Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 06:42
Behavioral task
behavioral1
Sample
74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
74a123b57e148e9c13dc171b7fb50a32
-
SHA1
12aa2bf0d5783d30caccd202eda50c734297dbc7
-
SHA256
642217f633ee9d8e762461366a6a4e8e3375033a37fc4d2fdf1a6594860a4570
-
SHA512
8d4ed2ca7bdb908e05be982a6b09017928ac724fc4a91dabbcdcec1806be4003882dac49ca383e32711f175e10e7a67513f6618a0feab7a36a5816a8f80b0a24
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZz:0UzeyQMS4DqodCnoe+iitjWwwP
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 268 explorer.exe 1324 explorer.exe 2648 spoolsv.exe 2508 spoolsv.exe 2260 spoolsv.exe 2264 spoolsv.exe 1684 spoolsv.exe 2712 spoolsv.exe 2944 spoolsv.exe 2612 spoolsv.exe 1884 spoolsv.exe 2296 spoolsv.exe 1108 spoolsv.exe 912 spoolsv.exe 2068 spoolsv.exe 2768 spoolsv.exe 572 spoolsv.exe 1652 spoolsv.exe 2628 spoolsv.exe 1928 spoolsv.exe 1316 spoolsv.exe 1152 spoolsv.exe 2848 spoolsv.exe 2396 spoolsv.exe 2516 spoolsv.exe 2080 spoolsv.exe 940 spoolsv.exe 2844 spoolsv.exe 1672 spoolsv.exe 2540 spoolsv.exe 1488 spoolsv.exe 2376 spoolsv.exe 988 spoolsv.exe 1052 spoolsv.exe 1540 spoolsv.exe 2588 spoolsv.exe 848 spoolsv.exe 952 spoolsv.exe 2364 spoolsv.exe 2560 spoolsv.exe 2904 spoolsv.exe 2088 spoolsv.exe 1692 spoolsv.exe 1568 spoolsv.exe 2468 spoolsv.exe 1840 spoolsv.exe 2252 spoolsv.exe 1764 spoolsv.exe 2112 spoolsv.exe 1780 spoolsv.exe 1360 spoolsv.exe 2568 spoolsv.exe 2584 spoolsv.exe 2524 spoolsv.exe 1580 spoolsv.exe 1988 spoolsv.exe 2720 spoolsv.exe 820 spoolsv.exe 2480 explorer.exe 2312 spoolsv.exe 2224 spoolsv.exe 2556 spoolsv.exe 2900 spoolsv.exe 2144 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exeexplorer.exepid process 2492 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe 2492 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 11 IoCs
Processes:
74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 1548 set thread context of 2492 1548 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe PID 268 set thread context of 1324 268 explorer.exe explorer.exe PID 2508 set thread context of 820 2508 spoolsv.exe spoolsv.exe PID 2648 set thread context of 2312 2648 spoolsv.exe spoolsv.exe PID 2264 set thread context of 2224 2264 spoolsv.exe spoolsv.exe PID 2260 set thread context of 2556 2260 spoolsv.exe spoolsv.exe PID 2712 set thread context of 2144 2712 spoolsv.exe spoolsv.exe PID 1684 set thread context of 936 1684 spoolsv.exe spoolsv.exe PID 2612 set thread context of 3160 2612 spoolsv.exe spoolsv.exe PID 2944 set thread context of 3596 2944 spoolsv.exe spoolsv.exe PID 2296 set thread context of 3816 2296 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 61 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 63 IoCs
Processes:
74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exeexplorer.exepid process 2492 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1324 explorer.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
Processes:
74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2492 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe 2492 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 1324 explorer.exe 820 spoolsv.exe 820 spoolsv.exe 2312 spoolsv.exe 2312 spoolsv.exe 2224 spoolsv.exe 2224 spoolsv.exe 2556 spoolsv.exe 2556 spoolsv.exe 2144 spoolsv.exe 2144 spoolsv.exe 936 spoolsv.exe 3160 spoolsv.exe 3160 spoolsv.exe 936 spoolsv.exe 3596 spoolsv.exe 3596 spoolsv.exe 3816 spoolsv.exe 3816 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1548 wrote to memory of 1668 1548 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe splwow64.exe PID 1548 wrote to memory of 1668 1548 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe splwow64.exe PID 1548 wrote to memory of 1668 1548 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe splwow64.exe PID 1548 wrote to memory of 1668 1548 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe splwow64.exe PID 1548 wrote to memory of 2492 1548 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe PID 1548 wrote to memory of 2492 1548 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe PID 1548 wrote to memory of 2492 1548 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe PID 1548 wrote to memory of 2492 1548 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe PID 1548 wrote to memory of 2492 1548 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe PID 1548 wrote to memory of 2492 1548 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe PID 2492 wrote to memory of 268 2492 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe explorer.exe PID 2492 wrote to memory of 268 2492 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe explorer.exe PID 2492 wrote to memory of 268 2492 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe explorer.exe PID 2492 wrote to memory of 268 2492 74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe explorer.exe PID 268 wrote to memory of 1324 268 explorer.exe explorer.exe PID 268 wrote to memory of 1324 268 explorer.exe explorer.exe PID 268 wrote to memory of 1324 268 explorer.exe explorer.exe PID 268 wrote to memory of 1324 268 explorer.exe explorer.exe PID 268 wrote to memory of 1324 268 explorer.exe explorer.exe PID 268 wrote to memory of 1324 268 explorer.exe explorer.exe PID 1324 wrote to memory of 2648 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2648 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2648 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2648 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2508 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2508 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2508 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2508 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2260 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2260 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2260 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2260 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2264 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2264 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2264 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2264 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 1684 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 1684 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 1684 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 1684 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2712 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2712 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2712 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2712 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2944 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2944 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2944 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2944 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2612 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2612 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2612 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2612 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 1884 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 1884 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 1884 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 1884 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2296 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2296 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2296 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 2296 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 1108 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 1108 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 1108 1324 explorer.exe spoolsv.exe PID 1324 wrote to memory of 1108 1324 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\74a123b57e148e9c13dc171b7fb50a32_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:268 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2648 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2312 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2508 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:820 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
PID:2480 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2260 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2556 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2264 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2224 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1684 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:936 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2712 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2144 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1824
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2944 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3596 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2612 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3160 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1884 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3936
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2296 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3816 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3876
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1108 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3208
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:912 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4036
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3428
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2768 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3192
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:572 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3760
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1652 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:956
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2628 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3852
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1928 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3704
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1316 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2608
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1152 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3796
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2848 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2324
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2396 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1864
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2516 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2388
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3976
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:940 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2548
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2844 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2764
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1672 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3436
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2540 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1708
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1488 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2404
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2376 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3240
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:988 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3848
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1052 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3544
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1540 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3528
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2588 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3564
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:848 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2552
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:952 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3668
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2952
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2364 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:112
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2248
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2904 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2072
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2088 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1608
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1692 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2636
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1568 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3784
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2468 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3248
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1840 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3720
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2252 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3836
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1764 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3652
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2112 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2076
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1780 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3732
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1360 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2284
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2568 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2756
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2584 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3888
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2524 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2580
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1580 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2668
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1988 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3080
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2720 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2172
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2900 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3092
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3808
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3696
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1112
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System32\spool\drivers\x64\3\mxdwdui.BUDFilesize
56KB
MD5bd72dcf1083b6e22ccbfa0e8e27fb1e0
SHA13fd23d4f14da768da7b8364d74c54932d704e74e
SHA25690f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1
SHA51272360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562
-
C:\Windows\system\spoolsv.exeFilesize
2.2MB
MD5df2a58ae407e1a335160ab6f11bdba79
SHA1f0918ab4f1058a41dcb588ff39d645346288c9af
SHA2568206f28836d7b746f3ef7c5829cfcbe504ce371244763c2d891939b53b9d5e31
SHA512d447db97eb9acdcb369e22e1c02940fcbfcd62b7bc5a0cc8570c77e4fcd1e64675daa5c0703a31ef4e823eb4262a7ad4e28f29ff23d6fe0064d541ac98e91d2f
-
\Windows\system\explorer.exeFilesize
2.2MB
MD55f5789a633296d8e3ddb2867c6475b37
SHA1bf9b5819923f809f41835f39767b925b107d4ca5
SHA256977cac939fe60acf174795728c30309e354ffeb5c67aaa1cf5154dc5413b064b
SHA512767a0363c712f9d274f3dbc2564352a1b662466eed3c24f6550c8884fa19fab5a3e02a562b434c09032404f1e6a33eb4d5f59b0abccf9870c469536f5e73ba40
-
memory/268-67-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/268-43-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/268-58-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/572-1709-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/820-2294-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/820-2385-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/912-1701-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/936-2481-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/936-2510-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/940-2095-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/956-2641-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1108-1700-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1152-1913-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1316-1912-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1324-1031-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1488-2099-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1548-19-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/1548-0-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/1548-29-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1548-17-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1652-1710-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1672-2097-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1684-1246-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1708-2784-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1864-2728-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1884-1485-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1928-1911-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2068-1702-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2076-3207-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2080-1917-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2144-2473-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2144-2515-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2224-2320-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2260-1046-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2264-1245-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2296-1486-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2312-2308-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2324-2752-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2376-2273-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2388-2815-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2396-1915-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2404-3042-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2492-20-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2492-52-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2492-26-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2492-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2492-30-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2492-50-0x0000000000440000-0x000000000051F000-memory.dmpFilesize
892KB
-
memory/2508-1045-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2516-1916-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2540-2098-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2556-2380-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2612-1469-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2628-1711-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2648-1039-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2668-3214-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2712-1247-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2756-3105-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2768-1708-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2844-2096-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2848-1914-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2944-1248-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3160-2497-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3208-2618-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3428-2653-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3436-2845-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3528-3163-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3596-2495-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3704-2686-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3732-3100-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3760-2696-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3784-3132-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3796-2717-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3816-2542-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3816-2853-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3848-3204-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3852-2714-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3936-2553-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4036-2583-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB