Analysis
-
max time kernel
147s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
26-04-2024 17:04
Behavioral task
behavioral1
Sample
013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
013e1cfb58659275939c7aed074adc61
-
SHA1
6b7bb5e9d642cc8040cb6b99d7cae2514ee5923e
-
SHA256
bf70afa2e5a6f9f55ebd57f423c0eefce372f00e2c0778e129e570d24459ad1d
-
SHA512
9f6ba59e605700b668251214c3df45213fdf1ab3da3c9a71737f560b0af4ce28edbf780ed7f70d59cff049b4b0c2f4c7605349f4b7f964f4a1abeada8ccf504d
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZe:0UzeyQMS4DqodCnoe+iitjWwwC
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
013e1cfb58659275939c7aed074adc61_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2672 explorer.exe 1276 explorer.exe 1800 spoolsv.exe 2476 spoolsv.exe 2856 spoolsv.exe 1816 spoolsv.exe 2368 spoolsv.exe 1692 spoolsv.exe 1568 spoolsv.exe 2388 spoolsv.exe 2672 spoolsv.exe 1528 spoolsv.exe 1224 spoolsv.exe 1088 spoolsv.exe 1720 spoolsv.exe 2152 spoolsv.exe 2648 spoolsv.exe 2952 spoolsv.exe 2000 spoolsv.exe 2028 spoolsv.exe 1352 spoolsv.exe 540 spoolsv.exe 1592 spoolsv.exe 1508 spoolsv.exe 2888 spoolsv.exe 2676 spoolsv.exe 2848 spoolsv.exe 1488 spoolsv.exe 1472 spoolsv.exe 960 spoolsv.exe 1912 spoolsv.exe 2720 spoolsv.exe 2624 spoolsv.exe 1700 spoolsv.exe 2376 spoolsv.exe 2460 spoolsv.exe 1936 spoolsv.exe 2696 spoolsv.exe 2980 spoolsv.exe 2744 spoolsv.exe 1068 spoolsv.exe 1028 spoolsv.exe 2416 spoolsv.exe 2508 spoolsv.exe 2732 spoolsv.exe 2884 spoolsv.exe 2224 spoolsv.exe 2612 spoolsv.exe 2872 spoolsv.exe 2608 spoolsv.exe 884 spoolsv.exe 2652 spoolsv.exe 2536 spoolsv.exe 1016 spoolsv.exe 2164 spoolsv.exe 2640 spoolsv.exe 1856 spoolsv.exe 1316 spoolsv.exe 2808 spoolsv.exe 2912 spoolsv.exe 1468 spoolsv.exe 2876 spoolsv.exe 1804 spoolsv.exe 3012 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
013e1cfb58659275939c7aed074adc61_JaffaCakes118.exeexplorer.exepid process 2664 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe 2664 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
013e1cfb58659275939c7aed074adc61_JaffaCakes118.exeexplorer.exedescription pid process target process PID 2944 set thread context of 2664 2944 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe PID 2672 set thread context of 1276 2672 explorer.exe explorer.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe013e1cfb58659275939c7aed074adc61_JaffaCakes118.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
013e1cfb58659275939c7aed074adc61_JaffaCakes118.exeexplorer.exepid process 2664 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1276 explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
013e1cfb58659275939c7aed074adc61_JaffaCakes118.exeexplorer.exepid process 2664 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe 2664 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe 1276 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe013e1cfb58659275939c7aed074adc61_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 2944 wrote to memory of 3024 2944 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe splwow64.exe PID 2944 wrote to memory of 3024 2944 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe splwow64.exe PID 2944 wrote to memory of 3024 2944 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe splwow64.exe PID 2944 wrote to memory of 3024 2944 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe splwow64.exe PID 2944 wrote to memory of 2664 2944 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe PID 2944 wrote to memory of 2664 2944 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe PID 2944 wrote to memory of 2664 2944 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe PID 2944 wrote to memory of 2664 2944 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe PID 2944 wrote to memory of 2664 2944 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe PID 2944 wrote to memory of 2664 2944 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe PID 2664 wrote to memory of 2672 2664 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe explorer.exe PID 2664 wrote to memory of 2672 2664 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe explorer.exe PID 2664 wrote to memory of 2672 2664 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe explorer.exe PID 2664 wrote to memory of 2672 2664 013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe explorer.exe PID 2672 wrote to memory of 1276 2672 explorer.exe explorer.exe PID 2672 wrote to memory of 1276 2672 explorer.exe explorer.exe PID 2672 wrote to memory of 1276 2672 explorer.exe explorer.exe PID 2672 wrote to memory of 1276 2672 explorer.exe explorer.exe PID 2672 wrote to memory of 1276 2672 explorer.exe explorer.exe PID 2672 wrote to memory of 1276 2672 explorer.exe explorer.exe PID 1276 wrote to memory of 1800 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1800 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1800 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1800 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2476 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2476 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2476 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2476 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2856 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2856 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2856 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2856 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1816 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1816 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1816 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1816 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2368 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2368 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2368 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2368 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1692 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1692 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1692 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1692 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1568 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1568 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1568 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1568 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2388 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2388 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2388 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2388 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2672 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2672 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2672 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 2672 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1528 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1528 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1528 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1528 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1224 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1224 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1224 1276 explorer.exe spoolsv.exe PID 1276 wrote to memory of 1224 1276 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\013e1cfb58659275939c7aed074adc61_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Windows\system\explorer.exeFilesize
2.2MB
MD5c57fa6c45423c24c4011746e5b67429b
SHA1fed29f47b3645b3c9fb6a909fa2f36cf5df950fa
SHA2564ff03bc359647af8e010021a7628605db7f715738c52fb41652df4a6d760b8d1
SHA5126e58ce16ca4bef7990c4635f0dfc0f95ee596dd800d0df917d4c0da4159b46780122b9e34a978789106fbdd91eebfe0305f1fa8d8e2d6be8716ad3d31bcf29e5
-
\Windows\system\spoolsv.exeFilesize
2.2MB
MD5af01045a5f0998de3f0e0311837fda3a
SHA1de57bce43cbde8f75203e195254b8dd1cedb417d
SHA2565fad227918175d9480c5594a91b70cc55687b93e27da24d3b34fc5b9959ec8b3
SHA512ae8372d2aca2a61c3b88a89c0f7b335d4565ed55ce9c4a6645cb3e504cc1064657fd16d9c315d4e368051bf7671ee7044bfe0311b3b2acfd8ea19395235fd9ca
-
memory/540-3206-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/960-3214-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1088-2820-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1224-2819-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1276-2315-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1352-3205-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1472-3213-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1488-3212-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1508-3208-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1528-2818-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1568-2799-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1592-3207-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1692-2798-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1720-2821-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1800-2316-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1816-2319-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1912-3215-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2000-3195-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2028-3204-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2152-2822-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2368-2320-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2388-2801-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2476-2317-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2648-2823-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2664-28-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2664-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2664-25-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2664-50-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2664-49-0x0000000000450000-0x0000000000490000-memory.dmpFilesize
256KB
-
memory/2664-20-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2672-2817-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2672-42-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2672-61-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2672-63-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2672-70-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2676-3210-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2720-3216-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2848-3211-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2856-2318-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2888-3209-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2944-19-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2944-29-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2944-0-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2944-17-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2952-2824-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4452-5075-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4452-5181-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4464-5087-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4840-5100-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4864-5144-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5560-5208-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5576-5229-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6024-5258-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB