Analysis
-
max time kernel
122s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 14:04
Behavioral task
behavioral1
Sample
6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
6ec439c732a86312556c828ca0015dd7
-
SHA1
95a13be1a8cd91a7f30022aeb686686244d351b2
-
SHA256
dc64da8aac00411f640b8a6386da1191da8379e6c624be03cec2a7b02175d502
-
SHA512
a089cbbb547b19f222569496399c1b09408c4c1bccf969ed29f6edb545634d72d9ed33db4730e3ce2c58f263ff3f26f4c5c0294e3c5d419524d401bb950fab66
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZU:0UzeyQMS4DqodCnoe+iitjWwwI
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exepid process 2224 explorer.exe 716 explorer.exe 4024 spoolsv.exe 1480 spoolsv.exe 5044 spoolsv.exe 1040 spoolsv.exe 3468 spoolsv.exe 4748 spoolsv.exe 3552 spoolsv.exe 4172 spoolsv.exe 60 spoolsv.exe 3912 spoolsv.exe 412 spoolsv.exe 4256 spoolsv.exe 3212 spoolsv.exe 2224 spoolsv.exe 2988 spoolsv.exe 1840 spoolsv.exe 728 spoolsv.exe 556 spoolsv.exe 3796 spoolsv.exe 1876 spoolsv.exe 3924 spoolsv.exe 4736 spoolsv.exe 3700 spoolsv.exe 4092 spoolsv.exe 3300 spoolsv.exe 1056 spoolsv.exe 2356 spoolsv.exe 3944 spoolsv.exe 4796 spoolsv.exe 3408 spoolsv.exe 2384 explorer.exe 856 spoolsv.exe 5016 spoolsv.exe 3036 spoolsv.exe 2664 spoolsv.exe 4640 spoolsv.exe 3972 spoolsv.exe 4928 explorer.exe 1772 spoolsv.exe 368 spoolsv.exe 4456 spoolsv.exe 1092 spoolsv.exe 2164 spoolsv.exe 468 explorer.exe 1360 spoolsv.exe 4636 spoolsv.exe 1588 spoolsv.exe 5012 spoolsv.exe 1032 spoolsv.exe 3436 explorer.exe 2524 spoolsv.exe 1816 spoolsv.exe 692 spoolsv.exe 4548 spoolsv.exe 3772 spoolsv.exe 1192 explorer.exe 440 spoolsv.exe 3920 spoolsv.exe 2896 spoolsv.exe 2444 spoolsv.exe 3884 spoolsv.exe 4868 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 34 IoCs
Processes:
6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exedescription pid process target process PID 1480 set thread context of 4116 1480 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe PID 2224 set thread context of 716 2224 explorer.exe explorer.exe PID 4024 set thread context of 3408 4024 spoolsv.exe spoolsv.exe PID 1480 set thread context of 856 1480 spoolsv.exe spoolsv.exe PID 5044 set thread context of 5016 5044 spoolsv.exe spoolsv.exe PID 1040 set thread context of 3036 1040 spoolsv.exe spoolsv.exe PID 3468 set thread context of 2664 3468 spoolsv.exe spoolsv.exe PID 4748 set thread context of 3972 4748 spoolsv.exe spoolsv.exe PID 3552 set thread context of 1772 3552 spoolsv.exe spoolsv.exe PID 4172 set thread context of 368 4172 spoolsv.exe spoolsv.exe PID 60 set thread context of 1092 60 spoolsv.exe spoolsv.exe PID 3912 set thread context of 2164 3912 spoolsv.exe spoolsv.exe PID 412 set thread context of 1360 412 spoolsv.exe spoolsv.exe PID 4256 set thread context of 4636 4256 spoolsv.exe spoolsv.exe PID 3212 set thread context of 5012 3212 spoolsv.exe spoolsv.exe PID 2224 set thread context of 1032 2224 spoolsv.exe spoolsv.exe PID 2988 set thread context of 2524 2988 spoolsv.exe spoolsv.exe PID 1840 set thread context of 1816 1840 spoolsv.exe spoolsv.exe PID 728 set thread context of 692 728 spoolsv.exe spoolsv.exe PID 556 set thread context of 3772 556 spoolsv.exe spoolsv.exe PID 3796 set thread context of 440 3796 spoolsv.exe spoolsv.exe PID 1876 set thread context of 3920 1876 spoolsv.exe spoolsv.exe PID 3924 set thread context of 2444 3924 spoolsv.exe spoolsv.exe PID 4736 set thread context of 3884 4736 spoolsv.exe spoolsv.exe PID 3700 set thread context of 880 3700 spoolsv.exe spoolsv.exe PID 4092 set thread context of 452 4092 spoolsv.exe spoolsv.exe PID 3300 set thread context of 3276 3300 spoolsv.exe spoolsv.exe PID 1056 set thread context of 4664 1056 spoolsv.exe spoolsv.exe PID 2356 set thread context of 2108 2356 spoolsv.exe spoolsv.exe PID 3944 set thread context of 3288 3944 spoolsv.exe spoolsv.exe PID 2384 set thread context of 1344 2384 explorer.exe explorer.exe PID 4796 set thread context of 1324 4796 spoolsv.exe spoolsv.exe PID 4640 set thread context of 4524 4640 spoolsv.exe spoolsv.exe PID 4928 set thread context of 5332 4928 explorer.exe explorer.exe -
Drops file in Windows directory 63 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exe6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exeexplorer.exepid process 4116 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe 4116 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exepid process 4116 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe 4116 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 3408 spoolsv.exe 3408 spoolsv.exe 856 spoolsv.exe 856 spoolsv.exe 5016 spoolsv.exe 5016 spoolsv.exe 3036 spoolsv.exe 3036 spoolsv.exe 2664 spoolsv.exe 2664 spoolsv.exe 3972 spoolsv.exe 3972 spoolsv.exe 1772 spoolsv.exe 1772 spoolsv.exe 368 spoolsv.exe 368 spoolsv.exe 1092 spoolsv.exe 1092 spoolsv.exe 2164 spoolsv.exe 2164 spoolsv.exe 1360 spoolsv.exe 1360 spoolsv.exe 4636 spoolsv.exe 4636 spoolsv.exe 5012 spoolsv.exe 5012 spoolsv.exe 1032 spoolsv.exe 1032 spoolsv.exe 2524 spoolsv.exe 2524 spoolsv.exe 1816 spoolsv.exe 1816 spoolsv.exe 692 spoolsv.exe 692 spoolsv.exe 3772 spoolsv.exe 3772 spoolsv.exe 440 spoolsv.exe 440 spoolsv.exe 3920 spoolsv.exe 3920 spoolsv.exe 2444 spoolsv.exe 2444 spoolsv.exe 3884 spoolsv.exe 3884 spoolsv.exe 880 spoolsv.exe 880 spoolsv.exe 452 spoolsv.exe 452 spoolsv.exe 3276 spoolsv.exe 3276 spoolsv.exe 4664 spoolsv.exe 4664 spoolsv.exe 2108 spoolsv.exe 2108 spoolsv.exe 3288 spoolsv.exe 3288 spoolsv.exe 1344 explorer.exe 1344 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1480 wrote to memory of 4596 1480 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe splwow64.exe PID 1480 wrote to memory of 4596 1480 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe splwow64.exe PID 1480 wrote to memory of 4116 1480 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe PID 1480 wrote to memory of 4116 1480 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe PID 1480 wrote to memory of 4116 1480 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe PID 1480 wrote to memory of 4116 1480 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe PID 1480 wrote to memory of 4116 1480 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe PID 4116 wrote to memory of 2224 4116 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe explorer.exe PID 4116 wrote to memory of 2224 4116 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe explorer.exe PID 4116 wrote to memory of 2224 4116 6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe explorer.exe PID 2224 wrote to memory of 716 2224 explorer.exe explorer.exe PID 2224 wrote to memory of 716 2224 explorer.exe explorer.exe PID 2224 wrote to memory of 716 2224 explorer.exe explorer.exe PID 2224 wrote to memory of 716 2224 explorer.exe explorer.exe PID 2224 wrote to memory of 716 2224 explorer.exe explorer.exe PID 716 wrote to memory of 4024 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 4024 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 4024 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 1480 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 1480 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 1480 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 5044 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 5044 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 5044 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 1040 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 1040 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 1040 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 3468 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 3468 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 3468 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 4748 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 4748 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 4748 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 3552 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 3552 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 3552 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 4172 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 4172 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 4172 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 60 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 60 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 60 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 3912 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 3912 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 3912 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 412 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 412 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 412 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 4256 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 4256 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 4256 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 3212 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 3212 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 3212 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 2224 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 2224 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 2224 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 2988 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 2988 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 2988 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 1840 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 1840 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 1840 716 explorer.exe spoolsv.exe PID 716 wrote to memory of 728 716 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6ec439c732a86312556c828ca0015dd7_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD53f9e6e0c79ec44745d9fabf43b0c93e5
SHA12985cde0acfade253803fdbdfc76ad2b84cd6381
SHA256ea1aca1828d3aa41a2b051cd4ca14eb9c793489f2262f506f41146bede971764
SHA512378ab08e80dfd0ead1fdb606c5ab654afeba61af7370820f1c8c1cd3d67b5b500a3f06d099ee51332603a9b5cd731662bd83e21279ad391127175823865a8b15
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD5dc73b52291053a769d2e8fa1378f19a0
SHA1548662c2f9c8f23cafa6184ed3f8964670f38b09
SHA25631704c382868040fa5a3bc39c2cdf45a9e90b9a840d40044acdb95a5370203a4
SHA51203bc08c0267cc5423f685605d7f84748c6c9e160bac5ac1c52a926e1eca2a3ace3b24691b5cb8682d47de0ee8bc746259a2e6129daa0f3f730a905d17eed50f5
-
memory/60-1455-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/368-2086-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/412-1457-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/440-2612-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/556-1876-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/716-789-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/716-99-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/728-1738-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/756-5290-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/856-1888-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/868-4532-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/880-2893-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1032-2426-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1032-2586-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1040-1907-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1040-1113-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1092-2165-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1324-3658-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1324-3541-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1344-3502-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1360-2242-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1360-2245-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1480-43-0x0000000002240000-0x0000000002241000-memory.dmpFilesize
4KB
-
memory/1480-1890-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1480-926-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1480-0-0x0000000002240000-0x0000000002241000-memory.dmpFilesize
4KB
-
memory/1480-41-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1480-47-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1728-4050-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1772-2076-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1772-2072-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1792-5296-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1816-2444-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1840-1737-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1876-1887-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2108-2990-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2164-2233-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2164-2409-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2224-1582-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2224-95-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2224-100-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2524-2434-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2524-2437-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2664-1970-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2916-5275-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2920-4822-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2988-1736-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3036-1913-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3212-1581-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3276-2914-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3276-2910-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3288-3083-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3288-3211-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3408-1878-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3408-1967-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3468-1114-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3552-1266-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3772-2761-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3772-2603-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3796-1877-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3884-2961-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3884-2810-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3912-1456-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3920-2634-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3920-2621-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3924-1900-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3972-2216-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4024-790-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4024-1879-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4116-87-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/4116-89-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4116-46-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4116-44-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4172-1267-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4256-1565-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4388-5025-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4524-3960-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4636-2255-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4664-3059-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4664-2983-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4748-1115-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5012-2319-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5016-1901-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5044-1897-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5044-927-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5176-4341-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5176-4454-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5220-4999-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5332-3887-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5380-4351-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5612-4604-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5720-5017-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5756-5041-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5776-5122-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5780-4842-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5788-5054-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5892-5114-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6032-4187-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6032-4039-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6092-5093-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB