modiloader | 30f6159ccc08f38c6cc431d624962d87893ba8242bb4b3e14afa372cab1887e6

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14c774ac9a6d96757c8d7c08a29b0923.exe
Size

651KB
MD5

14c774ac9a6d96757c8d7c08a29b0923
SHA1

0887ca2968e918f4f79cb158f3f3b5bc01f6a07e
SHA256

30f6159ccc08f38c6cc431d624962d87893ba8242bb4b3e14afa372cab1887e6
SHA512

6f52cf312215ff21d36a5d7e2af68295b3d80f8c149a5c9980c294fb7a233aadb1c3299957885f5f5093e11123917ae83c4da030c8f488917f0b0e437cdfa756
SSDEEP

12288:kpyZT1JrCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx1JjOD3SxcDDcNDqWYurL0

Score

10^/10

modiloader evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	dHY4IvP3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	wiour.exe

ModiLoader Second Stage 16 IoCs

resource	yara_rule
behavioral1/memory/2100-12-0x0000000000400000-0x000000000041C000-memory.dmp	modiloader_stage2
behavioral1/memory/2256-15-0x0000000000400000-0x0000000000507000-memory.dmp	modiloader_stage2
behavioral1/memory/2256-16-0x0000000000400000-0x0000000000507000-memory.dmp	modiloader_stage2
behavioral1/files/0x000c0000000126a2-51.dat	modiloader_stage2
behavioral1/files/0x000c0000000126a2-52.dat	modiloader_stage2
behavioral1/files/0x000c0000000126a2-48.dat	modiloader_stage2
behavioral1/files/0x000c0000000126a2-46.dat	modiloader_stage2
behavioral1/files/0x000c0000000126a2-53.dat	modiloader_stage2
behavioral1/memory/2552-72-0x0000000000400000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral1/files/0x000c00000001313b-75.dat	modiloader_stage2
behavioral1/memory/2256-82-0x0000000000400000-0x0000000000507000-memory.dmp	modiloader_stage2
behavioral1/memory/820-97-0x0000000000400000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral1/files/0x000800000001339f-103.dat	modiloader_stage2
behavioral1/memory/2256-143-0x00000000026B0000-0x0000000002714000-memory.dmp	modiloader_stage2
behavioral1/memory/2256-144-0x00000000026B0000-0x0000000002714000-memory.dmp	modiloader_stage2
behavioral1/memory/2256-214-0x0000000000400000-0x0000000000507000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
2324	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2484	dHY4IvP3.exe
2884	wiour.exe
2552	azhost.exe
2172	azhost.exe
820	bzhost.exe
2868	bzhost.exe
872	czhost.exe
1720	czhost.exe
1608	dzhost.exe
336	csrss.exe
616	ezhost.exe

Loads dropped DLL 18 IoCs

pid	Process
2256	14c774ac9a6d96757c8d7c08a29b0923.exe
2256	14c774ac9a6d96757c8d7c08a29b0923.exe
2484	dHY4IvP3.exe
2484	dHY4IvP3.exe
2256	14c774ac9a6d96757c8d7c08a29b0923.exe
2256	14c774ac9a6d96757c8d7c08a29b0923.exe
2256	14c774ac9a6d96757c8d7c08a29b0923.exe
2256	14c774ac9a6d96757c8d7c08a29b0923.exe
2256	14c774ac9a6d96757c8d7c08a29b0923.exe
2256	14c774ac9a6d96757c8d7c08a29b0923.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2256	14c774ac9a6d96757c8d7c08a29b0923.exe
2256	14c774ac9a6d96757c8d7c08a29b0923.exe
2256	14c774ac9a6d96757c8d7c08a29b0923.exe
2256	14c774ac9a6d96757c8d7c08a29b0923.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2256-2-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral1/memory/2256-4-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral1/memory/2256-7-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral1/memory/2256-13-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral1/memory/2256-15-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral1/memory/2256-16-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral1/memory/2256-82-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral1/memory/2868-86-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2868-88-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2868-91-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2868-99-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2868-101-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2868-102-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/1720-113-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1720-115-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1720-118-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1720-127-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1720-130-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2868-176-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2256-214-0x0000000000400000-0x0000000000507000-memory.dmp	upx

Adds Run key to start application 2 TTPs 51 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /v"	dHY4IvP3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /y"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /o"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /N"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /f"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /H"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /L"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /a"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /x"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /A"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /r"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /w"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /Z"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /k"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /J"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /F"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /O"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /s"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /P"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /v"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /M"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /i"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /S"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /d"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /K"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /j"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /m"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /g"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /Y"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /V"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /p"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /B"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /G"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /q"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /z"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /Q"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /U"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /D"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /T"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /l"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /I"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /c"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /b"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /W"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /X"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /e"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /u"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /t"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /R"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /n"	wiour.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiour = "C:\\Users\\Admin\\wiour.exe /C"	wiour.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	azhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	azhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	bzhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	bzhost.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2100 set thread context of 2256	2100	14c774ac9a6d96757c8d7c08a29b0923.exe	28
PID 2552 set thread context of 2172	2552	azhost.exe	36
PID 820 set thread context of 2868	820	bzhost.exe	38
PID 872 set thread context of 1720	872	czhost.exe	40
PID 1608 set thread context of 2860	1608	dzhost.exe	43

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	1720	WerFault.exe	40

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
2792	tasklist.exe
2468	tasklist.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2484	dHY4IvP3.exe
2484	dHY4IvP3.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2172	azhost.exe
2172	azhost.exe
2884	wiour.exe
2172	azhost.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2868	bzhost.exe
2884	wiour.exe
2172	azhost.exe
2172	azhost.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2172	azhost.exe
2172	azhost.exe
2884	wiour.exe
2884	wiour.exe
1608	dzhost.exe
1608	dzhost.exe
1608	dzhost.exe
2172	azhost.exe
2172	azhost.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2172	azhost.exe
2172	azhost.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2172	azhost.exe
2172	azhost.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2884	wiour.exe
2172	azhost.exe
2172	azhost.exe
2884	wiour.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	tasklist.exe
Token: SeDebugPrivilege	1608	dzhost.exe
Token: SeDebugPrivilege	1608	dzhost.exe
Token: SeDebugPrivilege	2468	tasklist.exe
Token: SeAssignPrimaryTokenPrivilege	828	svchost.exe
Token: SeIncreaseQuotaPrivilege	828	svchost.exe
Token: SeSecurityPrivilege	828	svchost.exe
Token: SeTakeOwnershipPrivilege	828	svchost.exe
Token: SeLoadDriverPrivilege	828	svchost.exe
Token: SeRestorePrivilege	828	svchost.exe
Token: SeSystemEnvironmentPrivilege	828	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	828	svchost.exe
Token: SeIncreaseQuotaPrivilege	828	svchost.exe
Token: SeSecurityPrivilege	828	svchost.exe
Token: SeTakeOwnershipPrivilege	828	svchost.exe
Token: SeLoadDriverPrivilege	828	svchost.exe
Token: SeSystemtimePrivilege	828	svchost.exe
Token: SeBackupPrivilege	828	svchost.exe
Token: SeRestorePrivilege	828	svchost.exe
Token: SeShutdownPrivilege	828	svchost.exe
Token: SeSystemEnvironmentPrivilege	828	svchost.exe
Token: SeUndockPrivilege	828	svchost.exe
Token: SeManageVolumePrivilege	828	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	828	svchost.exe
Token: SeIncreaseQuotaPrivilege	828	svchost.exe
Token: SeSecurityPrivilege	828	svchost.exe
Token: SeTakeOwnershipPrivilege	828	svchost.exe
Token: SeLoadDriverPrivilege	828	svchost.exe
Token: SeRestorePrivilege	828	svchost.exe
Token: SeSystemEnvironmentPrivilege	828	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	828	svchost.exe
Token: SeIncreaseQuotaPrivilege	828	svchost.exe
Token: SeSecurityPrivilege	828	svchost.exe
Token: SeTakeOwnershipPrivilege	828	svchost.exe
Token: SeLoadDriverPrivilege	828	svchost.exe
Token: SeRestorePrivilege	828	svchost.exe
Token: SeSystemEnvironmentPrivilege	828	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2256	14c774ac9a6d96757c8d7c08a29b0923.exe
2484	dHY4IvP3.exe
2884	wiour.exe
616	ezhost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2256	2100	14c774ac9a6d96757c8d7c08a29b0923.exe	28
PID 2100 wrote to memory of 2256	2100	14c774ac9a6d96757c8d7c08a29b0923.exe	28
PID 2100 wrote to memory of 2256	2100	14c774ac9a6d96757c8d7c08a29b0923.exe	28
PID 2100 wrote to memory of 2256	2100	14c774ac9a6d96757c8d7c08a29b0923.exe	28
PID 2100 wrote to memory of 2256	2100	14c774ac9a6d96757c8d7c08a29b0923.exe	28
PID 2100 wrote to memory of 2256	2100	14c774ac9a6d96757c8d7c08a29b0923.exe	28
PID 2100 wrote to memory of 2256	2100	14c774ac9a6d96757c8d7c08a29b0923.exe	28
PID 2100 wrote to memory of 2256	2100	14c774ac9a6d96757c8d7c08a29b0923.exe	28
PID 2256 wrote to memory of 2484	2256	14c774ac9a6d96757c8d7c08a29b0923.exe	29
PID 2256 wrote to memory of 2484	2256	14c774ac9a6d96757c8d7c08a29b0923.exe	29
PID 2256 wrote to memory of 2484	2256	14c774ac9a6d96757c8d7c08a29b0923.exe	29
PID 2256 wrote to memory of 2484	2256	14c774ac9a6d96757c8d7c08a29b0923.exe	29
PID 2484 wrote to memory of 2884	2484	dHY4IvP3.exe	30
PID 2484 wrote to memory of 2884	2484	dHY4IvP3.exe	30
PID 2484 wrote to memory of 2884	2484	dHY4IvP3.exe	30
PID 2484 wrote to memory of 2884	2484	dHY4IvP3.exe	30
PID 2484 wrote to memory of 2716	2484	dHY4IvP3.exe	31
PID 2484 wrote to memory of 2716	2484	dHY4IvP3.exe	31
PID 2484 wrote to memory of 2716	2484	dHY4IvP3.exe	31
PID 2484 wrote to memory of 2716	2484	dHY4IvP3.exe	31
PID 2716 wrote to memory of 2792	2716	cmd.exe	33
PID 2716 wrote to memory of 2792	2716	cmd.exe	33
PID 2716 wrote to memory of 2792	2716	cmd.exe	33
PID 2716 wrote to memory of 2792	2716	cmd.exe	33
PID 2256 wrote to memory of 2552	2256	14c774ac9a6d96757c8d7c08a29b0923.exe	35
PID 2256 wrote to memory of 2552	2256	14c774ac9a6d96757c8d7c08a29b0923.exe	35
PID 2256 wrote to memory of 2552	2256	14c774ac9a6d96757c8d7c08a29b0923.exe	35
PID 2256 wrote to memory of 2552	2256	14c774ac9a6d96757c8d7c08a29b0923.exe	35
PID 2552 wrote to memory of 2172	2552	azhost.exe	36
PID 2552 wrote to memory of 2172	2552	azhost.exe	36
PID 2552 wrote to memory of 2172	2552	azhost.exe	36
PID 2552 wrote to memory of 2172	2552	azhost.exe	36
PID 2552 wrote to memory of 2172	2552	azhost.exe	36
PID 2552 wrote to memory of 2172	2552	azhost.exe	36
PID 2552 wrote to memory of 2172	2552	azhost.exe	36
PID 2552 wrote to memory of 2172	2552	azhost.exe	36
PID 2552 wrote to memory of 2172	2552	azhost.exe	36
PID 2552 wrote to memory of 2172	2552	azhost.exe	36
PID 2256 wrote to memory of 820	2256	14c774ac9a6d96757c8d7c08a29b0923.exe	37
PID 2256 wrote to memory of 820	2256	14c774ac9a6d96757c8d7c08a29b0923.exe	37
PID 2256 wrote to memory of 820	2256	14c774ac9a6d96757c8d7c08a29b0923.exe	37
PID 2256 wrote to memory of 820	2256	14c774ac9a6d96757c8d7c08a29b0923.exe	37
PID 820 wrote to memory of 2868	820	bzhost.exe	38
PID 820 wrote to memory of 2868	820	bzhost.exe	38
PID 820 wrote to memory of 2868	820	bzhost.exe	38
PID 820 wrote to memory of 2868	820	bzhost.exe	38
PID 820 wrote to memory of 2868	820	bzhost.exe	38
PID 820 wrote to memory of 2868	820	bzhost.exe	38
PID 820 wrote to memory of 2868	820	bzhost.exe	38
PID 820 wrote to memory of 2868	820	bzhost.exe	38
PID 2256 wrote to memory of 872	2256	14c774ac9a6d96757c8d7c08a29b0923.exe	39
PID 2256 wrote to memory of 872	2256	14c774ac9a6d96757c8d7c08a29b0923.exe	39
PID 2256 wrote to memory of 872	2256	14c774ac9a6d96757c8d7c08a29b0923.exe	39
PID 2256 wrote to memory of 872	2256	14c774ac9a6d96757c8d7c08a29b0923.exe	39
PID 872 wrote to memory of 1720	872	czhost.exe	40
PID 872 wrote to memory of 1720	872	czhost.exe	40
PID 872 wrote to memory of 1720	872	czhost.exe	40
PID 872 wrote to memory of 1720	872	czhost.exe	40
PID 872 wrote to memory of 1720	872	czhost.exe	40
PID 872 wrote to memory of 1720	872	czhost.exe	40
PID 872 wrote to memory of 1720	872	czhost.exe	40
PID 872 wrote to memory of 1720	872	czhost.exe	40
PID 1720 wrote to memory of 2736	1720	czhost.exe	41
PID 1720 wrote to memory of 2736	1720	czhost.exe	41

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
PID:336

C:\Users\Admin\AppData\Local\Temp\14c774ac9a6d96757c8d7c08a29b0923.exe
"C:\Users\Admin\AppData\Local\Temp\14c774ac9a6d96757c8d7c08a29b0923.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\14c774ac9a6d96757c8d7c08a29b0923.exe
  14c774ac9a6d96757c8d7c08a29b0923.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Users\Admin\dHY4IvP3.exe
    C:\Users\Admin\dHY4IvP3.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Users\Admin\wiour.exe
      "C:\Users\Admin\wiour.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2884
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del dHY4IvP3.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2716
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
- - C:\Users\Admin\azhost.exe
    C:\Users\Admin\azhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Users\Admin\azhost.exe
      azhost.exe
      4⤵
      Executes dropped EXE
      Maps connected drives based on registry
      Suspicious behavior: EnumeratesProcesses
      PID:2172
- - C:\Users\Admin\bzhost.exe
    C:\Users\Admin\bzhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Users\Admin\bzhost.exe
      bzhost.exe
      4⤵
      Executes dropped EXE
      Maps connected drives based on registry
      Suspicious behavior: EnumeratesProcesses
      PID:2868
- - C:\Users\Admin\czhost.exe
    C:\Users\Admin\czhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Users\Admin\czhost.exe
      czhost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1720
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 88
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2736
- - C:\Users\Admin\dzhost.exe
    C:\Users\Admin\dzhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1608
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:2860
- - C:\Users\Admin\ezhost.exe
    C:\Users\Admin\ezhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:616
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del 14c774ac9a6d96757c8d7c08a29b0923.exe
    3⤵
    - Deletes itself
    PID:2324
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:828
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:440

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:1356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\azhost.exe

Filesize
36KB

MD5
b86636d784064ccc27ed26655797e719

SHA1
2c172dbec51f6cb632de287ba638559645382272

SHA256
d7fa5a8881a51f90f55af658d4552d135b10eea1b97a7854137005b261a2c8cd

SHA512
5815b72b17b352619d7a8b35820b8837f3b084ddef373efdfd588d30be0b1d81d74cb0c3f09f20c2c4a088fc752cba229382fd8e552da62504c84fa75e0e0296

Download Submit
C:\Users\Admin\azhost.exe

Filesize
93KB

MD5
185fe276abe9287965b5f4136ba571e2

SHA1
a4d072fef8508d9c8cad20606b60607aa482c203

SHA256
8287e96720ebbf4dc175541271ad013bb9a5a8ad7c1545588c8eb9b7fb41c315

SHA512
31529b4486762900e6b0e6773f19f0eef5d03639b03fe10fbabd49949591f75d6a1424f45883c381b00e18be2f8e248bcd13160959de94f5ee5494c0862669d9

Download Submit
C:\Users\Admin\azhost.exe

Filesize
248KB

MD5
27ef898ce7ec9c0b79a6996a0b419de1

SHA1
4e8aed756fbc6133af13028c33366d2eaa43f954

SHA256
f08df8dd8e3fe3de4a1ba4ba3bd355a233cf7febd5917b982ec5a949726c36a6

SHA512
5c7fa67e7ed1e8ce238e58f0b55618d1fc13af4e19d9267f6e88e277beb2f10e6c0f0027a532a2d1d4b6e40da1b31dfcacf50ccb71a75dc231ff876869b6787a

Download Submit
C:\Users\Admin\dHY4IvP3.exe

Filesize
121KB

MD5
c08d103558b2fba4d24c531ff1478559

SHA1
f44d78719a42136d44c3eed62bf6a004196dcffb

SHA256
78ea72d4c0af0064cb309c453c11541c6a2bcba7a5545473e57154485793ec14

SHA512
9facdaac3c5d32c0e3b12649b81997270853f89452bb184923afce4223f3ca4fb760b366602d6c646dd2e9b2548d10bd30002f36a68e40335f6e2988282fbc4b

Download Submit
C:\Users\Admin\dHY4IvP3.exe

Filesize
217KB

MD5
cb3de109985e03e45dfbe9ddad4ac72f

SHA1
942fb15a7b23f1c2ffa27d461ae6036be8f9c84f

SHA256
e74882088982b5943ed54e6ab61d3a7076fa586ae93ab0540ee480cb1880ed8f

SHA512
47132805bf9b691f32cbacd6e1a1b6faf30ed7755880a621ddfc025f59a707806522705c585d958928134d4836718f77ec9e68e8d07744c72b7289658511a60f

Download Submit
C:\Users\Admin\dHY4IvP3.exe

Filesize
147KB

MD5
b827156494717466ecbf916e89c70687

SHA1
1facc8b42b5fb3266456f4b99ce3d7d41ffb4f2e

SHA256
f2e26f002174023319cfef165b356145f899dc99e9e1c875e89ad35635ce404a

SHA512
5098b4828cbfeb5417da3a07f50f0b41b8ad0d50e9cfa19c97c14d951200d7122d173919e7f0b9dff109de45a7fcb00fda3097c3b4d88d3af091e40f5a943c13

Download Submit
C:\Windows\system32\consrv.dll

Filesize
53KB

MD5
63e99b675a1337db6d8430195ea3efd2

SHA1
1baead2bf8f433dc82f9b2c03fd65ce697a92155

SHA256
6616179477849205eb4075b75a042056d196f45d67f78929dbb3317a35ccbea9

SHA512
f5b986eafa38dbc9ad7759784ac887ecbb9c8d8009a3f33e91b9c9ceeaf043ed3e4ddab8e6b6b77e54aed9fcecab02442c8ff253f2136ea06996d05ddd68199f

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
6ae904ffa300b898dd12204ae4667e06

SHA1
f56592aff9a0d5fac1929ce1c396b47707b2a92f

SHA256
26b64231867830c8f95d0521ccfb0f44e83b3df2be743c14673021bd26136b2b

SHA512
2373aa0a7dea7b0a91396275d4bdaa056cdbf350ea8fc215c80175924a6857569d30dedee72a186fbf3c55d1bebe2a4b417e0c5d273177095e3db05586218989

Download Submit
\Users\Admin\azhost.exe

Filesize
102KB

MD5
d95716c3ac2b9d1a6aadecdadab6be8a

SHA1
4e95bf69f89c4f44d00c49b839526b808382d247

SHA256
7f42d341711643562d34ef3984493ca84d442ed2e9419e51a44013f9ac51bdeb

SHA512
c5a493bb0d6c7f66246f0291df034542edcbd858ca3f889f40a32988b25f20358d843b3f23f3c00442859ae80e4d0cc4ba768f35e4facbad5e842fbed826c5e6

Download Submit
\Users\Admin\azhost.exe

Filesize
93KB

MD5
aa77c8bb5acf338fb289ae90b488931e

SHA1
3fb5cf5a17e11a802c753b9b71ce76f3fade7c44

SHA256
4bb692e7f335e92f7dd3590f80c39f48ae02f53635a7b46016c471771263f04a

SHA512
eac63d6674b248774afd2549743b0ef34bae28689482375df36a17a10ffb4fe56f55e5c74eb2a491c503de238fae866c360b77fdaaff5700e1b771e9cb6d3be8

Download Submit
\Users\Admin\bzhost.exe

Filesize
138KB

MD5
4e22775699416e81275fea3266e14bba

SHA1
32cc2479a30abd1b40b3b7e959ac32317fa124fd

SHA256
95dc812e94d5ba0842af45685ca7262b55607336fcf4becda83dbb6416beffa9

SHA512
34b13e9142a9c4251c78d876f02f9e86f22253950d3f9126dacd8ec6f0f3bbd36146381ce16b130d794c4bbc1ba08aa4df8e2e7af0c3900035d486242c81e3bf

Download Submit
\Users\Admin\czhost.exe

Filesize
96KB

MD5
fb7e8882346223dfbad778b5a7f74f32

SHA1
8285032fbab2f9f52533657d46df457ab64d0e15

SHA256
6d6fa60b26cd2fc87c94afb20e7f3b35d6eca76d5a46191b8df802d30d4cbc3e

SHA512
31e3963dd156da4a57b3ffd37b857ee1d433c61dc22eb56356f2171b282f3735a1c31d65b3a0b431151b55bfebf964f82c5aa13a12f1c2a8a580840a7ea5da32

Download Submit
\Users\Admin\dHY4IvP3.exe

Filesize
199KB

MD5
729e41f10f90667282981d812cbc5ec4

SHA1
51fc3762927b3db3aa01f3521474ad259c8b3266

SHA256
bd226cf25fee6c3e0b8c0aa1b86f42e89db12ff97bcc1e28dcd5f5b9880dccff

SHA512
8a50f90905ee6b77116c1bf804ad9341e8be7f72217d4ebdc4846beac9ab514138be7e676cd52b5425c530fd9c55d52d7adc5c1aa058bba2d750f1166d647044

Download Submit
\Users\Admin\dHY4IvP3.exe

Filesize
91KB

MD5
4a9daefd452cf5e94486c55d68d7c760

SHA1
334c592f5d125fdc49e617903489b936cf4da398

SHA256
f6a4859e7d00a0f074584fc72d66cb7e872f6ec66a5b2a6782c9be65b3753995

SHA512
6608301e33d106ac95079938e4334542e5872bfbd308c0f3d7ca92ffc43ecd26c44b42c8a994dfd3d104cdebaf355bceeb61f5323d31d973319ddde00aa5d45a

Download Submit
\Users\Admin\dzhost.exe

Filesize
221KB

MD5
5b414fb77d0dbec97ee529ec0bbcbeaf

SHA1
359cd24cd341f75eb46b99375824f6b649443f8e

SHA256
62027b13d4918e5e644952c977960a5e6dfe241e2bb35b387de0bfd0b752e882

SHA512
887b1b93e51d21927ffba49536f281003eef1dbee7634a08cab256f07701d54fe755acab7ae4a513c754067e4144c44c3580689ce187fd584ba440ab748a2360

Download Submit
\Users\Admin\ezhost.exe

Filesize
28KB

MD5
46ede15ce82c221c24bf81b2de1be7e8

SHA1
c332a5ec7aeb213c13449626156f6623351a4393

SHA256
a360c27de3799bf85f2501d4b375744394643fd50f8ecf5241d170b5cb7f6782

SHA512
517f497a4783a0f67ccfca641d93b7f20505c89d6252229f5b97df674f7be20ae48d4732c137ba081c2c1f8ec712371fa4ba4602873e11c0e02b109a00b6c316

Download Submit
\Users\Admin\wiour.exe

Filesize
288KB

MD5
a0a08fe0c184d14bc27952be95b86895

SHA1
ec695af6d7ac9b19a7a7759ed1b3645761fc0b45

SHA256
9a16544bd38b96a6017b045dc6a9474c95801bcad29552c54785c229bf5f4c34

SHA512
40493a261ea5c0d20e906b9d784f9f75e228e0e79e123c6ad318bdc3a17dbae1f01b3fa63f6556cffcaeaeac0836a0c09066d6d1bb39c3c248052ab32f018487

Download Submit
memory/336-184-0x0000000000370000-0x00000000003B5000-memory.dmp

Filesize
276KB

Download
memory/336-186-0x0000000000B50000-0x0000000000B62000-memory.dmp

Filesize
72KB

Download
memory/820-97-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/828-229-0x0000000000180000-0x0000000000188000-memory.dmp

Filesize
32KB

Download
memory/828-240-0x00000000001A0000-0x00000000001AB000-memory.dmp

Filesize
44KB

Download
memory/828-253-0x00000000001A0000-0x00000000001AB000-memory.dmp

Filesize
44KB

Download
memory/1608-150-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1608-164-0x0000000000370000-0x00000000003B5000-memory.dmp

Filesize
276KB

Download
memory/1608-148-0x0000000000220000-0x0000000000284000-memory.dmp

Filesize
400KB

Download
memory/1608-147-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1608-146-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1608-145-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1608-153-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1608-188-0x0000000000600000-0x0000000000645000-memory.dmp

Filesize
276KB

Download
memory/1608-187-0x0000000000370000-0x00000000003B5000-memory.dmp

Filesize
276KB

Download
memory/1608-182-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1608-179-0x0000000000370000-0x00000000003B5000-memory.dmp

Filesize
276KB

Download
memory/1608-168-0x0000000000604000-0x0000000000605000-memory.dmp

Filesize
4KB

Download
memory/1608-163-0x0000000000370000-0x00000000003B5000-memory.dmp

Filesize
276KB

Download
memory/1608-167-0x0000000000600000-0x0000000000645000-memory.dmp

Filesize
276KB

Download
memory/1608-166-0x0000000000370000-0x00000000003B5000-memory.dmp

Filesize
276KB

Download
memory/1608-149-0x0000000000224000-0x0000000000225000-memory.dmp

Filesize
4KB

Download
memory/1720-130-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1720-111-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1720-113-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1720-115-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1720-118-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1720-127-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2100-12-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2172-54-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2172-61-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2172-58-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2172-67-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2172-74-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2172-56-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2172-64-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2256-143-0x00000000026B0000-0x0000000002714000-memory.dmp

Filesize
400KB

Download
memory/2256-7-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2256-144-0x00000000026B0000-0x0000000002714000-memory.dmp

Filesize
400KB

Download
memory/2256-82-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2256-2-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2256-4-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2256-0-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2256-13-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2256-16-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2256-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2256-214-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2256-15-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2484-45-0x0000000002FF0000-0x0000000003AAA000-memory.dmp

Filesize
10.7MB

Download
memory/2552-72-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2868-99-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2868-84-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2868-86-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2868-88-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2868-176-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2868-91-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2868-101-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2868-102-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download