Analysis
-
max time kernel
110s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 10:48
Behavioral task
behavioral1
Sample
753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
753ac64d29342b23ff56c01034b497ef
-
SHA1
fa82ebc5e0e2fedc4120cedcfa815b6dbdd2e75f
-
SHA256
9b6bbea6cb392f69a6fe6e72fda33e9ee9fc49fe580238d52f176b319ad56ac4
-
SHA512
49947c055251585fb0aa2cef2ca35e62342ce67c52ab9f880ef5cc3c9748454d32f63cbf609f1cc259e670ef92cf59da7ce9e5cbf6c29b44608da2f2cb7770ac
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZP:0UzeyQMS4DqodCnoe+iitjWww7
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1088 explorer.exe 3620 explorer.exe 2792 spoolsv.exe 4820 spoolsv.exe 3668 spoolsv.exe 3440 spoolsv.exe 4876 spoolsv.exe 616 spoolsv.exe 4704 spoolsv.exe 4836 spoolsv.exe 1292 spoolsv.exe 1644 spoolsv.exe 880 spoolsv.exe 536 spoolsv.exe 3800 spoolsv.exe 3580 spoolsv.exe 2868 spoolsv.exe 4016 spoolsv.exe 2116 spoolsv.exe 1620 spoolsv.exe 3608 spoolsv.exe 3352 spoolsv.exe 4360 spoolsv.exe 1768 spoolsv.exe 1992 spoolsv.exe 4548 spoolsv.exe 4272 spoolsv.exe 4420 spoolsv.exe 2328 spoolsv.exe 4236 spoolsv.exe 2140 spoolsv.exe 3708 spoolsv.exe 3728 spoolsv.exe 2212 spoolsv.exe 1072 spoolsv.exe 2952 explorer.exe 4556 spoolsv.exe 3252 spoolsv.exe 2532 spoolsv.exe 4412 spoolsv.exe 3012 spoolsv.exe 2568 spoolsv.exe 5068 spoolsv.exe 1780 spoolsv.exe 3520 spoolsv.exe 3416 spoolsv.exe 1740 spoolsv.exe 1272 explorer.exe 644 spoolsv.exe 316 spoolsv.exe 1564 spoolsv.exe 4140 spoolsv.exe 900 spoolsv.exe 4952 spoolsv.exe 1848 spoolsv.exe 4108 spoolsv.exe 4992 spoolsv.exe 4136 spoolsv.exe 3876 spoolsv.exe 2220 spoolsv.exe 2880 spoolsv.exe 8 spoolsv.exe 2360 spoolsv.exe 4600 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 32 IoCs
Processes:
753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 1292 set thread context of 1388 1292 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe PID 1088 set thread context of 3620 1088 explorer.exe explorer.exe PID 2792 set thread context of 1072 2792 spoolsv.exe spoolsv.exe PID 4820 set thread context of 4556 4820 spoolsv.exe spoolsv.exe PID 3668 set thread context of 3252 3668 spoolsv.exe spoolsv.exe PID 3440 set thread context of 2532 3440 spoolsv.exe spoolsv.exe PID 4876 set thread context of 4412 4876 spoolsv.exe spoolsv.exe PID 616 set thread context of 3012 616 spoolsv.exe spoolsv.exe PID 4704 set thread context of 2568 4704 spoolsv.exe spoolsv.exe PID 4836 set thread context of 5068 4836 spoolsv.exe spoolsv.exe PID 1292 set thread context of 1780 1292 spoolsv.exe spoolsv.exe PID 1644 set thread context of 3416 1644 spoolsv.exe spoolsv.exe PID 880 set thread context of 1740 880 spoolsv.exe spoolsv.exe PID 536 set thread context of 644 536 spoolsv.exe spoolsv.exe PID 3800 set thread context of 316 3800 spoolsv.exe spoolsv.exe PID 2868 set thread context of 1564 2868 spoolsv.exe spoolsv.exe PID 3580 set thread context of 4140 3580 spoolsv.exe spoolsv.exe PID 2116 set thread context of 900 2116 spoolsv.exe spoolsv.exe PID 4016 set thread context of 4952 4016 spoolsv.exe spoolsv.exe PID 1620 set thread context of 1848 1620 spoolsv.exe spoolsv.exe PID 3608 set thread context of 4108 3608 spoolsv.exe spoolsv.exe PID 3352 set thread context of 4992 3352 spoolsv.exe spoolsv.exe PID 4360 set thread context of 4136 4360 spoolsv.exe spoolsv.exe PID 1768 set thread context of 3876 1768 spoolsv.exe spoolsv.exe PID 1992 set thread context of 2220 1992 spoolsv.exe spoolsv.exe PID 4548 set thread context of 2880 4548 spoolsv.exe spoolsv.exe PID 4272 set thread context of 8 4272 spoolsv.exe spoolsv.exe PID 4420 set thread context of 2360 4420 spoolsv.exe spoolsv.exe PID 2328 set thread context of 4600 2328 spoolsv.exe spoolsv.exe PID 4236 set thread context of 1608 4236 spoolsv.exe spoolsv.exe PID 2140 set thread context of 2076 2140 spoolsv.exe spoolsv.exe PID 3708 set thread context of 3460 3708 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 44 IoCs
Processes:
spoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exe753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exeexplorer.exepid process 1388 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe 1388 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1388 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe 1388 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 1072 spoolsv.exe 1072 spoolsv.exe 4556 spoolsv.exe 4556 spoolsv.exe 3252 spoolsv.exe 3252 spoolsv.exe 2532 spoolsv.exe 2532 spoolsv.exe 4412 spoolsv.exe 4412 spoolsv.exe 3012 spoolsv.exe 3012 spoolsv.exe 2568 spoolsv.exe 2568 spoolsv.exe 5068 spoolsv.exe 5068 spoolsv.exe 1780 spoolsv.exe 1780 spoolsv.exe 3416 spoolsv.exe 3416 spoolsv.exe 1740 spoolsv.exe 1740 spoolsv.exe 644 spoolsv.exe 644 spoolsv.exe 316 spoolsv.exe 316 spoolsv.exe 1564 spoolsv.exe 1564 spoolsv.exe 4140 spoolsv.exe 4140 spoolsv.exe 900 spoolsv.exe 900 spoolsv.exe 4952 spoolsv.exe 4952 spoolsv.exe 1848 spoolsv.exe 1848 spoolsv.exe 4108 spoolsv.exe 4108 spoolsv.exe 4992 spoolsv.exe 4992 spoolsv.exe 4136 spoolsv.exe 4136 spoolsv.exe 3876 spoolsv.exe 3876 spoolsv.exe 2220 spoolsv.exe 2220 spoolsv.exe 2880 spoolsv.exe 2880 spoolsv.exe 8 spoolsv.exe 8 spoolsv.exe 2360 spoolsv.exe 2360 spoolsv.exe 4600 spoolsv.exe 4600 spoolsv.exe 1608 spoolsv.exe 1608 spoolsv.exe 2076 spoolsv.exe 2076 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1292 wrote to memory of 1636 1292 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe splwow64.exe PID 1292 wrote to memory of 1636 1292 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe splwow64.exe PID 1292 wrote to memory of 1388 1292 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe PID 1292 wrote to memory of 1388 1292 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe PID 1292 wrote to memory of 1388 1292 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe PID 1292 wrote to memory of 1388 1292 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe PID 1292 wrote to memory of 1388 1292 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe PID 1388 wrote to memory of 1088 1388 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe explorer.exe PID 1388 wrote to memory of 1088 1388 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe explorer.exe PID 1388 wrote to memory of 1088 1388 753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe explorer.exe PID 1088 wrote to memory of 3620 1088 explorer.exe explorer.exe PID 1088 wrote to memory of 3620 1088 explorer.exe explorer.exe PID 1088 wrote to memory of 3620 1088 explorer.exe explorer.exe PID 1088 wrote to memory of 3620 1088 explorer.exe explorer.exe PID 1088 wrote to memory of 3620 1088 explorer.exe explorer.exe PID 3620 wrote to memory of 2792 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 2792 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 2792 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 4820 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 4820 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 4820 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 3668 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 3668 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 3668 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 3440 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 3440 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 3440 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 4876 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 4876 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 4876 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 616 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 616 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 616 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 4704 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 4704 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 4704 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 4836 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 4836 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 4836 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 1292 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 1292 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 1292 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 1644 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 1644 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 1644 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 880 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 880 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 880 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 536 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 536 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 536 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 3800 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 3800 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 3800 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 3580 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 3580 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 3580 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 2868 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 2868 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 2868 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 4016 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 4016 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 4016 3620 explorer.exe spoolsv.exe PID 3620 wrote to memory of 2116 3620 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\753ac64d29342b23ff56c01034b497ef_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD537fb450847418333f70b95be2534b07c
SHA19eb8388aaf48157c90799a6650afd19f7b9ae5d0
SHA256a6df9590046395563c7ef1ffe958593843a51ecf91fee3b4c92f860d2de113bd
SHA51277298f5746cef83c283f0d7563e9d9f3e74e8af91aaf89e7a6fd5f029d10760ba2c961fb9155ef1394f1c816836b0622d21683cbc64ec712bd3968b56a2ab24c
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD53245c1b60d4fdf43dcdb244baa7ab254
SHA1f7fd4bdf5fdd4976cc299b75171a70c63f5fdb35
SHA256c1de3128d32a5cdd1b075bdaed09b4014585b0910575fb68ed924fe3bf2b50de
SHA51204ce2de6583a630a0e9f871cb5373c7ae122dd5adeb12f466d5df6e700eeeb4c750229ae176cca94013324d679d5557bb87031e749013eb02f0a0f6b225e9665
-
memory/8-2326-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/316-2222-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/364-4089-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/364-3889-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/536-1730-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/616-1689-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/644-2212-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/880-1729-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/900-2254-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1072-2181-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1072-2075-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1088-83-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1088-78-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1292-33-0x0000000002480000-0x0000000002481000-memory.dmpFilesize
4KB
-
memory/1292-0-0x0000000002480000-0x0000000002481000-memory.dmpFilesize
4KB
-
memory/1292-31-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1292-1727-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1292-37-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1388-34-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1388-36-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1388-72-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1564-2235-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1608-2355-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1620-1868-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1644-1728-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1676-4123-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1720-3900-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1740-2201-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1768-1930-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1848-2279-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1992-1931-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2076-2753-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2116-1867-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2124-3985-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2220-2313-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2260-2926-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2260-2921-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2328-2073-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2360-2338-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2520-4114-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2532-2114-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2568-2154-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2792-1564-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2792-2076-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2868-1865-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2880-2314-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2936-3952-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2936-4142-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2936-4146-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2936-3956-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3012-2136-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3060-4002-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3152-3976-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3252-2099-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3352-1870-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3416-2613-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3440-1687-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3580-1864-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3608-1869-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3620-1563-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3620-84-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3664-3924-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3664-3993-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3668-1566-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3800-1731-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3876-2311-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4016-1866-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4136-2290-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4136-2293-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4236-2084-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4272-1933-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4360-1929-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4412-2127-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4420-1990-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4548-1932-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4552-4223-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4556-2086-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4556-2090-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4556-2088-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/4704-1690-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4820-2087-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4820-1565-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4836-1726-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4876-1688-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4952-2256-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4992-2288-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5064-4311-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5064-4419-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5068-2166-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5080-3916-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5112-3935-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB