Analysis
-
max time kernel
132s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 08:14
Behavioral task
behavioral1
Sample
a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a8aff845ce99b65136f8cd2e41dd4006
-
SHA1
3dfc1b39af35a3406edda60438f9d9fd450da7e1
-
SHA256
f0a2a5c6c2ac22ee7eb88d6fd42eb42b60a2a615173b5441be63e1c1066e037e
-
SHA512
9781f60aaa1957f994268462b6ad41ab935f41c31669d0e929f3f559232b652b8b03113dfe171bd76064b0cf29144262a019fc000232cae60fb4ba3bf044fc49
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZH:0UzeyQMS4DqodCnoe+iitjWww7
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Drops startup file 2 IoCs
Processes:
a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe -
Executes dropped EXE 21 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 4192 explorer.exe 5064 explorer.exe 4084 explorer.exe 4428 explorer.exe 2180 explorer.exe 3720 explorer.exe 2892 explorer.exe 4884 explorer.exe 3652 explorer.exe 632 explorer.exe 432 explorer.exe 3156 explorer.exe 4980 explorer.exe 3844 explorer.exe 4348 explorer.exe 4376 explorer.exe 1508 explorer.exe 3568 explorer.exe 912 explorer.exe 4352 explorer.exe 1520 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 43 IoCs
Processes:
a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 2184 set thread context of 2260 2184 a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe PID 4192 set thread context of 5064 4192 explorer.exe explorer.exe PID 4080 set thread context of 2208 4080 spoolsv.exe spoolsv.exe PID 1840 set thread context of 1196 1840 spoolsv.exe spoolsv.exe PID 1268 set thread context of 2188 1268 spoolsv.exe spoolsv.exe PID 4864 set thread context of 2100 4864 spoolsv.exe spoolsv.exe PID 3520 set thread context of 4396 3520 spoolsv.exe spoolsv.exe PID 5032 set thread context of 3472 5032 spoolsv.exe spoolsv.exe PID 452 set thread context of 1416 452 spoolsv.exe spoolsv.exe PID 4296 set thread context of 4612 4296 spoolsv.exe spoolsv.exe PID 1820 set thread context of 388 1820 spoolsv.exe spoolsv.exe PID 4356 set thread context of 2972 4356 spoolsv.exe spoolsv.exe PID 680 set thread context of 4064 680 spoolsv.exe spoolsv.exe PID 4708 set thread context of 4652 4708 spoolsv.exe spoolsv.exe PID 4948 set thread context of 4796 4948 spoolsv.exe spoolsv.exe PID 436 set thread context of 1556 436 spoolsv.exe spoolsv.exe PID 1860 set thread context of 4128 1860 spoolsv.exe spoolsv.exe PID 2524 set thread context of 552 2524 spoolsv.exe spoolsv.exe PID 3804 set thread context of 4424 3804 spoolsv.exe spoolsv.exe PID 3044 set thread context of 4712 3044 spoolsv.exe spoolsv.exe PID 3056 set thread context of 1220 3056 spoolsv.exe spoolsv.exe PID 3772 set thread context of 1356 3772 spoolsv.exe spoolsv.exe PID 2664 set thread context of 976 2664 spoolsv.exe spoolsv.exe PID 4560 set thread context of 2572 4560 spoolsv.exe spoolsv.exe PID 2420 set thread context of 4832 2420 spoolsv.exe spoolsv.exe PID 3272 set thread context of 2704 3272 spoolsv.exe spoolsv.exe PID 4724 set thread context of 1596 4724 spoolsv.exe spoolsv.exe PID 4816 set thread context of 2544 4816 spoolsv.exe spoolsv.exe PID 1912 set thread context of 4512 1912 spoolsv.exe spoolsv.exe PID 4036 set thread context of 1928 4036 spoolsv.exe spoolsv.exe PID 1552 set thread context of 4904 1552 spoolsv.exe spoolsv.exe PID 228 set thread context of 1824 228 spoolsv.exe spoolsv.exe PID 4084 set thread context of 3156 4084 explorer.exe explorer.exe PID 3252 set thread context of 2836 3252 spoolsv.exe spoolsv.exe PID 4936 set thread context of 2840 4936 spoolsv.exe spoolsv.exe PID 4428 set thread context of 4348 4428 explorer.exe explorer.exe PID 4564 set thread context of 4528 4564 spoolsv.exe spoolsv.exe PID 2180 set thread context of 1508 2180 explorer.exe explorer.exe PID 1372 set thread context of 1592 1372 spoolsv.exe spoolsv.exe PID 3720 set thread context of 3568 3720 explorer.exe explorer.exe PID 1020 set thread context of 2168 1020 spoolsv.exe spoolsv.exe PID 2892 set thread context of 4352 2892 explorer.exe explorer.exe PID 4108 set thread context of 544 4108 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exea8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exea8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exespoolsv.exeexplorer.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exepid process 2260 a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe 2260 a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exepid process 2260 a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe 2260 a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe 2208 spoolsv.exe 2208 spoolsv.exe 1196 spoolsv.exe 1196 spoolsv.exe 2188 spoolsv.exe 2188 spoolsv.exe 2100 spoolsv.exe 2100 spoolsv.exe 4396 spoolsv.exe 4396 spoolsv.exe 3472 spoolsv.exe 3472 spoolsv.exe 1416 spoolsv.exe 1416 spoolsv.exe 4612 spoolsv.exe 4612 spoolsv.exe 388 spoolsv.exe 388 spoolsv.exe 2972 spoolsv.exe 2972 spoolsv.exe 4064 spoolsv.exe 4064 spoolsv.exe 4652 spoolsv.exe 4652 spoolsv.exe 4796 spoolsv.exe 4796 spoolsv.exe 1556 spoolsv.exe 1556 spoolsv.exe 4128 spoolsv.exe 4128 spoolsv.exe 552 spoolsv.exe 552 spoolsv.exe 4424 spoolsv.exe 4424 spoolsv.exe 4712 spoolsv.exe 4712 spoolsv.exe 1220 spoolsv.exe 1220 spoolsv.exe 1356 spoolsv.exe 1356 spoolsv.exe 976 spoolsv.exe 976 spoolsv.exe 2572 spoolsv.exe 2572 spoolsv.exe 4832 spoolsv.exe 4832 spoolsv.exe 2704 spoolsv.exe 2704 spoolsv.exe 1596 spoolsv.exe 1596 spoolsv.exe 2544 spoolsv.exe 2544 spoolsv.exe 4512 spoolsv.exe 4512 spoolsv.exe 1928 spoolsv.exe 1928 spoolsv.exe 4904 spoolsv.exe 4904 spoolsv.exe 1824 spoolsv.exe 1824 spoolsv.exe 3156 explorer.exe 3156 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exea8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 2184 wrote to memory of 2480 2184 a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe splwow64.exe PID 2184 wrote to memory of 2480 2184 a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe splwow64.exe PID 2184 wrote to memory of 2260 2184 a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe PID 2184 wrote to memory of 2260 2184 a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe PID 2184 wrote to memory of 2260 2184 a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe PID 2184 wrote to memory of 2260 2184 a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe PID 2184 wrote to memory of 2260 2184 a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe PID 2260 wrote to memory of 4192 2260 a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe explorer.exe PID 2260 wrote to memory of 4192 2260 a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe explorer.exe PID 2260 wrote to memory of 4192 2260 a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe explorer.exe PID 4192 wrote to memory of 5064 4192 explorer.exe explorer.exe PID 4192 wrote to memory of 5064 4192 explorer.exe explorer.exe PID 4192 wrote to memory of 5064 4192 explorer.exe explorer.exe PID 4192 wrote to memory of 5064 4192 explorer.exe explorer.exe PID 4192 wrote to memory of 5064 4192 explorer.exe explorer.exe PID 4080 wrote to memory of 2208 4080 spoolsv.exe spoolsv.exe PID 4080 wrote to memory of 2208 4080 spoolsv.exe spoolsv.exe PID 4080 wrote to memory of 2208 4080 spoolsv.exe spoolsv.exe PID 4080 wrote to memory of 2208 4080 spoolsv.exe spoolsv.exe PID 4080 wrote to memory of 2208 4080 spoolsv.exe spoolsv.exe PID 2208 wrote to memory of 4084 2208 spoolsv.exe explorer.exe PID 2208 wrote to memory of 4084 2208 spoolsv.exe explorer.exe PID 2208 wrote to memory of 4084 2208 spoolsv.exe explorer.exe PID 1840 wrote to memory of 1196 1840 spoolsv.exe spoolsv.exe PID 1840 wrote to memory of 1196 1840 spoolsv.exe spoolsv.exe PID 1840 wrote to memory of 1196 1840 spoolsv.exe spoolsv.exe PID 1840 wrote to memory of 1196 1840 spoolsv.exe spoolsv.exe PID 1840 wrote to memory of 1196 1840 spoolsv.exe spoolsv.exe PID 1268 wrote to memory of 2188 1268 spoolsv.exe spoolsv.exe PID 1268 wrote to memory of 2188 1268 spoolsv.exe spoolsv.exe PID 1268 wrote to memory of 2188 1268 spoolsv.exe spoolsv.exe PID 1268 wrote to memory of 2188 1268 spoolsv.exe spoolsv.exe PID 1268 wrote to memory of 2188 1268 spoolsv.exe spoolsv.exe PID 4864 wrote to memory of 2100 4864 spoolsv.exe spoolsv.exe PID 4864 wrote to memory of 2100 4864 spoolsv.exe spoolsv.exe PID 4864 wrote to memory of 2100 4864 spoolsv.exe spoolsv.exe PID 4864 wrote to memory of 2100 4864 spoolsv.exe spoolsv.exe PID 4864 wrote to memory of 2100 4864 spoolsv.exe spoolsv.exe PID 3520 wrote to memory of 4396 3520 spoolsv.exe spoolsv.exe PID 3520 wrote to memory of 4396 3520 spoolsv.exe spoolsv.exe PID 3520 wrote to memory of 4396 3520 spoolsv.exe spoolsv.exe PID 3520 wrote to memory of 4396 3520 spoolsv.exe spoolsv.exe PID 3520 wrote to memory of 4396 3520 spoolsv.exe spoolsv.exe PID 5032 wrote to memory of 3472 5032 spoolsv.exe spoolsv.exe PID 5032 wrote to memory of 3472 5032 spoolsv.exe spoolsv.exe PID 5032 wrote to memory of 3472 5032 spoolsv.exe spoolsv.exe PID 5032 wrote to memory of 3472 5032 spoolsv.exe spoolsv.exe PID 5032 wrote to memory of 3472 5032 spoolsv.exe spoolsv.exe PID 452 wrote to memory of 1416 452 spoolsv.exe spoolsv.exe PID 452 wrote to memory of 1416 452 spoolsv.exe spoolsv.exe PID 452 wrote to memory of 1416 452 spoolsv.exe spoolsv.exe PID 452 wrote to memory of 1416 452 spoolsv.exe spoolsv.exe PID 452 wrote to memory of 1416 452 spoolsv.exe spoolsv.exe PID 4296 wrote to memory of 4612 4296 spoolsv.exe spoolsv.exe PID 4296 wrote to memory of 4612 4296 spoolsv.exe spoolsv.exe PID 4296 wrote to memory of 4612 4296 spoolsv.exe spoolsv.exe PID 4296 wrote to memory of 4612 4296 spoolsv.exe spoolsv.exe PID 4296 wrote to memory of 4612 4296 spoolsv.exe spoolsv.exe PID 4612 wrote to memory of 4428 4612 spoolsv.exe explorer.exe PID 4612 wrote to memory of 4428 4612 spoolsv.exe explorer.exe PID 4612 wrote to memory of 4428 4612 spoolsv.exe explorer.exe PID 1820 wrote to memory of 388 1820 spoolsv.exe spoolsv.exe PID 1820 wrote to memory of 388 1820 spoolsv.exe spoolsv.exe PID 1820 wrote to memory of 388 1820 spoolsv.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8aff845ce99b65136f8cd2e41dd4006_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD5c45cf86ed57c53ed149027b9a38bd7c7
SHA11f437811822968d96f1ec029fecad535c930d6cc
SHA256e88b771b434356b9b1050072ef9ef1ab9afc90a15759c715e666cc294cae43c5
SHA512e63a71a1f983dc59ef4b9cc4d03c58a69c1501c98fc32dfd3adeb0a7b41fcf0ae477de8021fc0557def18891397524dc1a5f26a3cde882ce869158e77dd1c315
-
memory/388-2280-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/436-1730-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/452-1188-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/544-4554-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/544-4679-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/552-2622-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/552-2786-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/680-1539-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/728-5357-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/728-5450-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/976-2887-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1196-2004-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1196-2000-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1220-2726-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1268-2014-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1268-1009-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1284-5080-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1284-5076-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1356-2803-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1356-2942-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1416-2153-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1508-4204-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1508-5626-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1556-2473-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1592-4215-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1624-5387-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1704-4774-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1820-1385-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1824-3599-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1840-1008-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1840-2002-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1860-1731-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1892-5597-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1988-5617-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2100-2103-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2100-2099-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2168-4419-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2168-4517-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2184-46-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2184-52-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2184-0-0x0000000000790000-0x0000000000791000-memory.dmpFilesize
4KB
-
memory/2184-48-0x0000000000790000-0x0000000000791000-memory.dmpFilesize
4KB
-
memory/2188-2013-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2208-2183-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2208-1993-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2260-49-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2260-79-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2260-77-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/2260-51-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2420-2096-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2524-1850-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2544-3135-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2572-2895-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2572-2899-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2664-1997-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2796-5204-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2796-5058-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2836-3839-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2840-3931-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2972-2291-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3044-1852-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3056-1991-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3156-3705-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3180-5068-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3264-5231-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3264-5229-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3472-2123-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3520-1186-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3568-4343-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3772-1992-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3804-1851-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3808-5089-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4064-2301-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4064-2304-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4080-871-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4080-1988-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4128-2585-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4192-85-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4192-89-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4192-4784-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4260-5315-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4296-1384-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4348-3941-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4352-4547-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4356-1538-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4396-2112-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4424-2706-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4424-2703-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4528-4108-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4560-2012-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4612-2442-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4612-2269-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4652-2382-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4708-1540-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4712-2714-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4712-2717-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4796-2604-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4796-2465-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4832-3035-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4832-3112-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4864-1010-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4904-3287-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4904-3381-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4944-5370-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4948-1729-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5012-5402-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5024-5376-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5024-5380-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5032-1187-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5064-870-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5064-90-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB