cryptbot | 3fb79cd293ce64dcfd20d84df6db2d3c67869cde656bcbad684bb773f76c298f

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe
Size

4.3MB
MD5

2239fcbdac9582e1a379dc39ca1e4dd1
SHA1

9f3b3a7126144c2e3195d073f385c34fa82cfb6b
SHA256

3fb79cd293ce64dcfd20d84df6db2d3c67869cde656bcbad684bb773f76c298f
SHA512

994688df44661ad342c97757212487cc30fe3a1241e1e05ad15f44a393d53f9bd8173cfbaf143c17c297eea6a052afe900c2199c3385abf636ac3f2aa0b5ee97
SSDEEP

98304:EJyh2DzSgTbg52T41Ahxo2DvzQ/LwqDVNzsgeIXS3HWbNYS1HGO5AUMW4kmw:EgDWq2s8xocE/Lxno1n2bNYS1HtAZW4S

Score

10^/10

cryptbot discovery evasion spyware stealer

Malware Config

Extracted

Family

cryptbot

cede04.info

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Setup.exeSetupres.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup.exe
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setupres.exe
Blocklisted process makes network request 5 IoCs

Processes:

CScript.exe

flow pid process

8 1260 CScript.exe
11 1260 CScript.exe
13 1260 CScript.exe
15 1260 CScript.exe
17 1260 CScript.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Setupres.exe

flow	pid	process
8	1260	CScript.exe
11	1260	CScript.exe
13	1260	CScript.exe
15	1260	CScript.exe
17	1260	CScript.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setupres.exeSetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Setupres.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Setupres.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Setup.exe

Executes dropped EXE 2 IoCs

Processes:

Setup.exeSetupres.exe

pid process

2820 Setup.exe
1908 Setupres.exe

pid	process
2820	Setup.exe
1908	Setupres.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

Setup.exeSetupres.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Wine	Setup.exe
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Wine	Setupres.exe

Loads dropped DLL 8 IoCs

Processes:

2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exeSetup.exeSetupres.exe

pid	process
2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe
2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe
2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe
2820	Setup.exe
2820	Setup.exe
2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe
1908	Setupres.exe
1908	Setupres.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

8 iplogger.org
20 bitbucket.org
21 bitbucket.org
42 bitbucket.org
3 iplogger.org
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Setup.exeSetupres.exe

pid process

2820 Setup.exe
1908 Setupres.exe

flow	ioc
8	iplogger.org
20	bitbucket.org
21	bitbucket.org
42	bitbucket.org
3	iplogger.org

flow	ioc
6	ip-api.com

pid	process
2820	Setup.exe
1908	Setupres.exe

Drops file in Program Files directory 3 IoCs

Processes:

2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files (x86)\Sir\Air\Setup.exe	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe
File created	C:\Program Files (x86)\Sir\Air\Setupres.exe	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe
File created	C:\Program Files (x86)\Sir\Air\ipras.vbs	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Setup.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

CScript.exeSetupres.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	CScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Setupres.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	CScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	CScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	CScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	CScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Setupres.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Setupres.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Setupres.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	CScript.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setup.exeSetupres.exe

pid process

2820 Setup.exe
1908 Setupres.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

CScript.exe

description pid process

Token: SeRestorePrivilege 1260 CScript.exe
Token: SeBackupPrivilege 1260 CScript.exe
Suspicious use of FindShellTrayWindow 12 IoCs

Processes:

Setup.exe

pid process

2820 Setup.exe
2820 Setup.exe
2820 Setup.exe
2820 Setup.exe
2820 Setup.exe
2820 Setup.exe
2820 Setup.exe
2820 Setup.exe
2820 Setup.exe
2820 Setup.exe
2820 Setup.exe
2820 Setup.exe

pid	process
2820	Setup.exe
1908	Setupres.exe

description	pid	process
Token: SeRestorePrivilege	1260	CScript.exe
Token: SeBackupPrivilege	1260	CScript.exe

pid	process
2820	Setup.exe
2820	Setup.exe
2820	Setup.exe
2820	Setup.exe
2820	Setup.exe
2820	Setup.exe
2820	Setup.exe
2820	Setup.exe
2820	Setup.exe
2820	Setup.exe
2820	Setup.exe
2820	Setup.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe

description	pid	process	target process
PID 2944 wrote to memory of 2820	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	Setup.exe
PID 2944 wrote to memory of 2820	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	Setup.exe
PID 2944 wrote to memory of 2820	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	Setup.exe
PID 2944 wrote to memory of 2820	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	Setup.exe
PID 2944 wrote to memory of 2820	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	Setup.exe
PID 2944 wrote to memory of 2820	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	Setup.exe
PID 2944 wrote to memory of 2820	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	Setup.exe
PID 2944 wrote to memory of 1260	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	CScript.exe
PID 2944 wrote to memory of 1260	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	CScript.exe
PID 2944 wrote to memory of 1260	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	CScript.exe
PID 2944 wrote to memory of 1260	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	CScript.exe
PID 2944 wrote to memory of 1260	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	CScript.exe
PID 2944 wrote to memory of 1260	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	CScript.exe
PID 2944 wrote to memory of 1260	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	CScript.exe
PID 2944 wrote to memory of 1908	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	Setupres.exe
PID 2944 wrote to memory of 1908	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	Setupres.exe
PID 2944 wrote to memory of 1908	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	Setupres.exe
PID 2944 wrote to memory of 1908	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	Setupres.exe
PID 2944 wrote to memory of 1908	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	Setupres.exe
PID 2944 wrote to memory of 1908	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	Setupres.exe
PID 2944 wrote to memory of 1908	2944	2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe	Setupres.exe

C:\Users\Admin\AppData\Local\Temp\2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2944

C:\Program Files (x86)\Sir\Air\Setup.exe
"C:\Program Files (x86)\Sir\Air\Setup.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2820

C:\Windows\SysWOW64\CScript.exe
"C:\Windows\system32\CScript.exe" "C:\Program Files (x86)\Sir\Air\ipras.vbs" //e:vbscript //B //NOLOGO
2⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1260

C:\Program Files (x86)\Sir\Air\Setupres.exe
"C:\Program Files (x86)\Sir\Air\Setupres.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1908

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Sir\Air\ipras.vbs
Filesize
126B

MD5
b802ff9244875f69db2fae0f78e92b10

SHA1
49385a89cd575894a29fbda969b99cc1f5cf8076

SHA256
a1b0cb16fb2ecd66fccf156024404801ad694056e8a596326c1b27b57d8eabe8

SHA512
609856415a7ae2b3e260f945f1c8a8d2a28884c202d37181bea948708918f24b42ae03f17dba1520fddc91b2f7a182b0b8f885f33ea6f81bb3ee4c72e4e9350e

Download Submit
C:\ProgramData\JYb3hILh\47283761.txt
Filesize
156B

MD5
b5089e0c5a3d5377e9bd19c0557ef04e

SHA1
9402e326be3d240e234c06892b15c24e93c93eb8

SHA256
d77789b2c49759c882f4fdd6f53e665b0d012f8f0949d0150eaba47fbf2a0eb5

SHA512
942349ccb99854f274ef1e20b623660588e15bd0d25bfc817fe9b2d010db656af340652e0e67b41edbf0cf259d55ab880d6b50acb1d7e8ab394f1393f7956c13

Download Submit
C:\ProgramData\JYb3hILh\Files\_Info.txt
Filesize
1KB

MD5
16b306899789fc86b70f0793b8f0cdda

SHA1
49c42740d9f039d1d8b69320aeb7f162c2424faf

SHA256
3d1dd470667089fc0900d98a871a41bdc68173ebfa46508a9068a0f997b07c0b

SHA512
9662b4b35f1ddd7bd065335bf85b82a1b3b069ed32c553d564be8c10ac66c5943734593303c43c21c3ca28278c41db027a5d68c21cc3f171b9c540e95b0d4a2a

Download Submit
C:\ProgramData\JYb3hILh\hn1rO5rIJg.zip
Filesize
41KB

MD5
6b9639e0a705e0aef2c92208a66756c7

SHA1
13e1a5a42231c6e93909f3299abdeb3c53ab40c0

SHA256
93af80383b308592ecf5d11d1a060cb3aefe82d8ad27c7c152a7535e1973a193

SHA512
2ee6a00dadc2af3bb7847f32bcd730d88097382ab48894f006347956186ab3538c0383de33d2dd9ea2bf64267d13f3399cc039bb641f5ebc369bec8fa59eaa5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e4d35587de75fd78267fc8faafb3499d

SHA1
d069030afd6dc33e0b5c5adb19391cef1d147eea

SHA256
c126c7e50e1f07d016d8fccd49429f6621133a4968af40f1a9ab29cb25a72528

SHA512
3795817e4cec5572161e327357b2e5f610fd6228ecf7f5207fef08ac8fc76a1dbf4bd6f5da1d245a9c8fbba8e4b297ce50e5fe931537afd2d2d3b943819aac9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ceec69e43108de6306a7c5d47324085b

SHA1
5760760db2cb613bbe18fc3d48ab21ebc0693a9c

SHA256
1fadb68b0353eedb636b9abcd4c404d7e25c7485ef62f4cb2cd47f85967e2ff0

SHA512
b7a0e4792ee47433202522c05ce81d73be284572dabd8430c5fd89f78b53db6488af95f010b4356f6fb096c59174841de650252c7363170f00e45550edcf1991

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2712.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar27A2.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Program Files (x86)\Sir\Air\Setup.exe
Filesize
2.2MB

MD5
41af7998ebb519e0a0ca9635a865be5d

SHA1
68a7613a8d4483efb67f3794c245420e0daf2f95

SHA256
f05dc2ebf5bebbe40f1698489b873adcbefa41c98afe544fa04fd1ded91c9189

SHA512
31af03c31f0568ae57aab30c3d320a5505f3106ffd02c19b9bb5c740f76af332b27d929fca715029bfd49f2a0f404643616f0f88ab4f115693949688112ac5bb

Download Submit
\Program Files (x86)\Sir\Air\Setupres.exe
Filesize
2.0MB

MD5
b00f36abdbc0edb4729ae72ed388e965

SHA1
a1bf243bda51006cf4c8b9ee1fdcffb206058973

SHA256
5e64432c3afc95cfda49aa9479fd66efb8d7ef9812a2acb3fa9a0f536a2e5db9

SHA512
8dd8e5d9d6ad4a5515ae178f27e4878ddab3b8cf8786177cac91719517a959fba30cc7d93eb0eff9d1d71d097dbbdf07684fd8b077e144927079db8b8d1f5bb3

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1E99.tmp\UAC.dll
Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1E99.tmp\nsExec.dll
Filesize
6KB

MD5
132e6153717a7f9710dcea4536f364cd

SHA1
e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

SHA256
d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

SHA512
9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

Download Submit
memory/1908-159-0x0000000000400000-0x000000000091E000-memory.dmp

Filesize
5.1MB

Download
memory/1908-235-0x0000000000400000-0x000000000091E000-memory.dmp

Filesize
5.1MB

Download
memory/1908-256-0x0000000000400000-0x000000000091E000-memory.dmp

Filesize
5.1MB

Download
memory/1908-145-0x0000000001290000-0x00000000017AE000-memory.dmp

Filesize
5.1MB

Download
memory/1908-146-0x0000000001290000-0x00000000017AE000-memory.dmp

Filesize
5.1MB

Download
memory/1908-147-0x0000000000400000-0x000000000091E000-memory.dmp

Filesize
5.1MB

Download
memory/1908-252-0x0000000000400000-0x000000000091E000-memory.dmp

Filesize
5.1MB

Download
memory/1908-150-0x0000000000400000-0x000000000091E000-memory.dmp

Filesize
5.1MB

Download
memory/1908-249-0x0000000000400000-0x000000000091E000-memory.dmp

Filesize
5.1MB

Download
memory/1908-242-0x0000000000400000-0x000000000091E000-memory.dmp

Filesize
5.1MB

Download
memory/1908-238-0x0000000000400000-0x000000000091E000-memory.dmp

Filesize
5.1MB

Download
memory/1908-228-0x0000000000400000-0x000000000091E000-memory.dmp

Filesize
5.1MB

Download
memory/1908-225-0x0000000000400000-0x000000000091E000-memory.dmp

Filesize
5.1MB

Download
memory/1908-222-0x0000000000400000-0x000000000091E000-memory.dmp

Filesize
5.1MB

Download
memory/1908-219-0x0000000000400000-0x000000000091E000-memory.dmp

Filesize
5.1MB

Download
memory/1908-215-0x0000000000400000-0x000000000091E000-memory.dmp

Filesize
5.1MB

Download
memory/1908-160-0x0000000001290000-0x00000000017AE000-memory.dmp

Filesize
5.1MB

Download
memory/1908-212-0x0000000000400000-0x000000000091E000-memory.dmp

Filesize
5.1MB

Download
memory/2820-233-0x0000000000E90000-0x00000000013AB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-149-0x0000000000E90000-0x00000000013AB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-214-0x0000000000E90000-0x00000000013AB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-21-0x0000000000E90000-0x00000000013AB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-217-0x0000000000E90000-0x00000000013AB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-22-0x00000000013B0000-0x00000000018CB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-221-0x0000000000E90000-0x00000000013AB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-227-0x0000000000E90000-0x00000000013AB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-224-0x0000000000E90000-0x00000000013AB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-156-0x0000000000E90000-0x00000000013AB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-254-0x0000000000E90000-0x00000000013AB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-155-0x00000000013B0000-0x00000000018CB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-237-0x0000000000E90000-0x00000000013AB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-23-0x00000000013B0000-0x00000000018CB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-210-0x0000000000E90000-0x00000000013AB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-154-0x00000000013B0000-0x00000000018CB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-240-0x0000000000E90000-0x00000000013AB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-152-0x0000000000E90000-0x00000000013AB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-244-0x0000000000E90000-0x00000000013AB000-memory.dmp

Filesize
5.1MB

Download
memory/2820-251-0x0000000000E90000-0x00000000013AB000-memory.dmp

Filesize
5.1MB

Download
memory/2944-151-0x0000000002FB0000-0x00000000034CB000-memory.dmp

Filesize
5.1MB

Download
memory/2944-10-0x0000000002FB0000-0x00000000034CB000-memory.dmp

Filesize
5.1MB

Download
memory/2944-144-0x0000000002FB0000-0x00000000034CE000-memory.dmp

Filesize
5.1MB

Download
memory/2944-157-0x0000000002FB0000-0x00000000034CE000-memory.dmp

Filesize
5.1MB

Download