Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 10:01
Static task
static1
Behavioral task
behavioral1
Sample
1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe
-
Size
232KB
-
MD5
1adddbab5f28afe8bbf5071392698a9c
-
SHA1
905dda62611d6641c43c8aad0f9cb17d1a950231
-
SHA256
3216e1fe62683c41494e363daeebc835b8eac7cfb7f79c522f637e5eda706e93
-
SHA512
1e87ff12ba1bce38fa2e3c9966d0bebdc1574bc11f90d6bcfcfd41a0aa4ac7348ccef6bf00b03a4c2cf38789a25185dd77306ab6c5eae9a1facacdd01b5bb015
-
SSDEEP
3072:pWSM/xCLimHVSibtDnXX79I6rYgMH4JlT3VMJrv7+r01zhkK6eMsEN:wSM/xgIkwYHTSnrpMsEN
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
Processes:
igfxcf32.exepid process 2616 igfxcf32.exe -
Executes dropped EXE 28 IoCs
Processes:
igfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exepid process 2672 igfxcf32.exe 2616 igfxcf32.exe 2588 igfxcf32.exe 1084 igfxcf32.exe 1800 igfxcf32.exe 1536 igfxcf32.exe 1136 igfxcf32.exe 1620 igfxcf32.exe 2060 igfxcf32.exe 2888 igfxcf32.exe 444 igfxcf32.exe 2304 igfxcf32.exe 1292 igfxcf32.exe 924 igfxcf32.exe 840 igfxcf32.exe 2360 igfxcf32.exe 1276 igfxcf32.exe 2040 igfxcf32.exe 2720 igfxcf32.exe 2728 igfxcf32.exe 2588 igfxcf32.exe 2940 igfxcf32.exe 3004 igfxcf32.exe 1792 igfxcf32.exe 2756 igfxcf32.exe 1136 igfxcf32.exe 1676 igfxcf32.exe 2832 igfxcf32.exe -
Loads dropped DLL 56 IoCs
Processes:
1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exepid process 2100 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe 2100 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe 2672 igfxcf32.exe 2672 igfxcf32.exe 2616 igfxcf32.exe 2616 igfxcf32.exe 2588 igfxcf32.exe 2588 igfxcf32.exe 1084 igfxcf32.exe 1084 igfxcf32.exe 1800 igfxcf32.exe 1800 igfxcf32.exe 1536 igfxcf32.exe 1536 igfxcf32.exe 1136 igfxcf32.exe 1136 igfxcf32.exe 1620 igfxcf32.exe 1620 igfxcf32.exe 2060 igfxcf32.exe 2060 igfxcf32.exe 2888 igfxcf32.exe 2888 igfxcf32.exe 444 igfxcf32.exe 444 igfxcf32.exe 2304 igfxcf32.exe 2304 igfxcf32.exe 1292 igfxcf32.exe 1292 igfxcf32.exe 924 igfxcf32.exe 924 igfxcf32.exe 840 igfxcf32.exe 840 igfxcf32.exe 2360 igfxcf32.exe 2360 igfxcf32.exe 1276 igfxcf32.exe 1276 igfxcf32.exe 2040 igfxcf32.exe 2040 igfxcf32.exe 2720 igfxcf32.exe 2720 igfxcf32.exe 2728 igfxcf32.exe 2728 igfxcf32.exe 2588 igfxcf32.exe 2588 igfxcf32.exe 2940 igfxcf32.exe 2940 igfxcf32.exe 3004 igfxcf32.exe 3004 igfxcf32.exe 1792 igfxcf32.exe 1792 igfxcf32.exe 2756 igfxcf32.exe 2756 igfxcf32.exe 1136 igfxcf32.exe 1136 igfxcf32.exe 1676 igfxcf32.exe 1676 igfxcf32.exe -
Processes:
resource yara_rule behavioral1/memory/2100-9-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2100-10-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2100-12-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2100-13-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2100-11-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2100-6-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2100-5-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2100-3-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2100-26-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2616-40-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2616-42-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2616-41-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2616-43-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2616-44-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2616-46-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2616-53-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1084-66-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1084-71-0x00000000030F0000-0x000000000312C000-memory.dmp upx behavioral1/memory/1084-75-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1536-87-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1536-97-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1620-110-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1620-119-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2888-132-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2888-137-0x0000000003110000-0x000000000314C000-memory.dmp upx behavioral1/memory/2888-142-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2304-155-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2304-166-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/924-179-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/924-184-0x0000000003210000-0x000000000324C000-memory.dmp upx behavioral1/memory/924-188-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2360-201-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2360-207-0x0000000003220000-0x000000000325C000-memory.dmp upx behavioral1/memory/2360-212-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2040-225-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2040-232-0x00000000030D0000-0x000000000310C000-memory.dmp upx behavioral1/memory/2040-235-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2728-246-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2728-248-0x0000000003330000-0x000000000336C000-memory.dmp upx behavioral1/memory/2728-252-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2940-263-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2940-264-0x0000000003230000-0x000000000326C000-memory.dmp upx behavioral1/memory/2940-268-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1792-278-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1792-284-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1136-294-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1136-300-0x0000000000400000-0x0000000000455000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 30 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
igfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exe1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxcf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxcf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxcf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxcf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxcf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxcf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxcf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxcf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxcf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxcf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxcf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxcf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxcf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxcf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxcf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxcf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxcf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxcf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxcf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxcf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxcf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxcf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxcf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxcf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxcf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxcf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxcf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxcf32.exe -
Drops file in System32 directory 43 IoCs
Processes:
igfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exe1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ igfxcf32.exe File opened for modification C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File created C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File opened for modification C:\Windows\SysWOW64\ igfxcf32.exe File opened for modification C:\Windows\SysWOW64\ igfxcf32.exe File opened for modification C:\Windows\SysWOW64\ igfxcf32.exe File created C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File opened for modification C:\Windows\SysWOW64\igfxcf32.exe 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File created C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File opened for modification C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File opened for modification C:\Windows\SysWOW64\ igfxcf32.exe File opened for modification C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File created C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File opened for modification C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File opened for modification C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File opened for modification C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File created C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File opened for modification C:\Windows\SysWOW64\ igfxcf32.exe File opened for modification C:\Windows\SysWOW64\ igfxcf32.exe File created C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File opened for modification C:\Windows\SysWOW64\ igfxcf32.exe File opened for modification C:\Windows\SysWOW64\ igfxcf32.exe File opened for modification C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File created C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File created C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File opened for modification C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File opened for modification C:\Windows\SysWOW64\ igfxcf32.exe File created C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File opened for modification C:\Windows\SysWOW64\ igfxcf32.exe File opened for modification C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File created C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File opened for modification C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File opened for modification C:\Windows\SysWOW64\ igfxcf32.exe File opened for modification C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File opened for modification C:\Windows\SysWOW64\ igfxcf32.exe File opened for modification C:\Windows\SysWOW64\ 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxcf32.exe 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ igfxcf32.exe File created C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File created C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File opened for modification C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe File created C:\Windows\SysWOW64\igfxcf32.exe igfxcf32.exe -
Suspicious use of SetThreadContext 15 IoCs
Processes:
1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exedescription pid process target process PID 2552 set thread context of 2100 2552 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe PID 2672 set thread context of 2616 2672 igfxcf32.exe igfxcf32.exe PID 2588 set thread context of 1084 2588 igfxcf32.exe igfxcf32.exe PID 1800 set thread context of 1536 1800 igfxcf32.exe igfxcf32.exe PID 1136 set thread context of 1620 1136 igfxcf32.exe igfxcf32.exe PID 2060 set thread context of 2888 2060 igfxcf32.exe igfxcf32.exe PID 444 set thread context of 2304 444 igfxcf32.exe igfxcf32.exe PID 1292 set thread context of 924 1292 igfxcf32.exe igfxcf32.exe PID 840 set thread context of 2360 840 igfxcf32.exe igfxcf32.exe PID 1276 set thread context of 2040 1276 igfxcf32.exe igfxcf32.exe PID 2720 set thread context of 2728 2720 igfxcf32.exe igfxcf32.exe PID 2588 set thread context of 2940 2588 igfxcf32.exe igfxcf32.exe PID 3004 set thread context of 1792 3004 igfxcf32.exe igfxcf32.exe PID 2756 set thread context of 1136 2756 igfxcf32.exe igfxcf32.exe PID 1676 set thread context of 2832 1676 igfxcf32.exe igfxcf32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exepid process 2100 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe 2100 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe 2616 igfxcf32.exe 2616 igfxcf32.exe 1084 igfxcf32.exe 1084 igfxcf32.exe 1536 igfxcf32.exe 1536 igfxcf32.exe 1620 igfxcf32.exe 1620 igfxcf32.exe 2888 igfxcf32.exe 2888 igfxcf32.exe 2304 igfxcf32.exe 2304 igfxcf32.exe 924 igfxcf32.exe 924 igfxcf32.exe 2360 igfxcf32.exe 2360 igfxcf32.exe 2040 igfxcf32.exe 2040 igfxcf32.exe 2728 igfxcf32.exe 2728 igfxcf32.exe 2940 igfxcf32.exe 2940 igfxcf32.exe 1792 igfxcf32.exe 1792 igfxcf32.exe 1136 igfxcf32.exe 1136 igfxcf32.exe 2832 igfxcf32.exe 2832 igfxcf32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exeigfxcf32.exedescription pid process target process PID 2552 wrote to memory of 2100 2552 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe PID 2552 wrote to memory of 2100 2552 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe PID 2552 wrote to memory of 2100 2552 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe PID 2552 wrote to memory of 2100 2552 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe PID 2552 wrote to memory of 2100 2552 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe PID 2552 wrote to memory of 2100 2552 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe PID 2552 wrote to memory of 2100 2552 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe PID 2100 wrote to memory of 2672 2100 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe igfxcf32.exe PID 2100 wrote to memory of 2672 2100 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe igfxcf32.exe PID 2100 wrote to memory of 2672 2100 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe igfxcf32.exe PID 2100 wrote to memory of 2672 2100 1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe igfxcf32.exe PID 2672 wrote to memory of 2616 2672 igfxcf32.exe igfxcf32.exe PID 2672 wrote to memory of 2616 2672 igfxcf32.exe igfxcf32.exe PID 2672 wrote to memory of 2616 2672 igfxcf32.exe igfxcf32.exe PID 2672 wrote to memory of 2616 2672 igfxcf32.exe igfxcf32.exe PID 2672 wrote to memory of 2616 2672 igfxcf32.exe igfxcf32.exe PID 2672 wrote to memory of 2616 2672 igfxcf32.exe igfxcf32.exe PID 2672 wrote to memory of 2616 2672 igfxcf32.exe igfxcf32.exe PID 2616 wrote to memory of 2588 2616 igfxcf32.exe igfxcf32.exe PID 2616 wrote to memory of 2588 2616 igfxcf32.exe igfxcf32.exe PID 2616 wrote to memory of 2588 2616 igfxcf32.exe igfxcf32.exe PID 2616 wrote to memory of 2588 2616 igfxcf32.exe igfxcf32.exe PID 2588 wrote to memory of 1084 2588 igfxcf32.exe igfxcf32.exe PID 2588 wrote to memory of 1084 2588 igfxcf32.exe igfxcf32.exe PID 2588 wrote to memory of 1084 2588 igfxcf32.exe igfxcf32.exe PID 2588 wrote to memory of 1084 2588 igfxcf32.exe igfxcf32.exe PID 2588 wrote to memory of 1084 2588 igfxcf32.exe igfxcf32.exe PID 2588 wrote to memory of 1084 2588 igfxcf32.exe igfxcf32.exe PID 2588 wrote to memory of 1084 2588 igfxcf32.exe igfxcf32.exe PID 1084 wrote to memory of 1800 1084 igfxcf32.exe igfxcf32.exe PID 1084 wrote to memory of 1800 1084 igfxcf32.exe igfxcf32.exe PID 1084 wrote to memory of 1800 1084 igfxcf32.exe igfxcf32.exe PID 1084 wrote to memory of 1800 1084 igfxcf32.exe igfxcf32.exe PID 1800 wrote to memory of 1536 1800 igfxcf32.exe igfxcf32.exe PID 1800 wrote to memory of 1536 1800 igfxcf32.exe igfxcf32.exe PID 1800 wrote to memory of 1536 1800 igfxcf32.exe igfxcf32.exe PID 1800 wrote to memory of 1536 1800 igfxcf32.exe igfxcf32.exe PID 1800 wrote to memory of 1536 1800 igfxcf32.exe igfxcf32.exe PID 1800 wrote to memory of 1536 1800 igfxcf32.exe igfxcf32.exe PID 1800 wrote to memory of 1536 1800 igfxcf32.exe igfxcf32.exe PID 1536 wrote to memory of 1136 1536 igfxcf32.exe igfxcf32.exe PID 1536 wrote to memory of 1136 1536 igfxcf32.exe igfxcf32.exe PID 1536 wrote to memory of 1136 1536 igfxcf32.exe igfxcf32.exe PID 1536 wrote to memory of 1136 1536 igfxcf32.exe igfxcf32.exe PID 1136 wrote to memory of 1620 1136 igfxcf32.exe igfxcf32.exe PID 1136 wrote to memory of 1620 1136 igfxcf32.exe igfxcf32.exe PID 1136 wrote to memory of 1620 1136 igfxcf32.exe igfxcf32.exe PID 1136 wrote to memory of 1620 1136 igfxcf32.exe igfxcf32.exe PID 1136 wrote to memory of 1620 1136 igfxcf32.exe igfxcf32.exe PID 1136 wrote to memory of 1620 1136 igfxcf32.exe igfxcf32.exe PID 1136 wrote to memory of 1620 1136 igfxcf32.exe igfxcf32.exe PID 1620 wrote to memory of 2060 1620 igfxcf32.exe igfxcf32.exe PID 1620 wrote to memory of 2060 1620 igfxcf32.exe igfxcf32.exe PID 1620 wrote to memory of 2060 1620 igfxcf32.exe igfxcf32.exe PID 1620 wrote to memory of 2060 1620 igfxcf32.exe igfxcf32.exe PID 2060 wrote to memory of 2888 2060 igfxcf32.exe igfxcf32.exe PID 2060 wrote to memory of 2888 2060 igfxcf32.exe igfxcf32.exe PID 2060 wrote to memory of 2888 2060 igfxcf32.exe igfxcf32.exe PID 2060 wrote to memory of 2888 2060 igfxcf32.exe igfxcf32.exe PID 2060 wrote to memory of 2888 2060 igfxcf32.exe igfxcf32.exe PID 2060 wrote to memory of 2888 2060 igfxcf32.exe igfxcf32.exe PID 2060 wrote to memory of 2888 2060 igfxcf32.exe igfxcf32.exe PID 2888 wrote to memory of 444 2888 igfxcf32.exe igfxcf32.exe PID 2888 wrote to memory of 444 2888 igfxcf32.exe igfxcf32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1adddbab5f28afe8bbf5071392698a9c_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Users\Admin\AppData\Local\Temp\1ADDDB~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Users\Admin\AppData\Local\Temp\1ADDDB~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxcf32.exe"C:\Windows\system32\igfxcf32.exe" C:\Windows\SysWOW64\igfxcf32.exe30⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Windows\SysWOW64\igfxcf32.exeFilesize
232KB
MD51adddbab5f28afe8bbf5071392698a9c
SHA1905dda62611d6641c43c8aad0f9cb17d1a950231
SHA2563216e1fe62683c41494e363daeebc835b8eac7cfb7f79c522f637e5eda706e93
SHA5121e87ff12ba1bce38fa2e3c9966d0bebdc1574bc11f90d6bcfcfd41a0aa4ac7348ccef6bf00b03a4c2cf38789a25185dd77306ab6c5eae9a1facacdd01b5bb015
-
memory/444-153-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/444-139-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/840-199-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/924-188-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/924-184-0x0000000003210000-0x000000000324C000-memory.dmpFilesize
240KB
-
memory/924-185-0x0000000003210000-0x000000000324C000-memory.dmpFilesize
240KB
-
memory/924-179-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1084-66-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1084-75-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1084-71-0x00000000030F0000-0x000000000312C000-memory.dmpFilesize
240KB
-
memory/1136-94-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1136-296-0x0000000003260000-0x000000000329C000-memory.dmpFilesize
240KB
-
memory/1136-107-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1136-294-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1136-300-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1276-209-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1276-223-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1276-224-0x00000000003B0000-0x00000000003EC000-memory.dmpFilesize
240KB
-
memory/1292-177-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1292-163-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1536-97-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1536-87-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1620-115-0x0000000003230000-0x000000000326C000-memory.dmpFilesize
240KB
-
memory/1620-110-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1620-119-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1676-308-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1676-297-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1792-280-0x0000000003170000-0x00000000031AC000-memory.dmpFilesize
240KB
-
memory/1792-278-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1792-284-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1800-85-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1800-72-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2040-225-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2040-232-0x00000000030D0000-0x000000000310C000-memory.dmpFilesize
240KB
-
memory/2040-235-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2040-230-0x00000000030D0000-0x000000000310C000-memory.dmpFilesize
240KB
-
memory/2060-116-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2060-130-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2100-3-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2100-24-0x0000000003190000-0x00000000031CC000-memory.dmpFilesize
240KB
-
memory/2100-11-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2100-26-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2100-6-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2100-5-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2100-1-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2100-13-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2100-23-0x0000000003190000-0x00000000031CC000-memory.dmpFilesize
240KB
-
memory/2100-9-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2100-10-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2100-12-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2304-162-0x0000000003220000-0x000000000325C000-memory.dmpFilesize
240KB
-
memory/2304-166-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2304-161-0x0000000003220000-0x000000000325C000-memory.dmpFilesize
240KB
-
memory/2304-155-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2360-207-0x0000000003220000-0x000000000325C000-memory.dmpFilesize
240KB
-
memory/2360-201-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2360-208-0x0000000003220000-0x000000000325C000-memory.dmpFilesize
240KB
-
memory/2360-212-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2552-7-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2552-0-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2588-260-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2588-63-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2588-50-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2588-249-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2616-46-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2616-40-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2616-53-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2616-48-0x0000000003110000-0x000000000314C000-memory.dmpFilesize
240KB
-
memory/2616-44-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2616-42-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2616-43-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2616-41-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2672-37-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2720-244-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2728-252-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2728-248-0x0000000003330000-0x000000000336C000-memory.dmpFilesize
240KB
-
memory/2728-246-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2756-292-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2756-281-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2888-138-0x0000000003110000-0x000000000314C000-memory.dmpFilesize
240KB
-
memory/2888-132-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2888-142-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2888-137-0x0000000003110000-0x000000000314C000-memory.dmpFilesize
240KB
-
memory/2940-268-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2940-264-0x0000000003230000-0x000000000326C000-memory.dmpFilesize
240KB
-
memory/2940-263-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/3004-276-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3004-265-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB