Analysis
-
max time kernel
149s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 16:03
Behavioral task
behavioral1
Sample
63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
63e4623a155c81cd49f0b25ae029bee9
-
SHA1
710e03ae368be2c47bca3f52b5c7aa6e71a9c9c2
-
SHA256
9fbb0b0fc9fa43defb985665b4cde0b93f327a45e316d21385645360965f921f
-
SHA512
9a1efc5ac811768a78349379e0919d4a1538ad581223b4f93d257194e3eeaafab77fc34665d412c1510e4c97d9d686ffee9952d42dca3b3d57e90920b19e1f81
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZF:0UzeyQMS4DqodCnoe+iitjWwwB
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2492 explorer.exe 2196 explorer.exe 1912 spoolsv.exe 1444 spoolsv.exe 2112 spoolsv.exe 1112 spoolsv.exe 960 spoolsv.exe 1148 spoolsv.exe 2044 spoolsv.exe 2440 spoolsv.exe 2544 spoolsv.exe 2172 spoolsv.exe 1952 spoolsv.exe 3000 spoolsv.exe 1552 spoolsv.exe 2804 spoolsv.exe 2964 spoolsv.exe 2984 spoolsv.exe 2812 spoolsv.exe 312 spoolsv.exe 2116 spoolsv.exe 1660 spoolsv.exe 1548 spoolsv.exe 2228 spoolsv.exe 2672 spoolsv.exe 2604 spoolsv.exe 2332 spoolsv.exe 2120 spoolsv.exe 1488 spoolsv.exe 2128 spoolsv.exe 352 spoolsv.exe 2600 spoolsv.exe 1904 spoolsv.exe 2188 spoolsv.exe 1172 spoolsv.exe 828 spoolsv.exe 1760 spoolsv.exe 2780 spoolsv.exe 2200 spoolsv.exe 1272 spoolsv.exe 1016 spoolsv.exe 1096 spoolsv.exe 2680 spoolsv.exe 1628 spoolsv.exe 2844 spoolsv.exe 852 spoolsv.exe 3024 spoolsv.exe 1824 spoolsv.exe 536 spoolsv.exe 2856 spoolsv.exe 2292 spoolsv.exe 1752 spoolsv.exe 3064 spoolsv.exe 2052 spoolsv.exe 2940 spoolsv.exe 1536 spoolsv.exe 3044 spoolsv.exe 1336 spoolsv.exe 2092 spoolsv.exe 1828 spoolsv.exe 2088 spoolsv.exe 1784 spoolsv.exe 768 spoolsv.exe 360 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exeexplorer.exepid process 2560 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 2560 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exeexplorer.exedescription pid process target process PID 1280 set thread context of 2560 1280 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe PID 2492 set thread context of 2196 2492 explorer.exe explorer.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exeexplorer.exepid process 2560 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 2196 explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exeexplorer.exepid process 2560 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 2560 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe 2196 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1280 wrote to memory of 1792 1280 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe splwow64.exe PID 1280 wrote to memory of 1792 1280 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe splwow64.exe PID 1280 wrote to memory of 1792 1280 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe splwow64.exe PID 1280 wrote to memory of 1792 1280 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe splwow64.exe PID 1280 wrote to memory of 2560 1280 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe PID 1280 wrote to memory of 2560 1280 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe PID 1280 wrote to memory of 2560 1280 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe PID 1280 wrote to memory of 2560 1280 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe PID 1280 wrote to memory of 2560 1280 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe PID 1280 wrote to memory of 2560 1280 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe PID 2560 wrote to memory of 2492 2560 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe explorer.exe PID 2560 wrote to memory of 2492 2560 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe explorer.exe PID 2560 wrote to memory of 2492 2560 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe explorer.exe PID 2560 wrote to memory of 2492 2560 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe explorer.exe PID 2492 wrote to memory of 2196 2492 explorer.exe explorer.exe PID 2492 wrote to memory of 2196 2492 explorer.exe explorer.exe PID 2492 wrote to memory of 2196 2492 explorer.exe explorer.exe PID 2492 wrote to memory of 2196 2492 explorer.exe explorer.exe PID 2492 wrote to memory of 2196 2492 explorer.exe explorer.exe PID 2492 wrote to memory of 2196 2492 explorer.exe explorer.exe PID 2196 wrote to memory of 1912 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1912 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1912 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1912 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1444 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1444 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1444 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1444 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2112 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2112 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2112 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2112 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1112 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1112 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1112 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1112 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 960 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 960 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 960 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 960 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1148 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1148 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1148 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1148 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2044 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2044 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2044 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2044 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2440 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2440 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2440 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2440 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2544 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2544 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2544 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2544 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2172 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2172 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2172 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 2172 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1952 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1952 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1952 2196 explorer.exe spoolsv.exe PID 2196 wrote to memory of 1952 2196 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\system\explorer.exeFilesize
2.2MB
MD53e99505c77dc6631f67c148e9cdf6800
SHA1ea8439257e5e0d02aefbfd0f162a9bce4bfb33e7
SHA256266ad087d588897eae6a0c15159a593ef3a49036c70cfc59fd174de5732fb98d
SHA512b5905ba011f3aeaea24e39bdf00f92a223cc7a7298a1408ebaa2c1f87085f7adc6783ec2c7fe9bd87dbedf13106ac15867d1c6130f54bc981cc06e77da85c61f
-
\Windows\system\spoolsv.exeFilesize
2.2MB
MD5582047d7b7f6422be55d40daa841c399
SHA16eab8a7794fcf4fdadfeecec6d531c2798eefc64
SHA256121bf57962e682cd719a72002a6a5a75a81b77f175699951a278d7288cd6d312
SHA512e94ad4086abe0b43f91d87c1bd58217ca5253820521199144eef3073d3134f50664d97857fc5d17018c72becdfd284edcee19126731ea5da8c2da1e6a12e86d3
-
memory/312-3167-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/352-3586-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/960-2640-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1112-2639-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1148-2646-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1280-0-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1280-19-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1280-17-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1280-28-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1444-2622-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1488-3584-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1548-3170-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1552-3157-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1660-3169-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1912-2621-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1952-3155-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2044-3146-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2112-2634-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2116-3168-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2120-3583-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2128-3585-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2172-3154-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2196-2620-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2228-3171-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2332-3582-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2440-3152-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2492-56-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2492-42-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2492-65-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2544-3153-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2560-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2560-20-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2560-29-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2560-50-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2560-27-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2600-3587-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2604-3581-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2672-3580-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2804-3158-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2812-3166-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2964-3159-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2984-3165-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3000-3156-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4740-5616-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4740-5726-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4760-5628-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5304-5703-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5348-5662-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB