modiloader | a6fc491d6d097332f35d3ffaa4a31ecafd1b114cdccee11f627e3bde36a7bfd3

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2022, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6fc491d6d097332f35d3ffaa4a31ecafd1b114cdccee.exe
Size 276KB
Sample221010-raznlsccaq
SHA256 a6fc491d6d097332f35d3ffaa4a31ecafd1b114cdccee11f627e3bde36a7bfd3
MD5 b6d9559fac6dea0c0ec5dfa25892b9ab
SHA1 24385a774a29ed69987f21685638e45fa323cfa4
SHA512 c7c54ea9b16542228608b334753f66146c2dc7ee731bc87fbcc800157c8edb3bfef4bf1bd3198a2362506fb736ad3e7b161490ef0b7b92f8a7a132a1928a7495
SSDEEP 3072:GXrc/v6fClgWsH44fCG5bGs2DRRlHJLSvpm4UeeLHD9K4yOy8M/h3qpZa9uD6Vdz:uQX66lxDkxSRTHwvdUe0iORrwVfquS2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader smokeloader backdoor discovery spyware stealer trojan

Malware Config

Signatures

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral2/memory/5016-133-0x00000000006A0000-0x00000000006A9000-memory.dmp	family_smokeloader

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

ModiLoader Second Stage 64 IoCs

resource	yara_rule
behavioral2/memory/3096-178-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-188-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-215-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-217-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-216-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-219-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-218-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-220-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-221-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-222-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-223-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-224-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-225-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-226-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-227-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-228-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-229-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-230-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-231-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-232-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-233-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-234-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-235-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-236-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-237-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-238-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-239-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-241-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-240-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-242-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-244-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-243-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-245-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-247-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-246-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-248-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-249-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-251-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-250-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-252-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-253-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-254-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-255-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-256-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-257-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-258-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-259-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-260-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-262-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-263-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-264-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-265-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-266-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-267-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-268-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-269-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-270-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-272-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-273-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-274-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-275-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-276-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-277-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2
behavioral2/memory/2200-355-0x0000000010410000-0x000000001043A000-memory.dmp	modiloader_stage2

Blocklisted process makes network request 4 IoCs

flow	pid	Process
208	2200	wscript.exe
209	2200	wscript.exe
212	2200	wscript.exe
216	2200	wscript.exe

Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
3456	FD7F.exe
1148	1FCD.exe
3524	257C.exe
2336	29F1.exe
3628	3973.exe
4616	3F31.exe
3096	43E5.exe
2456	wfyoot.exe
4572	43E5.exe
4168	wfyoot.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	3973.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wfyoot.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2200 set thread context of 4572	2200	wscript.exe	121

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3392	3456	WerFault.exe	90
3140	3628	WerFault.exe	102
2692	4168	WerFault.exe	122

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a6fc491d6d097332f35d3ffaa4a31ecafd1b114cdccee.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a6fc491d6d097332f35d3ffaa4a31ecafd1b114cdccee.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a6fc491d6d097332f35d3ffaa4a31ecafd1b114cdccee.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2344	schtasks.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5016	a6fc491d6d097332f35d3ffaa4a31ecafd1b114cdccee.exe
5016	a6fc491d6d097332f35d3ffaa4a31ecafd1b114cdccee.exe
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2180	Process not Found

Suspicious behavior: MapViewOfSection 19 IoCs

pid	Process
5016	a6fc491d6d097332f35d3ffaa4a31ecafd1b114cdccee.exe
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found
2180	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3456	FD7F.exe
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeDebugPrivilege	4572	43E5.exe
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found
Token: SeShutdownPrivilege	2180	Process not Found
Token: SeCreatePagefilePrivilege	2180	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2180	Process not Found
2180	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 3456	2180	Process not Found	90
PID 2180 wrote to memory of 3456	2180	Process not Found	90
PID 2180 wrote to memory of 3456	2180	Process not Found	90
PID 2180 wrote to memory of 1148	2180	Process not Found	93
PID 2180 wrote to memory of 1148	2180	Process not Found	93
PID 2180 wrote to memory of 1148	2180	Process not Found	93
PID 2180 wrote to memory of 3524	2180	Process not Found	95
PID 2180 wrote to memory of 3524	2180	Process not Found	95
PID 2180 wrote to memory of 3524	2180	Process not Found	95
PID 2180 wrote to memory of 2336	2180	Process not Found	100
PID 2180 wrote to memory of 2336	2180	Process not Found	100
PID 2180 wrote to memory of 2336	2180	Process not Found	100
PID 2180 wrote to memory of 3628	2180	Process not Found	102
PID 2180 wrote to memory of 3628	2180	Process not Found	102
PID 2180 wrote to memory of 3628	2180	Process not Found	102
PID 2180 wrote to memory of 4616	2180	Process not Found	103
PID 2180 wrote to memory of 4616	2180	Process not Found	103
PID 2180 wrote to memory of 4616	2180	Process not Found	103
PID 2180 wrote to memory of 3096	2180	Process not Found	105
PID 2180 wrote to memory of 3096	2180	Process not Found	105
PID 2180 wrote to memory of 3096	2180	Process not Found	105
PID 2180 wrote to memory of 2164	2180	Process not Found	106
PID 2180 wrote to memory of 2164	2180	Process not Found	106
PID 2180 wrote to memory of 2164	2180	Process not Found	106
PID 2180 wrote to memory of 2164	2180	Process not Found	106
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107
PID 3096 wrote to memory of 2200	3096	43E5.exe	107

C:\Users\Admin\AppData\Local\Temp\a6fc491d6d097332f35d3ffaa4a31ecafd1b114cdccee.exe
"C:\Users\Admin\AppData\Local\Temp\a6fc491d6d097332f35d3ffaa4a31ecafd1b114cdccee.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5016

C:\Users\Admin\AppData\Local\Temp\FD7F.exe
C:\Users\Admin\AppData\Local\Temp\FD7F.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 1736
  2⤵
  - Program crash
  PID:3392

C:\Users\Admin\AppData\Local\Temp\1FCD.exe
C:\Users\Admin\AppData\Local\Temp\1FCD.exe
1⤵
- Executes dropped EXE
PID:1148

C:\Users\Admin\AppData\Local\Temp\257C.exe
C:\Users\Admin\AppData\Local\Temp\257C.exe
1⤵
- Executes dropped EXE
PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3456 -ip 3456
1⤵
PID:1392

C:\Users\Admin\AppData\Local\Temp\29F1.exe
C:\Users\Admin\AppData\Local\Temp\29F1.exe
1⤵
- Executes dropped EXE
PID:2336

C:\Users\Admin\AppData\Local\Temp\3973.exe
C:\Users\Admin\AppData\Local\Temp\3973.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
PID:3628
- C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe
  "C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  PID:2456
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN wfyoot.exe /TR "C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 880
  2⤵
  - Program crash
  PID:3140

C:\Users\Admin\AppData\Local\Temp\3F31.exe
C:\Users\Admin\AppData\Local\Temp\3F31.exe
1⤵
- Executes dropped EXE
PID:4616

C:\Users\Admin\AppData\Local\Temp\43E5.exe
C:\Users\Admin\AppData\Local\Temp\43E5.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\SysWOW64\wscript.exe
  C:\Windows\System32\wscript.exe
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  PID:2200
- - C:\Users\Admin\AppData\Local\Temp\43E5.exe
    "C:\Users\Admin\AppData\Local\Temp\43E5.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4572

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3628 -ip 3628
1⤵
PID:1532

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2044

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4916

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2088

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3484

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:536

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2304

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2032

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3160

C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe
C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe
1⤵
- Executes dropped EXE
PID:4168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 316
  2⤵
  - Program crash
  PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4168 -ip 4168
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wfyoot.exe

Path C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe
Size 324KB
SHA256 c44e83861ea09273f134bfcb92bd1c48053763f761576cac3a9985e7f88a51b5
MD5 03321edebed139c7b73189e75a919864
SHA1 ce89b8b869d37ec45629c3dfbc8862fa401a448f
SHA512 7f3471dbc2bf7fa75a06dc092cfb65fdadc13223b66d1b235f24a574ec98cfdfc7dfe425268ff63dfce67f47b94653d0c145a008f3a46d522ccd2ac28a258e57
SSDEEP 6144:0SGRuGV8quC+Aa31IRYnm7Ygzs0CnrwVfquSAW:0S2V8quP3qRem7RQ06d/
MD5 SHA1 SHA512 SSDEEP

Submit Download

wfyoot.exe

Path C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe
Size 324KB
SHA256 c44e83861ea09273f134bfcb92bd1c48053763f761576cac3a9985e7f88a51b5
MD5 03321edebed139c7b73189e75a919864
SHA1 ce89b8b869d37ec45629c3dfbc8862fa401a448f
SHA512 7f3471dbc2bf7fa75a06dc092cfb65fdadc13223b66d1b235f24a574ec98cfdfc7dfe425268ff63dfce67f47b94653d0c145a008f3a46d522ccd2ac28a258e57
SSDEEP 6144:0SGRuGV8quC+Aa31IRYnm7Ygzs0CnrwVfquSAW:0S2V8quP3qRem7RQ06d/
MD5 SHA1 SHA512 SSDEEP

Submit Download

wfyoot.exe

Path C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe
Size 324KB
SHA256 c44e83861ea09273f134bfcb92bd1c48053763f761576cac3a9985e7f88a51b5
MD5 03321edebed139c7b73189e75a919864
SHA1 ce89b8b869d37ec45629c3dfbc8862fa401a448f
SHA512 7f3471dbc2bf7fa75a06dc092cfb65fdadc13223b66d1b235f24a574ec98cfdfc7dfe425268ff63dfce67f47b94653d0c145a008f3a46d522ccd2ac28a258e57
SSDEEP 6144:0SGRuGV8quC+Aa31IRYnm7Ygzs0CnrwVfquSAW:0S2V8quP3qRem7RQ06d/
MD5 SHA1 SHA512 SSDEEP

Submit Download

1FCD.exe

Path C:\Users\Admin\AppData\Local\Temp\1FCD.exe
Size 720KB
SHA256 beb1bdbc9b36231fe4e5319229e8316c75520551b717d5dde566f99be9e3a97e
MD5 34c9b2563434dc04cfc5ec0d165076ea
SHA1 983a62d491972c8e50af42e133a7f126cd18ffb9
SHA512 aecee67131b9de6e9749e59dfcbd9468ce412bad899064eab56745b335f40cd0e40c0f1ec9b69b2237fe1f0312c6a7e873852fb0f9750f0b0e7e65cc1ad55a36
SSDEEP 12288:n6CpcKrw334lLMGri0ioT/VGYmp7aGEiN8kF3DInIblrLDUkRuHBhUTIpkmchAq:6CpcKi34lLMGIEiN3D6Iblwksp6hT
MD5 SHA1 SHA512 SSDEEP

Submit Download

1FCD.exe

Path C:\Users\Admin\AppData\Local\Temp\1FCD.exe
Size 720KB
SHA256 beb1bdbc9b36231fe4e5319229e8316c75520551b717d5dde566f99be9e3a97e
MD5 34c9b2563434dc04cfc5ec0d165076ea
SHA1 983a62d491972c8e50af42e133a7f126cd18ffb9
SHA512 aecee67131b9de6e9749e59dfcbd9468ce412bad899064eab56745b335f40cd0e40c0f1ec9b69b2237fe1f0312c6a7e873852fb0f9750f0b0e7e65cc1ad55a36
SSDEEP 12288:n6CpcKrw334lLMGri0ioT/VGYmp7aGEiN8kF3DInIblrLDUkRuHBhUTIpkmchAq:6CpcKi34lLMGIEiN3D6Iblwksp6hT
MD5 SHA1 SHA512 SSDEEP

Submit Download

257C.exe

Path C:\Users\Admin\AppData\Local\Temp\257C.exe
Size 783KB
SHA256 e999aec023590c59392f9f7696f3d289aaac23b4d349e081f300d3c46f45bc13
MD5 7f3294b1b10b086cee0c2f9f4cad4a44
SHA1 3919b25280d25dc5deea3d34ddf9514626b7b018
SHA512 2266699746bd25d274bb73bec2ced408bbfacd763d4f44edad4b8023ec2903bb94442d7035d0acb2b951cac8f46812034ed1cb136a8ea781f771def1c4cd6fc2
SSDEEP 12288:YC6pcKrwnqEIXM3+i0i43iVGYmp7aGEiNef4UDIoqkFF3SOTPsuiBLVya53Mk8Aq:x6pcKqqEIXM3KEilUDdqkFFRPiRoT
MD5 SHA1 SHA512 SSDEEP

Submit Download

257C.exe

Path C:\Users\Admin\AppData\Local\Temp\257C.exe
Size 783KB
SHA256 e999aec023590c59392f9f7696f3d289aaac23b4d349e081f300d3c46f45bc13
MD5 7f3294b1b10b086cee0c2f9f4cad4a44
SHA1 3919b25280d25dc5deea3d34ddf9514626b7b018
SHA512 2266699746bd25d274bb73bec2ced408bbfacd763d4f44edad4b8023ec2903bb94442d7035d0acb2b951cac8f46812034ed1cb136a8ea781f771def1c4cd6fc2
SSDEEP 12288:YC6pcKrwnqEIXM3+i0i43iVGYmp7aGEiNef4UDIoqkFF3SOTPsuiBLVya53Mk8Aq:x6pcKqqEIXM3KEilUDdqkFFRPiRoT
MD5 SHA1 SHA512 SSDEEP

Submit Download

29F1.exe

Path C:\Users\Admin\AppData\Local\Temp\29F1.exe
Size 720KB
SHA256 4db9e17d126856919f1366761d80bbb6b852b4f14aa9b4698c50de83ddbe74df
MD5 866b5b2163c1478071179682952d2b24
SHA1 53d06993c0913d9d8af0740f94417c5cfac52cfa
SHA512 53ea9b38146e6cdf7d39395ecf84a2e0e108052da270811104d6217960965247ee1ceb8a559ff4b2de716ab367fc445d39b4a7f832e5daf06aac9a89b6ee4304
SSDEEP 12288:PSCpcKrw334lLMGri0ioT/VGYmp7aGEiN8kF3DInIblrLDUkRuHBhYmLxeA9rmMz:aCpcKi34lLMGoEiN3D6IblwkRA9rmM3D
MD5 SHA1 SHA512 SSDEEP

Submit Download

29F1.exe

Path C:\Users\Admin\AppData\Local\Temp\29F1.exe
Size 720KB
SHA256 4db9e17d126856919f1366761d80bbb6b852b4f14aa9b4698c50de83ddbe74df
MD5 866b5b2163c1478071179682952d2b24
SHA1 53d06993c0913d9d8af0740f94417c5cfac52cfa
SHA512 53ea9b38146e6cdf7d39395ecf84a2e0e108052da270811104d6217960965247ee1ceb8a559ff4b2de716ab367fc445d39b4a7f832e5daf06aac9a89b6ee4304
SSDEEP 12288:PSCpcKrw334lLMGri0ioT/VGYmp7aGEiN8kF3DInIblrLDUkRuHBhYmLxeA9rmMz:aCpcKi34lLMGoEiN3D6IblwkRA9rmM3D
MD5 SHA1 SHA512 SSDEEP

Submit Download

3973.exe

Path C:\Users\Admin\AppData\Local\Temp\3973.exe
Size 324KB
SHA256 c44e83861ea09273f134bfcb92bd1c48053763f761576cac3a9985e7f88a51b5
MD5 03321edebed139c7b73189e75a919864
SHA1 ce89b8b869d37ec45629c3dfbc8862fa401a448f
SHA512 7f3471dbc2bf7fa75a06dc092cfb65fdadc13223b66d1b235f24a574ec98cfdfc7dfe425268ff63dfce67f47b94653d0c145a008f3a46d522ccd2ac28a258e57
SSDEEP 6144:0SGRuGV8quC+Aa31IRYnm7Ygzs0CnrwVfquSAW:0S2V8quP3qRem7RQ06d/
MD5 SHA1 SHA512 SSDEEP

Submit Download

3973.exe

Path C:\Users\Admin\AppData\Local\Temp\3973.exe
Size 324KB
SHA256 c44e83861ea09273f134bfcb92bd1c48053763f761576cac3a9985e7f88a51b5
MD5 03321edebed139c7b73189e75a919864
SHA1 ce89b8b869d37ec45629c3dfbc8862fa401a448f
SHA512 7f3471dbc2bf7fa75a06dc092cfb65fdadc13223b66d1b235f24a574ec98cfdfc7dfe425268ff63dfce67f47b94653d0c145a008f3a46d522ccd2ac28a258e57
SSDEEP 6144:0SGRuGV8quC+Aa31IRYnm7Ygzs0CnrwVfquSAW:0S2V8quP3qRem7RQ06d/
MD5 SHA1 SHA512 SSDEEP

Submit Download

3F31.exe

Path C:\Users\Admin\AppData\Local\Temp\3F31.exe
Size 720KB
SHA256 579392006c5a06592ed6d56e0593e8c272b704c0849ecf6d8f1502ea02c75435
MD5 76f49e4c7c466ca27af9420399608af5
SHA1 0d61a9e9cecae0b259fec2aac1a89938fe5265d9
SHA512 1dee0a768259f168d5d71f296c2ecbf1068c59d56be24a5b48f40d26c5cb5114cce2ccd76a3147b5d89ebdfde3331696be58f828eb4ba6ee581efce95aff1a3d
SSDEEP 12288:6nSCpcKrw334lLMGri0ioT/VGYmp7aGEiN8kF3DInIblrLDUkRuHBh2nA0OBAq:LCpcKi34lLMGIEiN3D6IblwkHnA5T
MD5 SHA1 SHA512 SSDEEP

Submit Download

3F31.exe

Path C:\Users\Admin\AppData\Local\Temp\3F31.exe
Size 720KB
SHA256 579392006c5a06592ed6d56e0593e8c272b704c0849ecf6d8f1502ea02c75435
MD5 76f49e4c7c466ca27af9420399608af5
SHA1 0d61a9e9cecae0b259fec2aac1a89938fe5265d9
SHA512 1dee0a768259f168d5d71f296c2ecbf1068c59d56be24a5b48f40d26c5cb5114cce2ccd76a3147b5d89ebdfde3331696be58f828eb4ba6ee581efce95aff1a3d
SSDEEP 12288:6nSCpcKrw334lLMGri0ioT/VGYmp7aGEiN8kF3DInIblrLDUkRuHBh2nA0OBAq:LCpcKi34lLMGIEiN3D6IblwkHnA5T
MD5 SHA1 SHA512 SSDEEP

Submit Download

43E5.exe

Path C:\Users\Admin\AppData\Local\Temp\43E5.exe
Size 961KB
SHA256 ef52a01dd88433ae87bc10baa5d94ba2a42ad12f32cb57b6f06c6f3a7f4f0582
MD5 b64c986a71041d33480e606f7a4a3522
SHA1 5e53f76d36cf8ff033b439d35d4c9e611eb2df3f
SHA512 9a73077b3d7eccbaeba0fb36aefd78749c7633450da6aa401d9aa8fcbc0212b4284f8875d2f65486611f58588c27eabd2b75e55e8258daaec48b8e0089d5b50d
SSDEEP 12288:A0zNX3tuamI3X8LxJGKWR1VUeVGekrQB+71x4OxCPaUtVSX3x7FRS8Hy1Qmty/:AOJ13X8vGKWxhGlrQOzxC/tVSn52Rb
MD5 SHA1 SHA512 SSDEEP

Submit Download

43E5.exe

Path C:\Users\Admin\AppData\Local\Temp\43E5.exe
Size 961KB
SHA256 ef52a01dd88433ae87bc10baa5d94ba2a42ad12f32cb57b6f06c6f3a7f4f0582
MD5 b64c986a71041d33480e606f7a4a3522
SHA1 5e53f76d36cf8ff033b439d35d4c9e611eb2df3f
SHA512 9a73077b3d7eccbaeba0fb36aefd78749c7633450da6aa401d9aa8fcbc0212b4284f8875d2f65486611f58588c27eabd2b75e55e8258daaec48b8e0089d5b50d
SSDEEP 12288:A0zNX3tuamI3X8LxJGKWR1VUeVGekrQB+71x4OxCPaUtVSX3x7FRS8Hy1Qmty/:AOJ13X8vGKWxhGlrQOzxC/tVSn52Rb
MD5 SHA1 SHA512 SSDEEP

Submit Download

43E5.exe

Path C:\Users\Admin\AppData\Local\Temp\43E5.exe
Size 961KB
SHA256 ef52a01dd88433ae87bc10baa5d94ba2a42ad12f32cb57b6f06c6f3a7f4f0582
MD5 b64c986a71041d33480e606f7a4a3522
SHA1 5e53f76d36cf8ff033b439d35d4c9e611eb2df3f
SHA512 9a73077b3d7eccbaeba0fb36aefd78749c7633450da6aa401d9aa8fcbc0212b4284f8875d2f65486611f58588c27eabd2b75e55e8258daaec48b8e0089d5b50d
SSDEEP 12288:A0zNX3tuamI3X8LxJGKWR1VUeVGekrQB+71x4OxCPaUtVSX3x7FRS8Hy1Qmty/:AOJ13X8vGKWxhGlrQOzxC/tVSn52Rb
MD5 SHA1 SHA512 SSDEEP

Submit Download

FD7F.exe

Path C:\Users\Admin\AppData\Local\Temp\FD7F.exe
Size 421KB
SHA256 2c8158054be8f59049ffba2ef8555dbe76812ddef3628dc9e06491ee982f1c61
MD5 331e9467ace2c12e1142a7af3861be0a
SHA1 d148319627a24bef5de80ee1dc8d805b7322db64
SHA512 19c8c715d50771737803da03ed97a487012aa1586e68f51db3c437adbc8c69721400ab32b1ecedce05d53ffd7467d9f7cae054e3b763dde7f475155a6678b589
SSDEEP 6144:97XGPL6al/ma1wqe0vW/8PZ+cCx/8g4K09jEQwRvyvHyVktpnpzrwVfquS0:1XU6emMbo8h0d8+0qR6/NVd
MD5 SHA1 SHA512 SSDEEP

Submit Download

FD7F.exe

Path C:\Users\Admin\AppData\Local\Temp\FD7F.exe
Size 421KB
SHA256 2c8158054be8f59049ffba2ef8555dbe76812ddef3628dc9e06491ee982f1c61
MD5 331e9467ace2c12e1142a7af3861be0a
SHA1 d148319627a24bef5de80ee1dc8d805b7322db64
SHA512 19c8c715d50771737803da03ed97a487012aa1586e68f51db3c437adbc8c69721400ab32b1ecedce05d53ffd7467d9f7cae054e3b763dde7f475155a6678b589
SSDEEP 6144:97XGPL6al/ma1wqe0vW/8PZ+cCx/8g4K09jEQwRvyvHyVktpnpzrwVfquS0:1XU6emMbo8h0d8+0qR6/NVd
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.png

Path C:\Users\Public\Libraries\x.png
Size 42B
SHA256 00cc2b3be63440782bb32e9c1cb101384c71e726a3f3a91bee75629add3cb7bb
MD5 a2d98d1d9bfbf8cda988fa4e3fdb4b8c
SHA1 82c6d3f3cc6d90087ef0014d5b551d560e0aa8ac
SHA512 8dc3893293b7fe5be9407809a9cb9373755ce14c57f34df1078761d9930f3e784322cac521d5ac8e1a65cfe454f92114aee0ce73f95f69fb1ac42300d37f8e9c
MD5 SHA1 SHA512

Submit Download

memory/536-204-0x0000000000D50000-0x0000000000D55000-memory.dmp

Download

memory/536-205-0x0000000000D40000-0x0000000000D49000-memory.dmp

Download

memory/536-287-0x0000000000D50000-0x0000000000D55000-memory.dmp

Download

memory/2032-210-0x0000000000A30000-0x0000000000A37000-memory.dmp

Download

memory/2032-211-0x0000000000A20000-0x0000000000A2D000-memory.dmp

Download

memory/2032-356-0x0000000000A30000-0x0000000000A37000-memory.dmp

Download

memory/2044-191-0x0000000000960000-0x000000000096F000-memory.dmp

Download

memory/2044-190-0x0000000000970000-0x0000000000979000-memory.dmp

Download

memory/2044-282-0x0000000000970000-0x0000000000979000-memory.dmp

Download

memory/2088-198-0x0000000000120000-0x0000000000126000-memory.dmp

Download

memory/2088-199-0x0000000000110000-0x000000000011C000-memory.dmp

Download

memory/2088-285-0x0000000000120000-0x0000000000126000-memory.dmp

Download

memory/2164-187-0x0000000000580000-0x000000000058B000-memory.dmp

Download

memory/2164-186-0x0000000000590000-0x0000000000597000-memory.dmp

Download

memory/2164-261-0x0000000000590000-0x0000000000597000-memory.dmp

Download

memory/2200-253-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-264-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-355-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-277-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-276-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-275-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-274-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-273-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-272-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-270-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-269-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-268-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-267-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-266-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-188-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-265-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-263-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-262-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-260-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-259-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-258-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-257-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-256-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-255-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-254-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-252-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-250-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-251-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-249-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-248-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-246-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-247-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-245-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-243-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-244-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-242-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-240-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-241-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-239-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-238-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-237-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-215-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-217-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-216-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-219-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-218-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-220-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-221-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-222-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-223-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-224-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-225-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-226-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-227-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-228-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-229-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-230-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-231-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-232-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-233-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-234-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-235-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2200-236-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/2304-208-0x00000000004A0000-0x00000000004AB000-memory.dmp

Download

memory/2304-207-0x00000000004B0000-0x00000000004B6000-memory.dmp

Download

memory/2304-343-0x00000000004B0000-0x00000000004B6000-memory.dmp

Download

memory/2456-284-0x00000000006E6000-0x0000000000702000-memory.dmp

Download

memory/2456-196-0x00000000006E6000-0x0000000000702000-memory.dmp

Download

memory/2456-197-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/3096-178-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/3096-176-0x0000000010410000-0x000000001043A000-memory.dmp

Download

memory/3160-357-0x0000000000470000-0x0000000000478000-memory.dmp

Download

memory/3160-214-0x0000000000460000-0x000000000046B000-memory.dmp

Download

memory/3160-213-0x0000000000470000-0x0000000000478000-memory.dmp

Download

memory/3456-153-0x0000000007D30000-0x0000000007D80000-memory.dmp

Download

memory/3456-142-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3456-151-0x0000000007400000-0x00000000075C2000-memory.dmp

Download

memory/3456-149-0x0000000006510000-0x0000000006586000-memory.dmp

Download

memory/3456-139-0x0000000004C70000-0x0000000005214000-memory.dmp

Download

memory/3456-148-0x0000000006370000-0x0000000006402000-memory.dmp

Download

memory/3456-152-0x00000000075D0000-0x0000000007AFC000-memory.dmp

Download

memory/3456-141-0x00000000020A0000-0x00000000020F9000-memory.dmp

Download

memory/3456-150-0x00000000065D0000-0x00000000065EE000-memory.dmp

Download

memory/3456-147-0x0000000005C90000-0x0000000005CF6000-memory.dmp

Download

memory/3456-140-0x000000000053D000-0x0000000000574000-memory.dmp

Download

memory/3456-146-0x0000000005980000-0x00000000059BC000-memory.dmp

Download

memory/3456-145-0x0000000005870000-0x000000000597A000-memory.dmp

Download

memory/3456-144-0x0000000005850000-0x0000000005862000-memory.dmp

Download

memory/3456-163-0x000000000053D000-0x0000000000574000-memory.dmp

Download

memory/3456-143-0x0000000005220000-0x0000000005838000-memory.dmp

Download

memory/3456-164-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3484-201-0x0000000000F30000-0x0000000000F52000-memory.dmp

Download

memory/3484-202-0x0000000000F00000-0x0000000000F27000-memory.dmp

Download

memory/3484-286-0x0000000000F30000-0x0000000000F52000-memory.dmp

Download

memory/3628-184-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/3628-182-0x00000000006A7000-0x00000000006C3000-memory.dmp

Download

memory/3628-183-0x00000000005B0000-0x00000000005E7000-memory.dmp

Download

memory/4168-361-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/4168-360-0x000000000060A000-0x0000000000626000-memory.dmp

Download

memory/4572-358-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/4572-345-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/4916-193-0x0000000000B80000-0x0000000000B89000-memory.dmp

Download

memory/4916-192-0x0000000000B90000-0x0000000000B95000-memory.dmp

Download

memory/4916-283-0x0000000000B90000-0x0000000000B95000-memory.dmp

Download

memory/5016-135-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/5016-134-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/5016-132-0x0000000000787000-0x0000000000797000-memory.dmp

Download

memory/5016-133-0x00000000006A0000-0x00000000006A9000-memory.dmp

Download