Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 08:39
Behavioral task
behavioral1
Sample
1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
-
Size
856KB
-
MD5
1aa33e05b3da44a1137af63cb38b0c8b
-
SHA1
dd209ca1e39ba994cc317b04ae04b8abfba0e903
-
SHA256
d068ddf6ff4faff8822138c9245dd178663669be5a0243483b837ce5728e0fb8
-
SHA512
be55c66797d182cb6538b585e20351b25ad0d414d272506ba087e8f2159f334093a90cfb414641dd6c823116b1790818dfed32e87059175299d3b5f726d2c1de
-
SSDEEP
12288:cJjCWhgzbBG8PtV9m2YkA4UrCuMtfQBSo7n4fUT2a6A2QeTF0XhMdUyGtd:cJmmgPpPikA43xsr4Y2a6A2nChuUr
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\c1d0fc3f\\X" Explorer.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
HM23Yh.exerioqiuv.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" HM23Yh.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rioqiuv.exe -
ModiLoader Second Stage 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2244-10-0x0000000000400000-0x0000000000420000-memory.dmp modiloader_stage2 behavioral1/memory/2352-15-0x0000000000400000-0x000000000052D000-memory.dmp modiloader_stage2 behavioral1/memory/2352-13-0x0000000000400000-0x000000000052D000-memory.dmp modiloader_stage2 \Users\Admin\awhost.exe modiloader_stage2 behavioral1/memory/2976-72-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 \Users\Admin\bwhost.exe modiloader_stage2 behavioral1/memory/1900-94-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral1/memory/2352-98-0x0000000000400000-0x000000000052D000-memory.dmp modiloader_stage2 behavioral1/memory/2352-193-0x0000000000400000-0x000000000052D000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3008 cmd.exe -
Executes dropped EXE 12 IoCs
Processes:
HM23Yh.exerioqiuv.exeawhost.exeawhost.exebwhost.exebwhost.execwhost.exedwhost.execsrss.exeXExplorer.EXEewhost.exepid process 2612 HM23Yh.exe 2892 rioqiuv.exe 2976 awhost.exe 2212 awhost.exe 1900 bwhost.exe 1716 bwhost.exe 1564 cwhost.exe 2844 dwhost.exe 336 csrss.exe 2920 X 1336 Explorer.EXE 448 ewhost.exe -
Loads dropped DLL 18 IoCs
Processes:
1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exeHM23Yh.exedwhost.exeXpid process 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 2612 HM23Yh.exe 2612 HM23Yh.exe 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 2844 dwhost.exe 2844 dwhost.exe 2844 dwhost.exe 2920 X 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/2352-4-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2352-15-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2352-13-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2352-12-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2352-6-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2352-2-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/1716-88-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1716-99-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1716-97-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1716-96-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1716-91-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1716-85-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2352-98-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2352-107-0x0000000000330000-0x0000000000374000-memory.dmp upx behavioral1/memory/2352-108-0x0000000000330000-0x0000000000374000-memory.dmp upx behavioral1/memory/2352-193-0x0000000000400000-0x000000000052D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 50 IoCs
Processes:
rioqiuv.exeHM23Yh.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /k" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /L" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /i" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /C" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /y" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /J" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /b" HM23Yh.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /R" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /V" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /X" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /j" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /a" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /c" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /u" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /F" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /b" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /M" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /m" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /d" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /D" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /Y" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /r" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /I" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /p" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /U" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /o" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /l" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /e" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /Q" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /A" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /T" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /w" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /E" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /B" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /H" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /n" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /h" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /s" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /z" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /f" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /q" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /O" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /Z" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /N" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /W" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /v" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /S" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /g" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /G" rioqiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioqiuv = "C:\\Users\\Admin\\rioqiuv.exe /t" rioqiuv.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
csrss.exedescription ioc process File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
bwhost.exeawhost.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 bwhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum awhost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 awhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum bwhost.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exeawhost.exebwhost.exedwhost.exedescription pid process target process PID 2244 set thread context of 2352 2244 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe PID 2976 set thread context of 2212 2976 awhost.exe awhost.exe PID 1900 set thread context of 1716 1900 bwhost.exe bwhost.exe PID 2844 set thread context of 1056 2844 dwhost.exe cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 2936 tasklist.exe 2640 tasklist.exe -
Modifies registry class 3 IoCs
Processes:
explorer.exedescription ioc process Key created \registry\machine\Software\Classes\Interface\{a873d410-6fd3-1b1c-08a3-ea6185436e1c} explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{a873d410-6fd3-1b1c-08a3-ea6185436e1c}\u = "860049491" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{a873d410-6fd3-1b1c-08a3-ea6185436e1c}\cid = "3288734356630801463" explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
HM23Yh.exerioqiuv.exeawhost.exebwhost.exeexplorer.exeXpid process 2612 HM23Yh.exe 2612 HM23Yh.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2212 awhost.exe 2892 rioqiuv.exe 2212 awhost.exe 2212 awhost.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 1716 bwhost.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 2920 X 2212 awhost.exe 2212 awhost.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2212 awhost.exe 2212 awhost.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2212 awhost.exe 2212 awhost.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2212 awhost.exe 2212 awhost.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2212 awhost.exe 2212 awhost.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe 2892 rioqiuv.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tasklist.exeexplorer.exetasklist.exedescription pid process Token: SeDebugPrivilege 2640 tasklist.exe Token: SeDebugPrivilege 876 explorer.exe Token: SeDebugPrivilege 2936 tasklist.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1336 Explorer.EXE 1336 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1336 Explorer.EXE 1336 Explorer.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exeHM23Yh.exerioqiuv.exeewhost.exepid process 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 2612 HM23Yh.exe 2892 rioqiuv.exe 448 ewhost.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
csrss.exepid process 336 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exeHM23Yh.execmd.exeawhost.exebwhost.execwhost.exedescription pid process target process PID 2244 wrote to memory of 2352 2244 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe PID 2244 wrote to memory of 2352 2244 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe PID 2244 wrote to memory of 2352 2244 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe PID 2244 wrote to memory of 2352 2244 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe PID 2244 wrote to memory of 2352 2244 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe PID 2244 wrote to memory of 2352 2244 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe PID 2244 wrote to memory of 2352 2244 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe PID 2244 wrote to memory of 2352 2244 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe PID 2352 wrote to memory of 2612 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe HM23Yh.exe PID 2352 wrote to memory of 2612 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe HM23Yh.exe PID 2352 wrote to memory of 2612 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe HM23Yh.exe PID 2352 wrote to memory of 2612 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe HM23Yh.exe PID 2612 wrote to memory of 2892 2612 HM23Yh.exe rioqiuv.exe PID 2612 wrote to memory of 2892 2612 HM23Yh.exe rioqiuv.exe PID 2612 wrote to memory of 2892 2612 HM23Yh.exe rioqiuv.exe PID 2612 wrote to memory of 2892 2612 HM23Yh.exe rioqiuv.exe PID 2612 wrote to memory of 2512 2612 HM23Yh.exe cmd.exe PID 2612 wrote to memory of 2512 2612 HM23Yh.exe cmd.exe PID 2612 wrote to memory of 2512 2612 HM23Yh.exe cmd.exe PID 2612 wrote to memory of 2512 2612 HM23Yh.exe cmd.exe PID 2512 wrote to memory of 2640 2512 cmd.exe tasklist.exe PID 2512 wrote to memory of 2640 2512 cmd.exe tasklist.exe PID 2512 wrote to memory of 2640 2512 cmd.exe tasklist.exe PID 2512 wrote to memory of 2640 2512 cmd.exe tasklist.exe PID 2352 wrote to memory of 2976 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe awhost.exe PID 2352 wrote to memory of 2976 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe awhost.exe PID 2352 wrote to memory of 2976 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe awhost.exe PID 2352 wrote to memory of 2976 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe awhost.exe PID 2976 wrote to memory of 2212 2976 awhost.exe awhost.exe PID 2976 wrote to memory of 2212 2976 awhost.exe awhost.exe PID 2976 wrote to memory of 2212 2976 awhost.exe awhost.exe PID 2976 wrote to memory of 2212 2976 awhost.exe awhost.exe PID 2976 wrote to memory of 2212 2976 awhost.exe awhost.exe PID 2976 wrote to memory of 2212 2976 awhost.exe awhost.exe PID 2976 wrote to memory of 2212 2976 awhost.exe awhost.exe PID 2976 wrote to memory of 2212 2976 awhost.exe awhost.exe PID 2976 wrote to memory of 2212 2976 awhost.exe awhost.exe PID 2976 wrote to memory of 2212 2976 awhost.exe awhost.exe PID 2976 wrote to memory of 2212 2976 awhost.exe awhost.exe PID 2352 wrote to memory of 1900 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe bwhost.exe PID 2352 wrote to memory of 1900 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe bwhost.exe PID 2352 wrote to memory of 1900 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe bwhost.exe PID 2352 wrote to memory of 1900 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe bwhost.exe PID 1900 wrote to memory of 1716 1900 bwhost.exe bwhost.exe PID 1900 wrote to memory of 1716 1900 bwhost.exe bwhost.exe PID 1900 wrote to memory of 1716 1900 bwhost.exe bwhost.exe PID 1900 wrote to memory of 1716 1900 bwhost.exe bwhost.exe PID 1900 wrote to memory of 1716 1900 bwhost.exe bwhost.exe PID 1900 wrote to memory of 1716 1900 bwhost.exe bwhost.exe PID 1900 wrote to memory of 1716 1900 bwhost.exe bwhost.exe PID 1900 wrote to memory of 1716 1900 bwhost.exe bwhost.exe PID 2352 wrote to memory of 1564 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe cwhost.exe PID 2352 wrote to memory of 1564 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe cwhost.exe PID 2352 wrote to memory of 1564 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe cwhost.exe PID 2352 wrote to memory of 1564 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe cwhost.exe PID 1564 wrote to memory of 876 1564 cwhost.exe explorer.exe PID 1564 wrote to memory of 876 1564 cwhost.exe explorer.exe PID 1564 wrote to memory of 876 1564 cwhost.exe explorer.exe PID 1564 wrote to memory of 876 1564 cwhost.exe explorer.exe PID 1564 wrote to memory of 876 1564 cwhost.exe explorer.exe PID 1564 wrote to memory of 876 1564 cwhost.exe explorer.exe PID 2352 wrote to memory of 2844 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe dwhost.exe PID 2352 wrote to memory of 2844 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe dwhost.exe PID 2352 wrote to memory of 2844 2352 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe dwhost.exe
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe3⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\HM23Yh.exeC:\Users\Admin\HM23Yh.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\rioqiuv.exe"C:\Users\Admin\rioqiuv.exe"5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del HM23Yh.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\awhost.exeC:\Users\Admin\awhost.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\awhost.exeawhost.exe5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\bwhost.exeC:\Users\Admin\bwhost.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\bwhost.exebwhost.exe5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\cwhost.exeC:\Users\Admin\cwhost.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe00000088*5⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\dwhost.exeC:\Users\Admin\dwhost.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\c1d0fc3f\X193.105.154.210:805⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"5⤵
-
C:\Users\Admin\ewhost.exeC:\Users\Admin\ewhost.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe4⤵
- Deletes itself
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Modify Registry
3Hide Artifacts
1Hidden Files and Directories
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\c1d0fc3f\@Filesize
2KB
MD59f07c4a67dbf752b6e32e815c0ac7728
SHA1faef5b8f91e00af204351136aa884ce790c70c55
SHA2567ead63d0c9b4261f952aeaacd5a61a99998df9a07f3b5d770e8e7c8910b76651
SHA512280cc13e0af907b5779cfda9902dea5618eae5e844e09912f2685c7df52ce9fa15b93eb05f71e52fae30d425a6fa540b29a78210414004f4ba4fc8c87408ce4e
-
C:\Windows\system32\consrv.DLLFilesize
52KB
MD5c7570a7e24b29ee04a48c2c99da2587b
SHA1b6e3635a8de44b1635e8d362ac131e14281feb24
SHA256717cd7661c09701ee39c505d8b604ea3dd6c1151ef18e7ed1cab3832552ac34b
SHA51257479d2f5386ace8cc5e5ed543e6ad2c2b7b58accc849807d804a8cf0d03080f328f7b42442422fa1483a01ad473ca302f9eca97b9eb24e699e22db56641c572
-
\??\globalroot\systemroot\assembly\temp\@Filesize
2KB
MD5a22bad7a0530a7bdd9c6ceae0e48f675
SHA1a0e4c8d919686931e195c2e433b8842b32d69e32
SHA25612833cea983c54f92bbdd9a4a1faf729e42ffb8b715141798c7942e6b36c0d4c
SHA5123cfd47d13e40d7f1a93210fc13aba46cb106e3a0508669c409b2780bc8546990627a2deaf923ec30d130ad3a7d97a044149c18c0ed6e5b66cae16b9f33f81467
-
\Users\Admin\AppData\Local\c1d0fc3f\XFilesize
41KB
MD5686b479b0ee164cf1744a8be359ebb7d
SHA18615e8f967276a85110b198d575982a958581a07
SHA256fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b
SHA5127ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64
-
\Users\Admin\HM23Yh.exeFilesize
224KB
MD5b9204dce58a6e81de3b3306eb6cb03e5
SHA1ceb777de961f82c42b9b71dca67b8e56a31908a3
SHA256438f71f74c972c3ed35a21bbc93cbc8dd1fb3cf17fd789ae730e60e53816b472
SHA512f555f397416efd33bf9591dd08ad27a4dfed1d26cbfb9d73dc4c3ae130da8ce254d4bfc1e70406f3c92565d28e045469b3ba3b172bd5d19c5876708bb1aa37ed
-
\Users\Admin\awhost.exeFilesize
270KB
MD55efdb148d618a6b6d2369fccd60f4212
SHA17e2045b55c33af87848088738215af2bf7ad0b9b
SHA256db7e3eef1813f386579a2dd11587077c6888809ac9c9e33c7584eb301402203b
SHA512e63d8d4caf1cc98bc9beb168302c89885b12175a5802e2e7f507d30bce04eb67ce1f81519f544da297bbb581f59c5baab8ed3fd9b3f7f911a884095603587a21
-
\Users\Admin\bwhost.exeFilesize
157KB
MD52dd258fd2e5a7fccd81b8af93c08780b
SHA1a5373acdb7f4684b032954e9e754593ddcc827b2
SHA25600d8a5382bc4f61a6836bc2b22c05b57485bdf2550188c456f1a854d8a885ca9
SHA51220048701859ed645bc678a3a45a3ef45cee1d31edfba2ab6cc8edbb03bad6174b541694ac09f4dc58c58241a93d592deb049c33d22ef3cc9f0a6eaac925111df
-
\Users\Admin\cwhost.exeFilesize
150KB
MD5d91ada984db5e7adbf2b80c2284c12f6
SHA131e9b27095ac041687b016006f41ea6e5222202d
SHA2568cbabd93630154a79f8f0c52964f330b44b427631403c3eef4b6c6fc87649948
SHA5128a0eea5b8ffc4c8d4bdf1e551e6c11e8d188f2209666e2f4b6a74bed99105264510a612a7a1e72f7142584386891ab4aa95946110b8fe623d5b2035494da0748
-
\Users\Admin\dwhost.exeFilesize
333KB
MD51aceb282a6d05fcc08f3f74f5483bf0a
SHA1778e34df0c35fee3ab8b7f1af14b2b4ce948ea7b
SHA256d62b7050a4ada5513bb9f24c79cf782a8675122ef7833bc8c91cb107fe71fc6d
SHA5125f2c02faa69f1f3f32affc898773d92738a9944a59ad2a28cebe192b0ad1089363c8e3bbc1d202097b160c1b2dada71fc0f03a1a0744dbc2c72cc3273a4629f8
-
\Users\Admin\ewhost.exeFilesize
36KB
MD54bcd12fdaa17197a658a5113af9120ec
SHA13ac79b0b793e390cf1dea82c1754ec34aab1ea46
SHA256e781bf0233fb732b4b6935255af5cf33b7f0a58bad54b70408c347d2e83dbf96
SHA512dab61b32fc43b2f55a197ebdf1b8c5709ed97e99530fb31a33ec077c25812f075733ff5e97cc5eebe01d8b83cd29ba104caba02b7a8cdf7e13f43e18432ccbdd
-
\Users\Admin\rioqiuv.exeFilesize
224KB
MD520f2bfc540a14a18f2e15fea4a5f1d89
SHA10ec6605637817233a858e68aeb6963a82bc82198
SHA2567a3dbe9b73ed323751dae91ee1adf79348a45d247d7d05b50b104460ac54b6ee
SHA5127db2825024af5f7566d8d311451a51f9f7cf75ea635f90bbb1e6fd01ce3fc37eff1af85e09238208084d56a4018e20a5661615c4c617d7961875084ed1c563ff
-
\Windows\assembly\GAC_32\Desktop.iniFilesize
4KB
MD580dbc7d15fdf94f16bb4a739cd9c3f98
SHA1c0f3f20b360ce78cc153fa514e5f62c06f68feb7
SHA25620b2d1e1b5348ed92f7e2eaedba4348e446970c13c6226f34a816503aa956c91
SHA512cf8d820104ee3db4a103fb19d38267fe2f5095a29777bf3bcde95d4299360681cedd421251af92038da3f8709e68f101f7326ad9abdd087a59ca83adec87bc48
-
\Windows\assembly\GAC_64\Desktop.iniFilesize
5KB
MD578ab98fd9228277f2638fd93cd703016
SHA11640ee7f500074c155a5af431e9d125a4ec2cea5
SHA256e0517a9584af6cfd4f1e6d280e086b20fd576b90b32f9ddac916de03a53b766c
SHA512d98ed49a83d5b50737a674e4421cea4cbe353f80234d2d5a8df82995a0d81e9524f23919ca600afb98bc676a8f93e7c0df73c22cae9b3fc624027800ba9dcc76
-
memory/336-137-0x0000000000E50000-0x0000000000E62000-memory.dmpFilesize
72KB
-
memory/876-124-0x00000000001F0000-0x0000000000209000-memory.dmpFilesize
100KB
-
memory/876-119-0x00000000001F0000-0x0000000000209000-memory.dmpFilesize
100KB
-
memory/876-114-0x00000000001F0000-0x0000000000209000-memory.dmpFilesize
100KB
-
memory/1336-151-0x0000000002E20000-0x0000000002E2B000-memory.dmpFilesize
44KB
-
memory/1564-113-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1564-109-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1716-88-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1716-97-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1716-85-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1716-84-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1716-91-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1716-96-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1716-99-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1900-94-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2212-68-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2212-57-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2212-53-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2212-66-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2212-74-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2212-60-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2212-55-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2212-63-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2244-10-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2352-108-0x0000000000330000-0x0000000000374000-memory.dmpFilesize
272KB
-
memory/2352-13-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2352-107-0x0000000000330000-0x0000000000374000-memory.dmpFilesize
272KB
-
memory/2352-98-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2352-4-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2352-2-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2352-0-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2352-6-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2352-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2352-12-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2352-193-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2352-15-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2612-44-0x0000000003A30000-0x00000000044EA000-memory.dmpFilesize
10.7MB
-
memory/2976-72-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB