modiloader | e80421e725e99a4b97fc2a5492f1e0eaa87777a14a7aa11c202b1613c151331c

Analysis

max time kernel
150s
max time network
136s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-11-2024 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe
Size

653KB
MD5

85b780f08b016dd454c2a0f4bf2c91eb
SHA1

0393172b0a8332f81e7f5bb61921855b80524814
SHA256

e80421e725e99a4b97fc2a5492f1e0eaa87777a14a7aa11c202b1613c151331c
SHA512

dd5504472fa52946cdb545a7a331ff032b30b19422e38dba91808767b8e2501337bc250cf22c49e3fc1046e1252129962f600ca84e12f09886ffc4479f2d9b82
SSDEEP

12288:tE0NR1s/Z5jrzIezVVRmy9S60TDJ0tIl6UTcmKGJ+1lqteLRXbRww786a:tE5/ZNrzXBVAy9S6Bt06UAmBQqt0Rbl

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 41 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2380-1-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2380-13-0x00000000031A0000-0x000000000333C000-memory.dmp	modiloader_stage2
behavioral1/memory/2112-39-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2536-32-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2380-40-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2112-42-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2892-46-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2892-50-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2112-51-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2112-52-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/1160-57-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/1160-61-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2556-492-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2556-496-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2112-497-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/1584-505-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2112-507-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2468-513-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2052-520-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/1064-530-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/3036-540-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/1864-551-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/1972-562-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2556-571-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2112-572-0x0000000003210000-0x00000000033AC000-memory.dmp	modiloader_stage2
behavioral1/memory/1212-779-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2072-1020-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2072-1025-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/1096-1035-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2808-1045-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2576-1054-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2556-1065-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/1212-1074-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/1536-1085-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2072-1093-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/1212-1105-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/1376-1115-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2112-1116-0x0000000003210000-0x00000000033AC000-memory.dmp	modiloader_stage2
behavioral1/memory/2476-1126-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2
behavioral1/memory/2112-1128-0x0000000003210000-0x00000000033AC000-memory.dmp	modiloader_stage2
behavioral1/memory/2808-1136-0x0000000000400000-0x000000000059C000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
2756	cmd.exe

Executes dropped EXE 25 IoCs

Processes:

rejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exe

pid	Process
2536	rejoice47.exe
2892	rejoice47.exe
1160	rejoice47.exe
2556	rejoice47.exe
1584	rejoice47.exe
2468	rejoice47.exe
2052	rejoice47.exe
1064	rejoice47.exe
3036	rejoice47.exe
1864	rejoice47.exe
1972	rejoice47.exe
2556	rejoice47.exe
1212	rejoice47.exe
2072	rejoice47.exe
1096	rejoice47.exe
2808	rejoice47.exe
2576	rejoice47.exe
2556	rejoice47.exe
1212	rejoice47.exe
1536	rejoice47.exe
2072	rejoice47.exe
1212	rejoice47.exe
1376	rejoice47.exe
2476	rejoice47.exe
2808	rejoice47.exe

Loads dropped DLL 26 IoCs

Processes:

85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.execalc.exe

pid	Process
2380	85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe
2380	85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe
2112	calc.exe

Drops file in System32 directory 2 IoCs

Processes:

rejoice47.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\_rejoice47.exe	rejoice47.exe
File opened for modification	C:\Windows\SysWOW64\_rejoice47.exe	rejoice47.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 27 IoCs

Processes:

85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exerejoice47.execalc.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exerejoice47.exe

pid	Process
2380	85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe
2536	rejoice47.exe
2112	calc.exe
2892	rejoice47.exe
1160	rejoice47.exe
2556	rejoice47.exe
1584	rejoice47.exe
2468	rejoice47.exe
2052	rejoice47.exe
1064	rejoice47.exe
3036	rejoice47.exe
1864	rejoice47.exe
1972	rejoice47.exe
2556	rejoice47.exe
1212	rejoice47.exe
2072	rejoice47.exe
1096	rejoice47.exe
2808	rejoice47.exe
2576	rejoice47.exe
2556	rejoice47.exe
1212	rejoice47.exe
1536	rejoice47.exe
2072	rejoice47.exe
1212	rejoice47.exe
1376	rejoice47.exe
2476	rejoice47.exe
2808	rejoice47.exe

Suspicious use of SetThreadContext 25 IoCs

Processes:

description	pid	Process	procid_target
PID 2536 set thread context of 2112	2536	rejoice47.exe	31
PID 2892 set thread context of 2948	2892	rejoice47.exe	36
PID 1160 set thread context of 1084	1160	rejoice47.exe	39
PID 2556 set thread context of 2012	2556	rejoice47.exe	43
PID 1584 set thread context of 3024	1584	rejoice47.exe	46
PID 2468 set thread context of 2328	2468	rejoice47.exe	49
PID 2052 set thread context of 376	2052	rejoice47.exe	51
PID 1064 set thread context of 2912	1064	rejoice47.exe	54
PID 3036 set thread context of 2464	3036	rejoice47.exe	56
PID 1864 set thread context of 1376	1864	rejoice47.exe	59
PID 1972 set thread context of 816	1972	rejoice47.exe	61
PID 2556 set thread context of 1700	2556	rejoice47.exe	64
PID 1212 set thread context of 2836	1212	rejoice47.exe	66
PID 2072 set thread context of 2772	2072	rejoice47.exe	69
PID 1096 set thread context of 2844	1096	rejoice47.exe	71
PID 2808 set thread context of 2208	2808	rejoice47.exe	74
PID 2576 set thread context of 1532	2576	rejoice47.exe	76
PID 2556 set thread context of 2496	2556	rejoice47.exe	79
PID 1212 set thread context of 2844	1212	rejoice47.exe	81
PID 1536 set thread context of 1376	1536	rejoice47.exe	83
PID 2072 set thread context of 768	2072	rejoice47.exe	86
PID 1212 set thread context of 288	1212	rejoice47.exe	88
PID 1376 set thread context of 2540	1376	rejoice47.exe	90
PID 2476 set thread context of 2512	2476	rejoice47.exe	93
PID 2808 set thread context of 1356	2808	rejoice47.exe	95

Drops file in Program Files directory 2 IoCs

Processes:

85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe	85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe	85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rejoice47.exerejoice47.exerejoice47.exe85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exeIEXPLORE.EXEIEXPLORE.EXErejoice47.execmd.exeIEXPLORE.EXErejoice47.exeIEXPLORE.EXErejoice47.exerejoice47.exerejoice47.exeIEXPLORE.EXErejoice47.exerejoice47.execalc.exerejoice47.exerejoice47.exeIEXPLORE.EXErejoice47.exeIEXPLORE.EXErejoice47.exerejoice47.exerejoice47.exeIEXPLORE.EXErejoice47.exeIEXPLORE.EXErejoice47.exeIEXPLORE.EXEIEXPLORE.EXErejoice47.exerejoice47.exerejoice47.exerejoice47.exeIEXPLORE.EXErejoice47.exerejoice47.exerejoice47.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice47.exe

Modifies Internet Explorer settings 1 TTPs 47 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BEF88A51-991F-11EF-BF50-D686196AC2C0} = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3200000032000000b804000097020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "436716578"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff19000000190000009f0400007e020000	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff4b00000000000000d104000065020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6400000019000000ea0400007e020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 24 IoCs

Processes:

IEXPLORE.EXE

pid	Process
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	Process
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exerejoice47.execalc.exerejoice47.exeIEXPLORE.EXErejoice47.exerejoice47.exerejoice47.exe

description	pid	Process	procid_target
PID 2380 wrote to memory of 2536	2380	85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2536	2380	85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2536	2380	85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2536	2380	85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe	30
PID 2536 wrote to memory of 2112	2536	rejoice47.exe	31
PID 2536 wrote to memory of 2112	2536	rejoice47.exe	31
PID 2536 wrote to memory of 2112	2536	rejoice47.exe	31
PID 2536 wrote to memory of 2112	2536	rejoice47.exe	31
PID 2536 wrote to memory of 2112	2536	rejoice47.exe	31
PID 2536 wrote to memory of 2112	2536	rejoice47.exe	31
PID 2380 wrote to memory of 2756	2380	85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe	32
PID 2380 wrote to memory of 2756	2380	85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe	32
PID 2380 wrote to memory of 2756	2380	85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe	32
PID 2380 wrote to memory of 2756	2380	85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe	32
PID 2112 wrote to memory of 2892	2112	calc.exe	35
PID 2112 wrote to memory of 2892	2112	calc.exe	35
PID 2112 wrote to memory of 2892	2112	calc.exe	35
PID 2112 wrote to memory of 2892	2112	calc.exe	35
PID 2892 wrote to memory of 2948	2892	rejoice47.exe	36
PID 2892 wrote to memory of 2948	2892	rejoice47.exe	36
PID 2892 wrote to memory of 2948	2892	rejoice47.exe	36
PID 2892 wrote to memory of 2948	2892	rejoice47.exe	36
PID 2892 wrote to memory of 2948	2892	rejoice47.exe	36
PID 2948 wrote to memory of 2840	2948	IEXPLORE.EXE	37
PID 2948 wrote to memory of 2840	2948	IEXPLORE.EXE	37
PID 2948 wrote to memory of 2840	2948	IEXPLORE.EXE	37
PID 2948 wrote to memory of 2840	2948	IEXPLORE.EXE	37
PID 2112 wrote to memory of 1160	2112	calc.exe	38
PID 2112 wrote to memory of 1160	2112	calc.exe	38
PID 2112 wrote to memory of 1160	2112	calc.exe	38
PID 2112 wrote to memory of 1160	2112	calc.exe	38
PID 1160 wrote to memory of 1084	1160	rejoice47.exe	39
PID 1160 wrote to memory of 1084	1160	rejoice47.exe	39
PID 1160 wrote to memory of 1084	1160	rejoice47.exe	39
PID 1160 wrote to memory of 1084	1160	rejoice47.exe	39
PID 1160 wrote to memory of 1084	1160	rejoice47.exe	39
PID 2948 wrote to memory of 1680	2948	IEXPLORE.EXE	40
PID 2948 wrote to memory of 1680	2948	IEXPLORE.EXE	40
PID 2948 wrote to memory of 1680	2948	IEXPLORE.EXE	40
PID 2948 wrote to memory of 1680	2948	IEXPLORE.EXE	40
PID 2112 wrote to memory of 2556	2112	calc.exe	42
PID 2112 wrote to memory of 2556	2112	calc.exe	42
PID 2112 wrote to memory of 2556	2112	calc.exe	42
PID 2112 wrote to memory of 2556	2112	calc.exe	42
PID 2556 wrote to memory of 2012	2556	rejoice47.exe	43
PID 2556 wrote to memory of 2012	2556	rejoice47.exe	43
PID 2556 wrote to memory of 2012	2556	rejoice47.exe	43
PID 2556 wrote to memory of 2012	2556	rejoice47.exe	43
PID 2556 wrote to memory of 2012	2556	rejoice47.exe	43
PID 2948 wrote to memory of 2392	2948	IEXPLORE.EXE	44
PID 2948 wrote to memory of 2392	2948	IEXPLORE.EXE	44
PID 2948 wrote to memory of 2392	2948	IEXPLORE.EXE	44
PID 2948 wrote to memory of 2392	2948	IEXPLORE.EXE	44
PID 2112 wrote to memory of 1584	2112	calc.exe	45
PID 2112 wrote to memory of 1584	2112	calc.exe	45
PID 2112 wrote to memory of 1584	2112	calc.exe	45
PID 2112 wrote to memory of 1584	2112	calc.exe	45
PID 1584 wrote to memory of 3024	1584	rejoice47.exe	46
PID 1584 wrote to memory of 3024	1584	rejoice47.exe	46
PID 1584 wrote to memory of 3024	1584	rejoice47.exe	46
PID 1584 wrote to memory of 3024	1584	rejoice47.exe	46
PID 1584 wrote to memory of 3024	1584	rejoice47.exe	46
PID 2948 wrote to memory of 2548	2948	IEXPLORE.EXE	47
PID 2948 wrote to memory of 2548	2948	IEXPLORE.EXE	47

C:\Users\Admin\AppData\Local\Temp\85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2892
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2948
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:275457 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2840
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:2700295 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1680
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:2700302 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2392
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:1455121 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2548
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:1455146 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1672
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:1258547 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2336
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:996400 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1704
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:734269 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2832
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:799830 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2768
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:2962497 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2972
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:2241625 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:1748
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:1913977 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2648
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1160
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:1084
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:2012
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1584
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:3024
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:2468
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:2328
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:2052
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:376
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1064
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:2912
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:3036
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:2464
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1864
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:1376
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1972
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:816
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:2556
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:1700
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1212
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:2836
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:2072
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:2772
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1096
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:2844
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:2808
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:2208
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:2576
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:1532
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:2556
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:2496
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1212
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:2844
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1536
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:1376
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:2072
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:768
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1212
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:288
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1376
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:2540
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:2476
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:2512
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:2808
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:1356
- C:\Windows\SysWOW64\cmd.exe
  cmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f91016da6b45715f6ac394b4f508d2ce

SHA1
0c5274ae267c19cfa7c01c2f6da5e833aa1852e1

SHA256
0dbc89f811ba5961fe8710590ce5e20eb31e1deefb0d8cc2fad4168ff6c83f15

SHA512
b2d26d7847a22dbbfa4aa99cedfe1dc6bc237a69c9b6f7d3cbd4ce916269000d2e2c0cecdc0662ac75387fdc4dbbf198fc0f0e77c18eddc2c8bb39751051ad88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f531e815461ba5a49a9beae1237667e3

SHA1
aa07c1a23e3768edeca19b0df22fb3220df2c70b

SHA256
1ec16414e8da45a54f6d83a894d2996855e9188f717e23dcfc6fa21d9845b923

SHA512
e6f76370827ea7c7b9cc8f41c39bb4f9b680d371414779a9762b5e61d27cf1dab5d83e47ad11e77918aeb42100f15aea9596ee84b9739965499a2bf6a9d20cec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20ceb04aa77f499a8cf1f30cad7c9c1f

SHA1
ac6056e2285663fd2d5fa18be084564519b8b6c5

SHA256
cb228fc71912037eee631385e1899a63d0012b0e119d391821e2e6908ceabb20

SHA512
2aed53426b8ae785760cf79100ea2f742c00612d1d6ebcf604adebbbf0d5f58f2fb0c6c2dc84ad310380efcb428138ffc2df6921912df2ce4eff1ce44ac23f30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62693eb133fc9534994beb7b06c1fbf8

SHA1
0bf028bc7e31ff6a0d48253f80ff6a1438aa658d

SHA256
03f39438c336c8dd82dc118c07fc326c68afca905f3c220a0d166fb626361bf3

SHA512
8071b62a63e0eab5c44a456ad2dfc5bcc055037133892c41e7c093fd7ebf0e9c4d57aec51069587fe0d13da86abfa82d8b4553f31bcee84e98dba3daf4c10e9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ce47b5df7c4c0125a4609a50ce5c6c7

SHA1
c28427156c6bcbc7500ec17473285355928c4631

SHA256
480f2d28b07084a9f90d201a837e901524953e1aba6f92ad41f4a9d552438d38

SHA512
5cfbea600310912f105521934fb65f986b256af803b0b1b1713ba585a1d99116a14932a9f2f330832652be5cb5c7ae2c43520ba2d16b3c5e72963b8f46cbc8cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0266debd82cf6c734deb167290502f61

SHA1
bc5099e8c6c60ad1df4e6e86d6b41842614bf076

SHA256
a73a322ed53972fd88bdd382bb029faeed5cbca615fc8ad70952b2412275c716

SHA512
a253616df5ce9e869d576be2a79b7e5258eff325afc722c96119891f3ae7ed62780844387da8897d7a207c24a9f37cba10bc63475f995429cd08f9dd5da48dbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99c263e8f152be84bc5060be23fcc9d6

SHA1
af456d2baf42fbc7ed01cb6b4a0c946419c4ed14

SHA256
4be80edd6198c89731fa7c51db8384f0aa70badcfd5969b894b90588059b4ae1

SHA512
c3f2ccbdcf5eab9467858fb458cc86a0611db61010d229da507ce66e17f64dc0b70b51c82b8aa821d25be7a105e8c0e91f5fd0d698f703a51edc09592e9ca06f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6e6c5a8b13b4bf5097122796a5df399

SHA1
5f871c5c85f42b493f2f7b62c44c8d4f4a2514c2

SHA256
4283479b0d47c87501fbc4a8231a0cd609c39a1e6f22dc1fc45c47196879b3cd

SHA512
bc8deccd357d31a410938c2a282c15966d1dcf4c1e3a019bece67179ea0b09f20fd7a31638b134edc4f001c063bee7c5efbd70d238a3c32a9ca33837e28ef8ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09c8a9b847c79bf88188e271353abb46

SHA1
4b3060e906e7240e59f1731e24181dcec5ba62c4

SHA256
56d108750652898ba5a5ab6b181610df443a922d3d34da31850841d7ab2b71e0

SHA512
d5a778dea661e0cf73444fa4c5303b89b1fbfa47ff9b41d32507d21a8d8103d5033e0e47183c5105c960ae6867cc68531de380a91061273d31d152c4faea42fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be18393d7cba0e3be0e9e67577043504

SHA1
13732f84129162f378af846925d2c99e9ddd097a

SHA256
21ff6591eee1648959da391476ffc206e7a4a69f2f9273e806a43094c8adc641

SHA512
9c9c60367de5aba3da2a3c09b1ac0cbbef0b91d04d810a0654f7568daed8e4764722569aaf6b01f6a00d64dff6b68e78c557a7b455f9987cef82bfa2e19e5128

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b162714317efdf74d758640c27982aa1

SHA1
17a3fcfa5c8e36a89b2fe9110f1341d4ade0515b

SHA256
301159d022bac7e5cba52048dda2c86789360fa95a25b7b3ab41c4612096c781

SHA512
bb9eb151dbfa5866392cd67f4662e0cb0a59edfaf79c23ad940d8bedd0093810bbdff39b5b2a5fe716ee126376e93a294e84786402408782bb146eca31ab853f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29e714dfc798b61282901f4ab1f7fc2f

SHA1
32a494ab310d703a82c2892efc8f4473d1ef0002

SHA256
94711c79f2c1fb2b558888e35ad5882a18d792f362e1510fd8aa4e47b5d9a771

SHA512
900c6e718ab62eecd47ba4040d979c98ca71e0221b35f66969ae6fe5767bb4ebe1db517366ae7730b67e84651722172b7f0f11fc0a1ffff713d6cced1c7cd311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb3e28fc4609c2d947b64bfdad95cad9

SHA1
9e5e048d39ee912cff6e6fb329efc7deca14024c

SHA256
68bba95da83241454e70d3b189f17a91c6872af0b65f20614f4469ba0c3dda75

SHA512
c76f11504f45b4272c86f60273b3b9e35da3b5a72287bc3d43b32a3d4570e18a928175d4715b15f0286e7acbda0948eea2c6d2d4ce1c496d22e426b0167eb3c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b307a521fdb7f10364920a8f4a3494b8

SHA1
faa544376854309bafdb40a8d5e3622c20350465

SHA256
099c84599f5afdc48c6e0380ec42fcc5127dafd557291583898068f64d9aa9e0

SHA512
23944aaf4d377279494c8bfc21c00569b771ae40119f175a96c22ec29f5d89c8088d2e3e27009cced0c216c790e8047f69d828977ea6515b852983791fa0c126

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
225aab2861422f62fde9d165d62bc1bb

SHA1
897834706bd0f56a7e17e35b39a63a23b73f2aeb

SHA256
1f0a39c2551cbd94d8db751442d8f4a5ca138b857222e58c3180f5cf2ae8205d

SHA512
16899362910966c0696bdf604683ac32aafe59f2546e97df10405b8893fe5528aea051651b8509c424008386b4c366092097112aaf9131531e2bffbf4081b455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f4323298853f3a47b3cf1a74655b793

SHA1
87f23c352dfa85a38814c70b5f238ca73322cbf3

SHA256
d9131c966e7fcbc92146bfe3d81a634f9b5ffa2b767d1d42049de2ea7ae10a19

SHA512
733c04dadaa7344d7174a3ee9bb9c72cd4707d1464d70af8ac199361332b40a8e3c012a92432651c3b6a6747908cd9c4a80c136940322d0b13f4e2752107a828

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05c41e3a8e74a50e3923add2a647fe02

SHA1
d1f9bb0d2e6b5eb93c18a442e08d7f51f1ad0e9f

SHA256
0551995ef25b459e8e223d16dea8820bd4aa7351d829204f50ce44c074a8e794

SHA512
5d0e80e1558faf0e055a38145e9bec09dbc1d03cf530d9a7fbf6683d4355cce110e176bab28f66cc3f2010d5509d2ce78ed682a01665628b8c850c2ec8e1edc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e2f2e1f3510baebc82f4daa412a9e5b

SHA1
acde135f14f9d2ee68ba612fc4377c33ac0ca79b

SHA256
598b450645b80ddcd013fb7046882afb1fcfe1007f995084922c1d389af092c2

SHA512
cd4da746a8af1253adaa6da24a9b07701954c224bdb3ea8dc3fd5af19ca6e62ad82dd42b588fdb38a7e4c49da0a10865a3ced8c0236f9e347e15b82557aeace7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d07f220532b1c4d8e1779447b0519006

SHA1
f2ee227226c7d0e0c234888a96818dcb1eced09f

SHA256
5e9c67446af141ce38c8fd9f4e6fe85bc3a165f47985b4dd3e3075bb6a2e1654

SHA512
152bc9b43be12c9f44553565d65dd0b2b7e32f4d6ceb3a7c6f4575725f6b7d552e3f2e0ca0d6432b9df249419fa09c86c50de8550b7ee4b3be8c62c9f9c173d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5FB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6AB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFCD4425E61D1E5CB3.TMP

Filesize
16KB

MD5
2db4d74aaf4705bf64a6a18a40fe4b96

SHA1
ee4d14bdd25d23b01984bbee015f7910c22a67cb

SHA256
e20c2b7b1d24734222ca1dd3766b8f5fb216cb29b148677dc4d9c01ad4e951bf

SHA512
c80f6a235d584f32eb2241f852737c2e27e7ee48cb8b83abdebc19c5fe9a16cb8cc4de26c965de4ab64ce60581546d84f02946f3047834ab689ef0844cacbfe2

Download Submit
\Program Files\Common Files\Microsoft Shared\MSInfo\rejoice47.exe

Filesize
653KB

MD5
85b780f08b016dd454c2a0f4bf2c91eb

SHA1
0393172b0a8332f81e7f5bb61921855b80524814

SHA256
e80421e725e99a4b97fc2a5492f1e0eaa87777a14a7aa11c202b1613c151331c

SHA512
dd5504472fa52946cdb545a7a331ff032b30b19422e38dba91808767b8e2501337bc250cf22c49e3fc1046e1252129962f600ca84e12f09886ffc4479f2d9b82

Download Submit
memory/376-519-0x00000000001F0000-0x000000000038C000-memory.dmp

Filesize
1.6MB

Download
memory/1064-530-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/1084-60-0x0000000000230000-0x00000000003CC000-memory.dmp

Filesize
1.6MB

Download
memory/1096-1035-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/1160-57-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/1160-56-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/1160-61-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/1212-1105-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/1212-779-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/1212-749-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/1212-1074-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/1212-1098-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/1376-548-0x00000000002F0000-0x000000000048C000-memory.dmp

Filesize
1.6MB

Download
memory/1376-1115-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/1536-1085-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/1536-1078-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/1584-505-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/1864-551-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/1864-544-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/1972-562-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/1972-555-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2012-495-0x0000000000290000-0x000000000042C000-memory.dmp

Filesize
1.6MB

Download
memory/2052-520-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2072-1025-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2072-1020-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2072-1093-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2112-42-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2112-33-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2112-1116-0x0000000003210000-0x00000000033AC000-memory.dmp

Filesize
1.6MB

Download
memory/2112-31-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2112-499-0x0000000003210000-0x00000000033AC000-memory.dmp

Filesize
1.6MB

Download
memory/2112-497-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2112-51-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2112-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2112-44-0x0000000003210000-0x00000000033AC000-memory.dmp

Filesize
1.6MB

Download
memory/2112-531-0x0000000003210000-0x00000000033AC000-memory.dmp

Filesize
1.6MB

Download
memory/2112-507-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2112-572-0x0000000003210000-0x00000000033AC000-memory.dmp

Filesize
1.6MB

Download
memory/2112-52-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2112-34-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2112-1128-0x0000000003210000-0x00000000033AC000-memory.dmp

Filesize
1.6MB

Download
memory/2112-39-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2328-512-0x00000000001B0000-0x000000000034C000-memory.dmp

Filesize
1.6MB

Download
memory/2380-40-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2380-13-0x00000000031A0000-0x000000000333C000-memory.dmp

Filesize
1.6MB

Download
memory/2380-14-0x00000000031A0000-0x000000000333C000-memory.dmp

Filesize
1.6MB

Download
memory/2380-4-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2380-0-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2380-1-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2464-539-0x0000000000170000-0x000000000030C000-memory.dmp

Filesize
1.6MB

Download
memory/2468-513-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2476-1126-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2476-1119-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2536-32-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2536-20-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2536-16-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2556-1065-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2556-1058-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2556-571-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2556-496-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2556-492-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2576-1054-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2808-1045-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2808-1131-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2808-1136-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2892-50-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2892-46-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2948-49-0x00000000002B0000-0x000000000044C000-memory.dmp

Filesize
1.6MB

Download
memory/3024-504-0x00000000002D0000-0x000000000046C000-memory.dmp

Filesize
1.6MB

Download
memory/3036-540-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download