0x0000000000410000-0x0000000000420000-memory.dmp

Filesize
64KB

Download
memory/2540-22-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2540-11-0x00000000002C0000-0x00000000002D0000-memory.dmp

Filesize
64KB

Download
memory/2540-12-0x00000000002D0000-0x00000000002E0000-memory.dmp

Filesize
64KB

Download
memory/2540-13-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/2540-2-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/2540-3-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/2540-1-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2540-14-0x0000000000370000-0x0000000000380000-memory.dmp

Filesize
64KB

Download
memory/2540-15-0x0000000000380000-0x0000000000390000-memory.dmp

Filesize
64KB

Download
memory/2540-17-0x00000000003A0000-0x00000000003B0000-memory.dmp

Filesize
64KB

Download
memory/2540-18-0x00000000003B0000-0x00000000003C0000-memory.dmp

Filesize
64KB

Download
memory/2540-19-0x00000000003C0000-0x00000000003D0000-memory.dmp

Filesize
64KB

Download
memory/2540-21-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/2540-20-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/2540-16-0x0000000000390000-0x00000000003A0000-memory.dmp

Filesize
64KB

Download
memory/2540-9-0x00000000002A0000-0x00000000002B0000-memory.dmp

Filesize
64KB

Download
memory/2540-8-0x0000000000290000-0x00000000002A0000-memory.dmp

Filesize
64KB

Download
memory/2540-4-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/2540-5-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/2540-6-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download
memory/2540-7-0x0000000000280000-0x0000000000290000-memory.dmp

Filesize
64KB

Download
memory/2540-10-0x00000000002B0000-0x00000000002C0000-memory.dmp

Filesize
64KB

Download
memory/2628-138-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2628-82-0x00000000002B0000-0x00000000002C0000-memory.dmp

Filesize
64KB

Download
memory/2628-81-0x00000000002A0000-0x00000000002B0000-memory.dmp

Filesize
64KB

Download
memory/2700-401-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2816-904-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2816-336-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download