modiloader | b1c39c945d8a291715b7822601fc81c4387445df8e6e0bb5e8b96a751946e9cb

Analysis

max time kernel
149s
max time network
136s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe
Size

856KB
MD5

00d6eaf77b9c8558283fd6c6c67ac836
SHA1

7effc19117a3111fd734ad2c5126f59768462bd3
SHA256

b1c39c945d8a291715b7822601fc81c4387445df8e6e0bb5e8b96a751946e9cb
SHA512

e6bcfa542327b1b090fdbe248ead3f7687fed67fd3be9d6b55ff43d28fabca96bf2aca02554ccec321ec8b2afcd80ee1f8365448201daabc1f148a8b9e55922c
SSDEEP

12288:cJjCWhgzbBy8PtV9m2YkA4UrCuMtfQBSo7n4fUT2a6A2QeTF0XhMdUyGtd:cJmmgP5PikA43xsr4Y2a6A2nChuUr

Score

10^/10

modiloader discovery evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\d2f57668\\X"	Explorer.EXE

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	HM23Yh.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	faeluif.exe

ModiLoader Second Stage 9 IoCs

resource	yara_rule
behavioral1/memory/2888-14-0x0000000000400000-0x000000000052D000-memory.dmp	modiloader_stage2
behavioral1/memory/2888-12-0x0000000000400000-0x000000000052D000-memory.dmp	modiloader_stage2
behavioral1/memory/2760-9-0x0000000000400000-0x0000000000420000-memory.dmp	modiloader_stage2
behavioral1/files/0x0008000000016d29-43.dat	modiloader_stage2
behavioral1/memory/2684-70-0x0000000000400000-0x000000000041F000-memory.dmp	modiloader_stage2
behavioral1/files/0x0008000000016d31-73.dat	modiloader_stage2
behavioral1/memory/2888-81-0x0000000000400000-0x000000000052D000-memory.dmp	modiloader_stage2
behavioral1/memory/3040-94-0x0000000000400000-0x000000000041F000-memory.dmp	modiloader_stage2
behavioral1/memory/2888-193-0x0000000000400000-0x000000000052D000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
532	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
2056	HM23Yh.exe
2936	faeluif.exe
2684	awhost.exe
2160	awhost.exe
3040	bwhost.exe
2840	bwhost.exe
2820	cwhost.exe
1168	dwhost.exe
340	csrss.exe
2188	X
1196	Explorer.EXE
2016	ewhost.exe

Loads dropped DLL 18 IoCs

pid	Process
2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe
2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe
2056	HM23Yh.exe
2056	HM23Yh.exe
2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe
2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe
2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe
2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe
2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe
2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe
2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe
2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe
1168	dwhost.exe
1168	dwhost.exe
1168	dwhost.exe
2188	X
2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe
2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /u"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /L"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /p"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /s"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /j"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /R"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /g"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /S"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /B"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /f"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /Y"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /F"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /I"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /Q"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /o"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /b"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /a"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /A"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /V"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /W"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /r"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /E"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /q"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /h"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /K"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /n"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /M"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /N"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /i"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /C"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /Z"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /P"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /D"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /O"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /e"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /y"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /U"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /l"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /k"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /v"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /z"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /x"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /m"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /t"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /H"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /G"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /T"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /c"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /w"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /X"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /d"	faeluif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /K"	HM23Yh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeluif = "C:\\Users\\Admin\\faeluif.exe /J"	faeluif.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	awhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	awhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	bwhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	bwhost.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2020	tasklist.exe
2336	tasklist.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2760 set thread context of 2888	2760	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	30
PID 2684 set thread context of 2160	2684	awhost.exe	38
PID 3040 set thread context of 2840	3040	bwhost.exe	40
PID 1168 set thread context of 776	1168	dwhost.exe	46

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2888-3-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2888-11-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2888-14-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2888-12-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2888-5-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2888-2-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2888-81-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2840-97-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/2840-96-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/2840-91-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/2840-87-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/2840-85-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/2840-162-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/2888-193-0x0000000000400000-0x000000000052D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	awhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faeluif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HM23Yh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{c083cd7f-4678-8cf0-12c0-a23b769d6830}\cid = "5232661423331444341"	explorer.exe
Key created	\registry\machine\Software\Classes\Interface\{c083cd7f-4678-8cf0-12c0-a23b769d6830}	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{c083cd7f-4678-8cf0-12c0-a23b769d6830}\u = "860049491"	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2056	HM23Yh.exe
2056	HM23Yh.exe
2936	faeluif.exe
2936	faeluif.exe
2160	awhost.exe
2936	faeluif.exe
2160	awhost.exe
2160	awhost.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2840	bwhost.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2028	explorer.exe
2028	explorer.exe
2028	explorer.exe
2936	faeluif.exe
2188	X
2160	awhost.exe
2160	awhost.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2160	awhost.exe
2160	awhost.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2160	awhost.exe
2160	awhost.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2160	awhost.exe
2160	awhost.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2160	awhost.exe
2160	awhost.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe
2936	faeluif.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2336	tasklist.exe
Token: SeDebugPrivilege	2028	explorer.exe
Token: SeDebugPrivilege	2020	tasklist.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe
2056	HM23Yh.exe
2936	faeluif.exe
2016	ewhost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
340	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2888	2760	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	30
PID 2760 wrote to memory of 2888	2760	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	30
PID 2760 wrote to memory of 2888	2760	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	30
PID 2760 wrote to memory of 2888	2760	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	30
PID 2760 wrote to memory of 2888	2760	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	30
PID 2760 wrote to memory of 2888	2760	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	30
PID 2760 wrote to memory of 2888	2760	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	30
PID 2760 wrote to memory of 2888	2760	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	30
PID 2888 wrote to memory of 2056	2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	31
PID 2888 wrote to memory of 2056	2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	31
PID 2888 wrote to memory of 2056	2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	31
PID 2888 wrote to memory of 2056	2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	31
PID 2056 wrote to memory of 2936	2056	HM23Yh.exe	32
PID 2056 wrote to memory of 2936	2056	HM23Yh.exe	32
PID 2056 wrote to memory of 2936	2056	HM23Yh.exe	32
PID 2056 wrote to memory of 2936	2056	HM23Yh.exe	32
PID 2056 wrote to memory of 2680	2056	HM23Yh.exe	33
PID 2056 wrote to memory of 2680	2056	HM23Yh.exe	33
PID 2056 wrote to memory of 2680	2056	HM23Yh.exe	33
PID 2056 wrote to memory of 2680	2056	HM23Yh.exe	33
PID 2680 wrote to memory of 2336	2680	cmd.exe	35
PID 2680 wrote to memory of 2336	2680	cmd.exe	35
PID 2680 wrote to memory of 2336	2680	cmd.exe	35
PID 2680 wrote to memory of 2336	2680	cmd.exe	35
PID 2888 wrote to memory of 2684	2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	37
PID 2888 wrote to memory of 2684	2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	37
PID 2888 wrote to memory of 2684	2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	37
PID 2888 wrote to memory of 2684	2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	37
PID 2684 wrote to memory of 2160	2684	awhost.exe	38
PID 2684 wrote to memory of 2160	2684	awhost.exe	38
PID 2684 wrote to memory of 2160	2684	awhost.exe	38
PID 2684 wrote to memory of 2160	2684	awhost.exe	38
PID 2684 wrote to memory of 2160	2684	awhost.exe	38
PID 2684 wrote to memory of 2160	2684	awhost.exe	38
PID 2684 wrote to memory of 2160	2684	awhost.exe	38
PID 2684 wrote to memory of 2160	2684	awhost.exe	38
PID 2684 wrote to memory of 2160	2684	awhost.exe	38
PID 2684 wrote to memory of 2160	2684	awhost.exe	38
PID 2684 wrote to memory of 2160	2684	awhost.exe	38
PID 2888 wrote to memory of 3040	2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	39
PID 2888 wrote to memory of 3040	2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	39
PID 2888 wrote to memory of 3040	2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	39
PID 2888 wrote to memory of 3040	2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	39
PID 3040 wrote to memory of 2840	3040	bwhost.exe	40
PID 3040 wrote to memory of 2840	3040	bwhost.exe	40
PID 3040 wrote to memory of 2840	3040	bwhost.exe	40
PID 3040 wrote to memory of 2840	3040	bwhost.exe	40
PID 3040 wrote to memory of 2840	3040	bwhost.exe	40
PID 3040 wrote to memory of 2840	3040	bwhost.exe	40
PID 3040 wrote to memory of 2840	3040	bwhost.exe	40
PID 3040 wrote to memory of 2840	3040	bwhost.exe	40
PID 2888 wrote to memory of 2820	2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	41
PID 2888 wrote to memory of 2820	2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	41
PID 2888 wrote to memory of 2820	2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	41
PID 2888 wrote to memory of 2820	2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	41
PID 2820 wrote to memory of 2028	2820	cwhost.exe	42
PID 2820 wrote to memory of 2028	2820	cwhost.exe	42
PID 2820 wrote to memory of 2028	2820	cwhost.exe	42
PID 2820 wrote to memory of 2028	2820	cwhost.exe	42
PID 2820 wrote to memory of 2028	2820	cwhost.exe	42
PID 2820 wrote to memory of 2028	2820	cwhost.exe	42
PID 2028 wrote to memory of 340	2028	explorer.exe	2
PID 2888 wrote to memory of 1168	2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	43
PID 2888 wrote to memory of 1168	2888	00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe	43

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
PID:340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:860
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:1860

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
PID:1196
- C:\Users\Admin\AppData\Local\Temp\00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Users\Admin\AppData\Local\Temp\00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe
    00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Users\Admin\HM23Yh.exe
      C:\Users\Admin\HM23Yh.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2056
    - - C:\Users\Admin\faeluif.exe
        
        "C:\Users\Admin\faeluif.exe"
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2936
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c tasklist&&del HM23Yh.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2680
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2336
  - - C:\Users\Admin\awhost.exe
      C:\Users\Admin\awhost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2684
    - - C:\Users\Admin\awhost.exe
        
        awhost.exe
        5⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2160
  - - C:\Users\Admin\bwhost.exe
      C:\Users\Admin\bwhost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3040
    - - C:\Users\Admin\bwhost.exe
        
        bwhost.exe
        5⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2840
  - - C:\Users\Admin\cwhost.exe
      C:\Users\Admin\cwhost.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2820
    - - C:\Windows\explorer.exe
        
        00000088*
        5⤵
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2028
  - - C:\Users\Admin\dwhost.exe
      C:\Users\Admin\dwhost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1168
    - - C:\Users\Admin\AppData\Local\d2f57668\X
        
        193.105.154.210:80
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:2188
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:776
  - - C:\Users\Admin\ewhost.exe
      C:\Users\Admin\ewhost.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2016
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del 00d6eaf77b9c8558283fd6c6c67ac836_JaffaCakes118.exe
      4⤵
      Deletes itself
      System Location Discovery: System Language Discovery
      PID:532
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\d2f57668\@

Filesize
2KB

MD5
9f07c4a67dbf752b6e32e815c0ac7728

SHA1
faef5b8f91e00af204351136aa884ce790c70c55

SHA256
7ead63d0c9b4261f952aeaacd5a61a99998df9a07f3b5d770e8e7c8910b76651

SHA512
280cc13e0af907b5779cfda9902dea5618eae5e844e09912f2685c7df52ce9fa15b93eb05f71e52fae30d425a6fa540b29a78210414004f4ba4fc8c87408ce4e

Download Submit
C:\Windows\system32\consrv.DLL

Filesize
52KB

MD5
c7570a7e24b29ee04a48c2c99da2587b

SHA1
b6e3635a8de44b1635e8d362ac131e14281feb24

SHA256
717cd7661c09701ee39c505d8b604ea3dd6c1151ef18e7ed1cab3832552ac34b

SHA512
57479d2f5386ace8cc5e5ed543e6ad2c2b7b58accc849807d804a8cf0d03080f328f7b42442422fa1483a01ad473ca302f9eca97b9eb24e699e22db56641c572

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
7425414973a9e3e912e07cc4e1c89504

SHA1
ed32f82be44f57de5938f6781b1375eb5a46a82f

SHA256
c82b8fb5596349e92fd3f5fae36953f9bc4689a8d0f3212dd9125b9d8f666546

SHA512
cd0cf24a501bc3b5e6771abce46bf1a0ee4abbf0b400bd51287d458834d9631337fee67853c0dfb122d8d22b3af2ba38d99084ff71487244058e521b71bef64b

Download Submit
\Users\Admin\AppData\Local\d2f57668\X

Filesize
41KB

MD5
686b479b0ee164cf1744a8be359ebb7d

SHA1
8615e8f967276a85110b198d575982a958581a07

SHA256
fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b

SHA512
7ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64

Download Submit
\Users\Admin\HM23Yh.exe

Filesize
224KB

MD5
b9204dce58a6e81de3b3306eb6cb03e5

SHA1
ceb777de961f82c42b9b71dca67b8e56a31908a3

SHA256
438f71f74c972c3ed35a21bbc93cbc8dd1fb3cf17fd789ae730e60e53816b472

SHA512
f555f397416efd33bf9591dd08ad27a4dfed1d26cbfb9d73dc4c3ae130da8ce254d4bfc1e70406f3c92565d28e045469b3ba3b172bd5d19c5876708bb1aa37ed

Download Submit
\Users\Admin\awhost.exe

Filesize
270KB

MD5
5efdb148d618a6b6d2369fccd60f4212

SHA1
7e2045b55c33af87848088738215af2bf7ad0b9b

SHA256
db7e3eef1813f386579a2dd11587077c6888809ac9c9e33c7584eb301402203b

SHA512
e63d8d4caf1cc98bc9beb168302c89885b12175a5802e2e7f507d30bce04eb67ce1f81519f544da297bbb581f59c5baab8ed3fd9b3f7f911a884095603587a21

Download Submit
\Users\Admin\bwhost.exe

Filesize
157KB

MD5
2dd258fd2e5a7fccd81b8af93c08780b

SHA1
a5373acdb7f4684b032954e9e754593ddcc827b2

SHA256
00d8a5382bc4f61a6836bc2b22c05b57485bdf2550188c456f1a854d8a885ca9

SHA512
20048701859ed645bc678a3a45a3ef45cee1d31edfba2ab6cc8edbb03bad6174b541694ac09f4dc58c58241a93d592deb049c33d22ef3cc9f0a6eaac925111df

Download Submit
\Users\Admin\cwhost.exe

Filesize
150KB

MD5
d91ada984db5e7adbf2b80c2284c12f6

SHA1
31e9b27095ac041687b016006f41ea6e5222202d

SHA256
8cbabd93630154a79f8f0c52964f330b44b427631403c3eef4b6c6fc87649948

SHA512
8a0eea5b8ffc4c8d4bdf1e551e6c11e8d188f2209666e2f4b6a74bed99105264510a612a7a1e72f7142584386891ab4aa95946110b8fe623d5b2035494da0748

Download Submit
\Users\Admin\dwhost.exe

Filesize
333KB

MD5
1aceb282a6d05fcc08f3f74f5483bf0a

SHA1
778e34df0c35fee3ab8b7f1af14b2b4ce948ea7b

SHA256
d62b7050a4ada5513bb9f24c79cf782a8675122ef7833bc8c91cb107fe71fc6d

SHA512
5f2c02faa69f1f3f32affc898773d92738a9944a59ad2a28cebe192b0ad1089363c8e3bbc1d202097b160c1b2dada71fc0f03a1a0744dbc2c72cc3273a4629f8

Download Submit
\Users\Admin\ewhost.exe

Filesize
36KB

MD5
4bcd12fdaa17197a658a5113af9120ec

SHA1
3ac79b0b793e390cf1dea82c1754ec34aab1ea46

SHA256
e781bf0233fb732b4b6935255af5cf33b7f0a58bad54b70408c347d2e83dbf96

SHA512
dab61b32fc43b2f55a197ebdf1b8c5709ed97e99530fb31a33ec077c25812f075733ff5e97cc5eebe01d8b83cd29ba104caba02b7a8cdf7e13f43e18432ccbdd

Download Submit
\Users\Admin\faeluif.exe

Filesize
224KB

MD5
d5fb0bb3ededbef4bbd291f7692f0240

SHA1
cdcb8648099e5c6ba460eb73ad03b07899d56078

SHA256
4ac8acb0d40e35c3f3c2c98840fd07d757c42e76aae7717ec6a6cb20a9520605

SHA512
09a38584dcdb827b67145349806e432ad49f89d35e7dd9ed5f86f19b64bacf9a4971f1305fa44347b08749e0b9fae24a8cf283f5fd12c8203d14fe57d7aa3551

Download Submit
\Windows\assembly\GAC_32\Desktop.ini

Filesize
4KB

MD5
80dbc7d15fdf94f16bb4a739cd9c3f98

SHA1
c0f3f20b360ce78cc153fa514e5f62c06f68feb7

SHA256
20b2d1e1b5348ed92f7e2eaedba4348e446970c13c6226f34a816503aa956c91

SHA512
cf8d820104ee3db4a103fb19d38267fe2f5095a29777bf3bcde95d4299360681cedd421251af92038da3f8709e68f101f7326ad9abdd087a59ca83adec87bc48

Download Submit
\Windows\assembly\GAC_64\Desktop.ini

Filesize
5KB

MD5
78ab98fd9228277f2638fd93cd703016

SHA1
1640ee7f500074c155a5af431e9d125a4ec2cea5

SHA256
e0517a9584af6cfd4f1e6d280e086b20fd576b90b32f9ddac916de03a53b766c

SHA512
d98ed49a83d5b50737a674e4421cea4cbe353f80234d2d5a8df82995a0d81e9524f23919ca600afb98bc676a8f93e7c0df73c22cae9b3fc624027800ba9dcc76

Download Submit
memory/340-135-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/1196-149-0x0000000002510000-0x000000000251B000-memory.dmp

Filesize
44KB

Download
memory/2028-112-0x0000000000130000-0x0000000000149000-memory.dmp

Filesize
100KB

Download
memory/2028-117-0x0000000000130000-0x0000000000149000-memory.dmp

Filesize
100KB

Download
memory/2028-122-0x0000000000130000-0x0000000000149000-memory.dmp

Filesize
100KB

Download
memory/2160-51-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2160-61-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2160-53-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2160-58-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2160-66-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2160-64-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2160-55-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2160-72-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-70-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2760-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2820-111-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2820-107-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2840-83-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2840-85-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2840-87-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2840-91-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2840-96-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2840-97-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2840-162-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2888-104-0x00000000006C0000-0x0000000000704000-memory.dmp

Filesize
272KB

Download
memory/2888-105-0x00000000006C0000-0x0000000000704000-memory.dmp

Filesize
272KB

Download
memory/2888-3-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2888-2-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2888-0-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2888-5-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2888-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2888-12-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2888-81-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2888-14-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2888-193-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2888-11-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/3040-94-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download