Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 08:21
Static task
static1
Behavioral task
behavioral1
Sample
154dd7d9638995072c2c78ab478a3043_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
154dd7d9638995072c2c78ab478a3043_JaffaCakes118.exe
-
Size
166KB
-
MD5
154dd7d9638995072c2c78ab478a3043
-
SHA1
339ecc8ec888de71c6f76913e8cc97a0dcbc0060
-
SHA256
9fcc3b77d2085e60800e7f6e61e87d494c5b9bab5903135230f21b24df4aa67d
-
SHA512
663349206cbef3ee2b8f0a29fb89db78bf9cc8a319c910bd73e993b2a7cc21924402c156096b15467017aabb7f315e5f3adf75d6bba1cd7b60adafd4e5bb4d2b
-
SSDEEP
1536:8NpbWTono2PF9yJH9KBjH7ZoSQoL+Qz6AkMK6TNXkZXdrBVPjlVRuwz24+g:ldKFOoL16AkMK6BXEtrB9jlP5Yg
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exeWaterMark.exepid process 2072 154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exe 848 WaterMark.exe -
Loads dropped DLL 4 IoCs
Processes:
154dd7d9638995072c2c78ab478a3043_JaffaCakes118.exe154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exepid process 288 154dd7d9638995072c2c78ab478a3043_JaffaCakes118.exe 288 154dd7d9638995072c2c78ab478a3043_JaffaCakes118.exe 2072 154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exe 2072 154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exe -
Processes:
resource yara_rule behavioral1/memory/2072-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2072-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2072-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2072-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2072-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2072-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2072-20-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/848-35-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/848-39-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/848-549-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exe154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exedescription ioc process File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Utilities.v3.5.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libgl_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe svchost.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.exe svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\currency.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\skchui.dll svchost.exe File opened for modification C:\Program Files\DVD Maker\OmdProject.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libyuv_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\libmarq_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_sse2_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\hxdsui.dll svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\pxCDC.tmp 154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\hxds.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEDAO.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libqsv_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libvoc_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libwave_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\fxplugins.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_sse2_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html svchost.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libmpg123_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Mail\msoe.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libinflate_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\flyout.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe svchost.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwjpn.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEODBCI.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libtextst_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipres.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Csi.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\mozavutil.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsBase.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODTXT.DLL svchost.exe File opened for modification C:\Program Files\DVD Maker\Pipeline.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe svchost.exe File opened for modification C:\Program Files\Windows Journal\jnwmon.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\currency.html svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
WaterMark.exesvchost.exepid process 848 WaterMark.exe 848 WaterMark.exe 848 WaterMark.exe 848 WaterMark.exe 848 WaterMark.exe 848 WaterMark.exe 848 WaterMark.exe 848 WaterMark.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 848 WaterMark.exe Token: SeDebugPrivilege 2432 svchost.exe Token: SeDebugPrivilege 848 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exeWaterMark.exepid process 2072 154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exe 848 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
154dd7d9638995072c2c78ab478a3043_JaffaCakes118.exe154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exeWaterMark.exesvchost.exedescription pid process target process PID 288 wrote to memory of 2072 288 154dd7d9638995072c2c78ab478a3043_JaffaCakes118.exe 154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exe PID 288 wrote to memory of 2072 288 154dd7d9638995072c2c78ab478a3043_JaffaCakes118.exe 154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exe PID 288 wrote to memory of 2072 288 154dd7d9638995072c2c78ab478a3043_JaffaCakes118.exe 154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exe PID 288 wrote to memory of 2072 288 154dd7d9638995072c2c78ab478a3043_JaffaCakes118.exe 154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exe PID 2072 wrote to memory of 848 2072 154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exe WaterMark.exe PID 2072 wrote to memory of 848 2072 154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exe WaterMark.exe PID 2072 wrote to memory of 848 2072 154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exe WaterMark.exe PID 2072 wrote to memory of 848 2072 154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exe WaterMark.exe PID 848 wrote to memory of 2664 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2664 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2664 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2664 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2664 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2664 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2664 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2664 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2664 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2664 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2432 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2432 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2432 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2432 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2432 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2432 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2432 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2432 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2432 848 WaterMark.exe svchost.exe PID 848 wrote to memory of 2432 848 WaterMark.exe svchost.exe PID 2432 wrote to memory of 256 2432 svchost.exe smss.exe PID 2432 wrote to memory of 256 2432 svchost.exe smss.exe PID 2432 wrote to memory of 256 2432 svchost.exe smss.exe PID 2432 wrote to memory of 256 2432 svchost.exe smss.exe PID 2432 wrote to memory of 256 2432 svchost.exe smss.exe PID 2432 wrote to memory of 332 2432 svchost.exe csrss.exe PID 2432 wrote to memory of 332 2432 svchost.exe csrss.exe PID 2432 wrote to memory of 332 2432 svchost.exe csrss.exe PID 2432 wrote to memory of 332 2432 svchost.exe csrss.exe PID 2432 wrote to memory of 332 2432 svchost.exe csrss.exe PID 2432 wrote to memory of 380 2432 svchost.exe wininit.exe PID 2432 wrote to memory of 380 2432 svchost.exe wininit.exe PID 2432 wrote to memory of 380 2432 svchost.exe wininit.exe PID 2432 wrote to memory of 380 2432 svchost.exe wininit.exe PID 2432 wrote to memory of 380 2432 svchost.exe wininit.exe PID 2432 wrote to memory of 396 2432 svchost.exe csrss.exe PID 2432 wrote to memory of 396 2432 svchost.exe csrss.exe PID 2432 wrote to memory of 396 2432 svchost.exe csrss.exe PID 2432 wrote to memory of 396 2432 svchost.exe csrss.exe PID 2432 wrote to memory of 396 2432 svchost.exe csrss.exe PID 2432 wrote to memory of 432 2432 svchost.exe winlogon.exe PID 2432 wrote to memory of 432 2432 svchost.exe winlogon.exe PID 2432 wrote to memory of 432 2432 svchost.exe winlogon.exe PID 2432 wrote to memory of 432 2432 svchost.exe winlogon.exe PID 2432 wrote to memory of 432 2432 svchost.exe winlogon.exe PID 2432 wrote to memory of 480 2432 svchost.exe services.exe PID 2432 wrote to memory of 480 2432 svchost.exe services.exe PID 2432 wrote to memory of 480 2432 svchost.exe services.exe PID 2432 wrote to memory of 480 2432 svchost.exe services.exe PID 2432 wrote to memory of 480 2432 svchost.exe services.exe PID 2432 wrote to memory of 488 2432 svchost.exe lsass.exe PID 2432 wrote to memory of 488 2432 svchost.exe lsass.exe PID 2432 wrote to memory of 488 2432 svchost.exe lsass.exe PID 2432 wrote to memory of 488 2432 svchost.exe lsass.exe PID 2432 wrote to memory of 488 2432 svchost.exe lsass.exe PID 2432 wrote to memory of 496 2432 svchost.exe lsm.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\154dd7d9638995072c2c78ab478a3043_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\154dd7d9638995072c2c78ab478a3043_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exeC:\Users\Admin\AppData\Local\Temp\154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.htmlFilesize
206KB
MD58f1794f97a0c18413f40b3503f69ae87
SHA1e062598cb589c1efbc27b1639540f22d8b165591
SHA256333769358f2703e02bdb8b64d826ec96354a451621712b06195bea592de39c5b
SHA512adf1f0187f76cf115f8c70938c41a6277ecd7d1da09919f5f5fd8211532229228086fd739e4afa0cdd9a358e29cb3ab722ac19502779bf68a3be65848f70d3f0
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.htmlFilesize
202KB
MD5d6a7b64245ea3db58c34baed95b7acc9
SHA151b8ccba88d3ff929d8418a18cf62ed17ae55a7f
SHA25696e9f7e0e2b1361a2eb30a49c2f8c946d043d4381777b8710a58866ebf67be9f
SHA5120bee014a12cda58ecad06c4dc22a8777957f683655944f025a7ca7129537e16eeead03249ba3ed8546c45597300f9b09d81464ec3dd990a1c468133f535dce8b
-
C:\Users\Admin\AppData\Local\Temp\154dd7d9638995072c2c78ab478a3043_JaffaCakes118mgr.exeFilesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
memory/288-8-0x00000000002F0000-0x000000000031C000-memory.dmpFilesize
176KB
-
memory/288-0-0x00000000002F0000-0x000000000031C000-memory.dmpFilesize
176KB
-
memory/848-549-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/848-39-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/848-70-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/848-81-0x000000007766F000-0x0000000077670000-memory.dmpFilesize
4KB
-
memory/848-42-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/848-41-0x000000007766F000-0x0000000077670000-memory.dmpFilesize
4KB
-
memory/848-40-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/848-30-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/848-35-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2072-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2072-19-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2072-20-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2072-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2072-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2072-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2072-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2072-11-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2072-10-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2432-82-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2432-315-0x0000000077670000-0x0000000077671000-memory.dmpFilesize
4KB
-
memory/2432-87-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2432-88-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2432-72-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2432-90-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2432-86-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2432-91-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2432-89-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2664-58-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2664-66-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/2664-65-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/2664-62-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2664-64-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/2664-53-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2664-990-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2664-45-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/2664-43-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB