Analysis
-
max time kernel
146s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 03:50
Behavioral task
behavioral1
Sample
044f1beba281129bb335c7d87311a468_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
044f1beba281129bb335c7d87311a468_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
044f1beba281129bb335c7d87311a468
-
SHA1
ea8cef33799449e83c4af412dc52205b9b86a97f
-
SHA256
961f04770851408277e71fb089899c210c74d6a768aaf21f9ba23175fd0e8ef1
-
SHA512
ba10b8a2f0d41eefd1de0cd61ee73c9e111565374c55b8997d6e0f308bcc9a90f25c4bcf44da32949da21dd512c57bb6eac7166a388db515c9df4c9ad754eaed
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZu:0UzeyQMS4DqodCnoe+iitjWwwi
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
044f1beba281129bb335c7d87311a468_JaffaCakes118.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2820 explorer.exe 2156 explorer.exe 1980 spoolsv.exe 1956 spoolsv.exe 2408 spoolsv.exe 704 spoolsv.exe 840 spoolsv.exe 1816 spoolsv.exe 2644 spoolsv.exe 1444 spoolsv.exe 556 spoolsv.exe 1804 spoolsv.exe 1028 spoolsv.exe 2384 spoolsv.exe 1864 spoolsv.exe 1952 spoolsv.exe 2896 spoolsv.exe 2544 spoolsv.exe 1220 spoolsv.exe 1692 spoolsv.exe 676 spoolsv.exe 988 spoolsv.exe 3004 spoolsv.exe 2712 spoolsv.exe 2560 spoolsv.exe 552 spoolsv.exe 2968 spoolsv.exe 1276 spoolsv.exe 2236 spoolsv.exe 2188 spoolsv.exe 2792 spoolsv.exe 2556 spoolsv.exe 348 spoolsv.exe 2912 spoolsv.exe 2268 spoolsv.exe 2940 spoolsv.exe 344 spoolsv.exe 2292 spoolsv.exe 1584 spoolsv.exe 1840 spoolsv.exe 568 spoolsv.exe 2444 spoolsv.exe 3024 spoolsv.exe 1240 spoolsv.exe 828 spoolsv.exe 2212 spoolsv.exe 2540 spoolsv.exe 1944 spoolsv.exe 1752 spoolsv.exe 2308 spoolsv.exe 2568 spoolsv.exe 2492 spoolsv.exe 1100 spoolsv.exe 3044 spoolsv.exe 2756 spoolsv.exe 1728 spoolsv.exe 748 spoolsv.exe 2588 spoolsv.exe 1448 spoolsv.exe 1604 spoolsv.exe 352 spoolsv.exe 1860 spoolsv.exe 1316 spoolsv.exe 1620 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
044f1beba281129bb335c7d87311a468_JaffaCakes118.exeexplorer.exepid process 2688 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 2688 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
044f1beba281129bb335c7d87311a468_JaffaCakes118.exeexplorer.exedescription pid process target process PID 1740 set thread context of 2688 1740 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe PID 2820 set thread context of 2156 2820 explorer.exe explorer.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe044f1beba281129bb335c7d87311a468_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
044f1beba281129bb335c7d87311a468_JaffaCakes118.exeexplorer.exepid process 2688 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 2156 explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
044f1beba281129bb335c7d87311a468_JaffaCakes118.exeexplorer.exepid process 2688 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 2688 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe 2156 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
044f1beba281129bb335c7d87311a468_JaffaCakes118.exe044f1beba281129bb335c7d87311a468_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1740 wrote to memory of 288 1740 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe splwow64.exe PID 1740 wrote to memory of 288 1740 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe splwow64.exe PID 1740 wrote to memory of 288 1740 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe splwow64.exe PID 1740 wrote to memory of 288 1740 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe splwow64.exe PID 1740 wrote to memory of 2688 1740 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe PID 1740 wrote to memory of 2688 1740 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe PID 1740 wrote to memory of 2688 1740 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe PID 1740 wrote to memory of 2688 1740 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe PID 1740 wrote to memory of 2688 1740 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe PID 1740 wrote to memory of 2688 1740 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe PID 2688 wrote to memory of 2820 2688 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe explorer.exe PID 2688 wrote to memory of 2820 2688 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe explorer.exe PID 2688 wrote to memory of 2820 2688 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe explorer.exe PID 2688 wrote to memory of 2820 2688 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe explorer.exe PID 2820 wrote to memory of 2156 2820 explorer.exe explorer.exe PID 2820 wrote to memory of 2156 2820 explorer.exe explorer.exe PID 2820 wrote to memory of 2156 2820 explorer.exe explorer.exe PID 2820 wrote to memory of 2156 2820 explorer.exe explorer.exe PID 2820 wrote to memory of 2156 2820 explorer.exe explorer.exe PID 2820 wrote to memory of 2156 2820 explorer.exe explorer.exe PID 2156 wrote to memory of 1980 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1980 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1980 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1980 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1956 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1956 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1956 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1956 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 2408 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 2408 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 2408 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 2408 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 704 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 704 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 704 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 704 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 840 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 840 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 840 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 840 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1816 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1816 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1816 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1816 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 2644 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 2644 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 2644 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 2644 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1444 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1444 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1444 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1444 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 556 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 556 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 556 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 556 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1804 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1804 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1804 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1804 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1028 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1028 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1028 2156 explorer.exe spoolsv.exe PID 2156 wrote to memory of 1028 2156 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\044f1beba281129bb335c7d87311a468_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\044f1beba281129bb335c7d87311a468_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\044f1beba281129bb335c7d87311a468_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\044f1beba281129bb335c7d87311a468_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1980 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4532
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4584
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1956 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4636
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2408 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4940
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:704 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:840 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5396
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1816 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5928
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2224
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1444 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:556 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1804 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1028 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6020
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2384 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1864 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1952 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2896 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2544 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1220 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1692 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:676 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:988 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:3004 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2712 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2560 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:552 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2968 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1276 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2236 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2188 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2792 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2556 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:348 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2912 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2268 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2940 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:344 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2292 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1584 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1840 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:568 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2444 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:3024 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1240 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:828 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2212 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2540 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1944 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1752 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2308 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2568 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2492 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1100 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:3044 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2756 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1728 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:748 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2588 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1448 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1604 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:352 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1860 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1316 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1620 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1936
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2984
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1616
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2504
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1292
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2768
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1740
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2956 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2272 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1424
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1756
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1768
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2332 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3108
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3276
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3492 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3636 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3796
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3948
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1748
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3236 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3460 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3580 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3760
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3944 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3156
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3456 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3596 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3792 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4024
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3148 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3444
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3648 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3900 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3172
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3372
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3588
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3880
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3200 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3428
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3700
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4004
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3260
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3616 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3844
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3352
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3696
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2096
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3540 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4000
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3320 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3916
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3512 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2376
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3668
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3440
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3216
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3852
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3924 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3208 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3344
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3896
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3664 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3868
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4132
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4292 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4448 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4608 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4768
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4920 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5080 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4212 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4392 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4572
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4748 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4932 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5108 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4348
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1828
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5148
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Windows\system\explorer.exeFilesize
2.2MB
MD5bd4be87e522a14d07efd54aa86cde644
SHA1970a0c654804e5620b6d80506bfeaa1d5d544d19
SHA256255a90763a4b2bf70f845dff246269090b1b499dc9ca22825a563a0053234e05
SHA51296a21d5a9346adcbedf3edeee7767ca2a6986cb217c75b7557e2f40ef59ff9b72962dcb6b15cb54eaf2930ab85f0621ba5932590f0becab2cad8962299b3380f
-
\Windows\system\spoolsv.exeFilesize
2.2MB
MD55e0035b44d73157c7ef5e9ea05d9fc05
SHA15f8681567972cef032fd29a949b4d3f6d8f324f2
SHA2569855f75eeeeae9cbaa4a9b6624251917ca24b00fdf23272b57acf55ed24646f3
SHA512371f0ce683bd1a574aee8baa83b446c5b00dfff34a006545b5ae1dc5cb0943e58609dd422fcc539b75f7adb6b7bcb596a51d185e69dae93a0c2faef3decccc1f
-
memory/552-3130-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/556-2740-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/676-3125-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/704-2259-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/840-2731-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/988-3126-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1028-2742-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1220-3123-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1276-3132-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1444-2736-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1692-3124-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1740-0-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1740-17-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1740-19-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1740-28-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1804-2741-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1816-2732-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1864-2744-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1952-2745-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1956-2252-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1980-2251-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2156-2245-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2188-3134-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2236-3133-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2384-2743-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2408-2258-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2544-3122-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2556-3136-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2560-3129-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2644-2734-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2688-20-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2688-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2688-24-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2688-27-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2688-49-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2712-3128-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2792-3135-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2820-69-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2820-41-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2820-60-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2896-2746-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2968-3131-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3004-3127-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4532-5019-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4532-5125-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4636-5032-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4904-5043-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4940-5063-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5396-5134-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5396-5170-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5744-5165-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB