Analysis
-
max time kernel
131s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 10:47
Static task
static1
Behavioral task
behavioral1
Sample
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe
-
Size
154KB
-
MD5
e4be72eaed83102b4f86ba0c179ad73b
-
SHA1
abe62fe3d5ba15412953f1579d0b85194827fba2
-
SHA256
556788d05397a55d033825002b4ff0e3d1ed4787c1077570f6a78d06d50e6a1d
-
SHA512
362858992b49271beeb35871c01d272686272ff3b23fc86d3ee9ebfef5d1ad608add0b867a1616f265dab4683e28ad6a467dc30e6ccd1c19d76a4a300be59a38
-
SSDEEP
3072:Tjl5OJjtBvw9riwu00V9oPYTLyWetx8BKpe8cSlsiz9j:TjjIjtBI9+wu0M9oPYSNt9b
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Detect XtremeRAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2924-8-0x0000000000C80000-0x0000000000CA6000-memory.dmp family_xtremerat behavioral2/memory/4024-23-0x0000000000C80000-0x0000000000CA6000-memory.dmp family_xtremerat behavioral2/memory/2924-38-0x0000000000C80000-0x0000000000CA6000-memory.dmp family_xtremerat -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe -
Processes:
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe -
Processes:
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exesvchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{ALF74GD4-1L5C-75WV-YG15-0S7007NB3E77} e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ALF74GD4-1L5C-75WV-YG15-0S7007NB3E77}\StubPath = "C:\\Windows\\system32\\hacker\\win32.exe restart" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{ALF74GD4-1L5C-75WV-YG15-0S7007NB3E77} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ALF74GD4-1L5C-75WV-YG15-0S7007NB3E77}\StubPath = "C:\\Windows\\system32\\hacker\\win32.exe" svchost.exe -
Processes:
resource yara_rule behavioral2/memory/2924-2-0x0000000000C80000-0x0000000000CA6000-memory.dmp upx behavioral2/memory/2924-4-0x0000000000C80000-0x0000000000CA6000-memory.dmp upx behavioral2/memory/2924-6-0x0000000000C80000-0x0000000000CA6000-memory.dmp upx behavioral2/memory/2924-5-0x0000000000C80000-0x0000000000CA6000-memory.dmp upx behavioral2/memory/2924-7-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-8-0x0000000000C80000-0x0000000000CA6000-memory.dmp upx behavioral2/memory/2924-10-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/4024-23-0x0000000000C80000-0x0000000000CA6000-memory.dmp upx behavioral2/memory/2924-14-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-11-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-22-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-24-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-26-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-27-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-28-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-29-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-30-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-31-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-32-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-33-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-35-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-36-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-38-0x0000000000C80000-0x0000000000CA6000-memory.dmp upx behavioral2/memory/2924-39-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-41-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-42-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-51-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-53-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-57-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-59-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-61-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-63-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-65-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-72-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-74-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-76-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-78-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-80-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2924-82-0x0000000002350000-0x00000000033DE000-memory.dmp upx -
Processes:
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\hacker\\win32.exe" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\hacker\\win32.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\hacker\\win32.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\hacker\\win32.exe" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe -
Processes:
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exedescription ioc process File opened (read-only) \??\U: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\Z: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\H: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\M: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\S: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\T: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\J: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\L: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\N: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\X: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\W: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\I: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\O: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\Q: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\R: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\V: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\Y: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\E: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\G: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\K: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened (read-only) \??\P: e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exedescription ioc process File opened for modification C:\autorun.inf e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened for modification F:\autorun.inf e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
Processes:
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SysWOW64\hacker\win32.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File created C:\Windows\SysWOW64\hacker\win32.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exedescription pid process target process PID 868 set thread context of 2924 868 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe -
Drops file in Program Files directory 11 IoCs
Processes:
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exedescription ioc process File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
Processes:
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exepid process 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Token: SeDebugPrivilege 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exee4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exepid process 868 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exee4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exedescription pid process target process PID 868 wrote to memory of 2924 868 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe PID 868 wrote to memory of 2924 868 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe PID 868 wrote to memory of 2924 868 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe PID 868 wrote to memory of 2924 868 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe PID 868 wrote to memory of 2924 868 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe PID 868 wrote to memory of 2924 868 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe PID 868 wrote to memory of 2924 868 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe PID 868 wrote to memory of 2924 868 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe PID 2924 wrote to memory of 780 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe fontdrvhost.exe PID 2924 wrote to memory of 784 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe fontdrvhost.exe PID 2924 wrote to memory of 1020 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe dwm.exe PID 2924 wrote to memory of 2816 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe sihost.exe PID 2924 wrote to memory of 2884 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe svchost.exe PID 2924 wrote to memory of 3048 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe taskhostw.exe PID 2924 wrote to memory of 3372 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe Explorer.EXE PID 2924 wrote to memory of 3552 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe svchost.exe PID 2924 wrote to memory of 3736 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe DllHost.exe PID 2924 wrote to memory of 3828 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe StartMenuExperienceHost.exe PID 2924 wrote to memory of 3888 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe RuntimeBroker.exe PID 2924 wrote to memory of 3972 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe SearchApp.exe PID 2924 wrote to memory of 3400 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe RuntimeBroker.exe PID 2924 wrote to memory of 3836 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe TextInputHost.exe PID 2924 wrote to memory of 448 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe RuntimeBroker.exe PID 2924 wrote to memory of 2532 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe RuntimeBroker.exe PID 2924 wrote to memory of 4480 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe RuntimeBroker.exe PID 2924 wrote to memory of 4024 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe svchost.exe PID 2924 wrote to memory of 4024 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe svchost.exe PID 2924 wrote to memory of 4024 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe svchost.exe PID 2924 wrote to memory of 4024 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe svchost.exe PID 2924 wrote to memory of 1112 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 1112 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 1112 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 1596 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 1596 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 1596 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 388 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 388 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 388 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 2264 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 2264 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 2264 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 1072 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 1072 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 1072 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 3612 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 3612 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 3612 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 640 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 640 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 640 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 2456 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 2456 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 2456 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 3932 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 3932 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 3932 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 1616 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 1616 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 1616 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 4324 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 4324 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 4324 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 716 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 716 2924 e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe explorer.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e4be72eaed83102b4f86ba0c179ad73b_JaffaCakes118.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Modifies Installed Components in the registry
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
7Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\hacker\win32.exeFilesize
154KB
MD5e4be72eaed83102b4f86ba0c179ad73b
SHA1abe62fe3d5ba15412953f1579d0b85194827fba2
SHA256556788d05397a55d033825002b4ff0e3d1ed4787c1077570f6a78d06d50e6a1d
SHA512362858992b49271beeb35871c01d272686272ff3b23fc86d3ee9ebfef5d1ad608add0b867a1616f265dab4683e28ad6a467dc30e6ccd1c19d76a4a300be59a38
-
C:\Windows\SysWOW64\hacker\win32.exeFilesize
234KB
MD5a51c6c924410ab1140c4ca555213515d
SHA130c80e673971336f20d9fc6f9b8eb70ba4b5be36
SHA2561410fef19966ac0ff411104194fb0e1b6d110637d215a62af6e992acec1b89aa
SHA5127f3ed2be85025e0a22f32fd5fecef0c101497d0ed85b304e2e4fbd1a7a465b68ed70069702003ea827a622e11d6b75e37cfbc2d51e0436a06c8688ba15a9c669
-
F:\jgotk.pifFilesize
100KB
MD59bdd61bc9a2c82ff153d35f159bf38a7
SHA1d16195b3bbb832a524af2014ac4f085942586b16
SHA256dfbc9b1513c809fb342e384901071b8489d14e0d2fcb1603d2111a3586ec6cd0
SHA5121a03f2c41ab7d9accec693464ff1a194b683586d6c1f0b9c39814af9386f1032edea56129698600ccbc5a527c4ee95c033744c3f0adf82ec364da9b528451071
-
memory/1596-99-0x00000000012A0000-0x00000000012A2000-memory.dmpFilesize
8KB
-
memory/1596-50-0x00000000012A0000-0x00000000012A2000-memory.dmpFilesize
8KB
-
memory/1596-49-0x00000000012A0000-0x00000000012A2000-memory.dmpFilesize
8KB
-
memory/1596-48-0x0000000001330000-0x0000000001331000-memory.dmpFilesize
4KB
-
memory/2924-38-0x0000000000C80000-0x0000000000CA6000-memory.dmpFilesize
152KB
-
memory/2924-63-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-21-0x0000000000A30000-0x0000000000A32000-memory.dmpFilesize
8KB
-
memory/2924-4-0x0000000000C80000-0x0000000000CA6000-memory.dmpFilesize
152KB
-
memory/2924-14-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-11-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-22-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-12-0x0000000000A30000-0x0000000000A32000-memory.dmpFilesize
8KB
-
memory/2924-24-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-26-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-27-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-28-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-29-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-30-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-31-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-32-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-33-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-35-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-36-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-2-0x0000000000C80000-0x0000000000CA6000-memory.dmpFilesize
152KB
-
memory/2924-39-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-41-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-42-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-6-0x0000000000C80000-0x0000000000CA6000-memory.dmpFilesize
152KB
-
memory/2924-10-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-5-0x0000000000C80000-0x0000000000CA6000-memory.dmpFilesize
152KB
-
memory/2924-8-0x0000000000C80000-0x0000000000CA6000-memory.dmpFilesize
152KB
-
memory/2924-7-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-51-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-53-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-56-0x0000000000A30000-0x0000000000A32000-memory.dmpFilesize
8KB
-
memory/2924-57-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-59-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-61-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-13-0x0000000000C50000-0x0000000000C51000-memory.dmpFilesize
4KB
-
memory/2924-65-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-72-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-74-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-76-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-78-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-80-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/2924-82-0x0000000002350000-0x00000000033DE000-memory.dmpFilesize
16.6MB
-
memory/4024-94-0x0000000002370000-0x0000000002372000-memory.dmpFilesize
8KB
-
memory/4024-46-0x0000000002370000-0x0000000002372000-memory.dmpFilesize
8KB
-
memory/4024-45-0x00000000024C0000-0x00000000024C1000-memory.dmpFilesize
4KB
-
memory/4024-23-0x0000000000C80000-0x0000000000CA6000-memory.dmpFilesize
152KB