Analysis
-
max time kernel
129s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 15:17
Behavioral task
behavioral1
Sample
75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
75e6477c3decbcf6ae684948eaf96af2
-
SHA1
c7386e79ba4059462a3510e2ee1f76c53070fc3f
-
SHA256
aa72bcf3a91303ad7b3c46fa379c2ff687cc4369f428602d6088d20523d57893
-
SHA512
adf4cebd10b4946135280c998f8c18014003d956f7d4ad0bd98d6e6cf4e7770edfeeb900b0e49d53c6f569965bfea713e74c79b00ccdd61dbf0798f2167abc12
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZX:0UzeyQMS4DqodCnoe+iitjWwwT
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2536 explorer.exe 1916 explorer.exe 1508 spoolsv.exe 1472 spoolsv.exe 2396 spoolsv.exe 1100 spoolsv.exe 2076 spoolsv.exe 3064 spoolsv.exe 1296 spoolsv.exe 2428 spoolsv.exe 2728 spoolsv.exe 296 spoolsv.exe 2260 spoolsv.exe 3008 spoolsv.exe 1212 spoolsv.exe 2216 spoolsv.exe 892 spoolsv.exe 1972 spoolsv.exe 284 spoolsv.exe 832 spoolsv.exe 1556 spoolsv.exe 916 spoolsv.exe 1496 spoolsv.exe 1580 spoolsv.exe 2204 spoolsv.exe 2560 spoolsv.exe 2704 spoolsv.exe 1380 spoolsv.exe 324 spoolsv.exe 2088 spoolsv.exe 2060 spoolsv.exe 1792 spoolsv.exe 2332 spoolsv.exe 1856 spoolsv.exe 2508 spoolsv.exe 1652 spoolsv.exe 2040 spoolsv.exe 2668 spoolsv.exe 1592 spoolsv.exe 2156 spoolsv.exe 856 spoolsv.exe 2312 spoolsv.exe 2616 spoolsv.exe 2944 spoolsv.exe 1468 spoolsv.exe 2800 spoolsv.exe 2368 spoolsv.exe 2528 spoolsv.exe 1620 spoolsv.exe 1416 spoolsv.exe 2372 spoolsv.exe 2488 spoolsv.exe 1336 spoolsv.exe 1796 spoolsv.exe 2684 spoolsv.exe 1564 spoolsv.exe 1560 spoolsv.exe 1124 spoolsv.exe 2360 spoolsv.exe 320 spoolsv.exe 2664 spoolsv.exe 1764 spoolsv.exe 2588 spoolsv.exe 1104 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exeexplorer.exepid process 2632 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe 2632 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exeexplorer.exedescription pid process target process PID 1936 set thread context of 2632 1936 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe PID 2536 set thread context of 1916 2536 explorer.exe explorer.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exeexplorer.exepid process 2632 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1916 explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exeexplorer.exepid process 2632 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe 2632 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe 1916 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1936 wrote to memory of 2504 1936 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe splwow64.exe PID 1936 wrote to memory of 2504 1936 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe splwow64.exe PID 1936 wrote to memory of 2504 1936 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe splwow64.exe PID 1936 wrote to memory of 2504 1936 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe splwow64.exe PID 1936 wrote to memory of 2632 1936 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe PID 1936 wrote to memory of 2632 1936 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe PID 1936 wrote to memory of 2632 1936 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe PID 1936 wrote to memory of 2632 1936 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe PID 1936 wrote to memory of 2632 1936 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe PID 1936 wrote to memory of 2632 1936 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe PID 2632 wrote to memory of 2536 2632 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe explorer.exe PID 2632 wrote to memory of 2536 2632 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe explorer.exe PID 2632 wrote to memory of 2536 2632 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe explorer.exe PID 2632 wrote to memory of 2536 2632 75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe explorer.exe PID 2536 wrote to memory of 1916 2536 explorer.exe explorer.exe PID 2536 wrote to memory of 1916 2536 explorer.exe explorer.exe PID 2536 wrote to memory of 1916 2536 explorer.exe explorer.exe PID 2536 wrote to memory of 1916 2536 explorer.exe explorer.exe PID 2536 wrote to memory of 1916 2536 explorer.exe explorer.exe PID 2536 wrote to memory of 1916 2536 explorer.exe explorer.exe PID 1916 wrote to memory of 1508 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 1508 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 1508 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 1508 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 1472 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 1472 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 1472 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 1472 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2396 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2396 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2396 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2396 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 1100 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 1100 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 1100 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 1100 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2076 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2076 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2076 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2076 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 3064 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 3064 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 3064 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 3064 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 1296 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 1296 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 1296 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 1296 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2428 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2428 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2428 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2428 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2728 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2728 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2728 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2728 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 296 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 296 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 296 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 296 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2260 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2260 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2260 1916 explorer.exe spoolsv.exe PID 1916 wrote to memory of 2260 1916 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Windows\system\explorer.exeFilesize
2.2MB
MD5a0348bbab72bc0ec2087f39f6e7ef35a
SHA19e9c70656149e1d30d0b2b1e0935eec89cb6b8e7
SHA2567ceffcdf1b4c7668c131cff859346b75cb9d771233576668544e8f72495978bb
SHA512f8c105602b2e4c6a5cef90d3a3216e01cf545ba726896970ee919c93558f59b9085cddebc4e8453ac58fa5c40745f800314e195a7a47838c48270e59988834d2
-
\Windows\system\spoolsv.exeFilesize
2.2MB
MD5881e5c1831ed109e149ac294560304ca
SHA15e68f25e66e0609ef5991d5c681e7ac00ba9ba59
SHA256f56fb317fc7217bf1293a3f7f97ad2942031f54190a54ba3388e86576a543d73
SHA5126d2697495587ea21a3c12909a2009ec21c24728a59d1e76f81a3b167f6bfb8f3ab30473d05d35a934afc5392df5ff4f63ab7f594927b59820f96257d68b2b401
-
memory/284-3166-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/296-3154-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/324-3625-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/832-3167-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/892-3159-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/916-3169-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1100-2648-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1212-3157-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1296-3151-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1380-3624-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1472-2646-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1496-3170-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1508-2645-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1556-3168-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1580-3620-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1792-3628-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1916-2644-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1936-17-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1936-0-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1936-27-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1936-19-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1972-3165-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2060-3627-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2076-2649-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2088-3626-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2204-3621-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2216-3158-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2260-3155-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2396-2647-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2428-3152-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2536-42-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2536-71-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2536-61-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2560-3622-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2632-20-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2632-24-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2632-29-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2632-50-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2632-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2704-3623-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2728-3153-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3008-3156-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3064-2650-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4348-5752-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4384-5743-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6088-5883-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6880-5921-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB