Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 11:22
Static task
static1
Behavioral task
behavioral1
Sample
15d00fc2efbd85c50422b973081840bc_JaffaCakes118.dll
Resource
win7-20240611-en
General
-
Target
15d00fc2efbd85c50422b973081840bc_JaffaCakes118.dll
-
Size
337KB
-
MD5
15d00fc2efbd85c50422b973081840bc
-
SHA1
cf3d6bc5ebf9d8d989166adbfd967be2bef3ef74
-
SHA256
dd32e1e9e2417e47708a7553a41bfcf5208bd3ca89a7f04742b202c910483e25
-
SHA512
c91c07e4355a5887d058ea5f10b402792730c0d3f8e221a130a78eb9371d0667fc96e7111ac5337f144d12ff29b9f9a590ee454936d747abd29e5fa1c4cbd02a
-
SSDEEP
6144:qN0yr1sO/wIKS0FKtOT/OrDtgUi0uvQee7Qee/0QeesQeeglQeekQeeDC7M3HCRD:qG6wndYtamDSU1MHCRflZ
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 2420 regsvr32mgr.exe 1712 WaterMark.exe -
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exeregsvr32mgr.exepid process 1740 regsvr32.exe 1740 regsvr32.exe 2420 regsvr32mgr.exe 2420 regsvr32mgr.exe -
Processes:
resource yara_rule behavioral1/memory/2420-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2420-23-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2420-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2420-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2420-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2420-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2420-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1712-40-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1712-39-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1712-566-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
regsvr32.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\zip.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Defender\MpCommu.dll svchost.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Printing.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblend_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libclone_plugin.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\ieproxy.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libaudioscrobbler_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Journal\NBDoc.DLL svchost.exe File opened for modification C:\Program Files\DVD Maker\PipeTran.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationCore.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGM.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\hxdsui.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Client.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libgl_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\authplay.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_h264_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscene_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Mail\oeimport.dll svchost.exe File opened for modification C:\Program Files\Windows Mail\wabimp.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\settings.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EURO\MSOEURO.DLL svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\net.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\WMPNSSUI.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_sse2_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\clock.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSPTLS.DLL svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\softokn3.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\WMPDMCCore.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\hxdsui.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXP_XPS.DLL svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcor.dll svchost.exe -
Modifies registry class 4 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58F1580-0DF3-401C-93B1-2D9DDA61CF04}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58F1580-0DF3-401C-93B1-2D9DDA61CF04} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58F1580-0DF3-401C-93B1-2D9DDA61CF04}\1.0 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
WaterMark.exesvchost.exepid process 1712 WaterMark.exe 1712 WaterMark.exe 1712 WaterMark.exe 1712 WaterMark.exe 1712 WaterMark.exe 1712 WaterMark.exe 1712 WaterMark.exe 1712 WaterMark.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 1712 WaterMark.exe Token: SeDebugPrivilege 2528 svchost.exe Token: SeDebugPrivilege 1712 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 2420 regsvr32mgr.exe 1712 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32mgr.exeWaterMark.exesvchost.exedescription pid process target process PID 1976 wrote to memory of 1740 1976 regsvr32.exe regsvr32.exe PID 1976 wrote to memory of 1740 1976 regsvr32.exe regsvr32.exe PID 1976 wrote to memory of 1740 1976 regsvr32.exe regsvr32.exe PID 1976 wrote to memory of 1740 1976 regsvr32.exe regsvr32.exe PID 1976 wrote to memory of 1740 1976 regsvr32.exe regsvr32.exe PID 1976 wrote to memory of 1740 1976 regsvr32.exe regsvr32.exe PID 1976 wrote to memory of 1740 1976 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 2420 1740 regsvr32.exe regsvr32mgr.exe PID 1740 wrote to memory of 2420 1740 regsvr32.exe regsvr32mgr.exe PID 1740 wrote to memory of 2420 1740 regsvr32.exe regsvr32mgr.exe PID 1740 wrote to memory of 2420 1740 regsvr32.exe regsvr32mgr.exe PID 2420 wrote to memory of 1712 2420 regsvr32mgr.exe WaterMark.exe PID 2420 wrote to memory of 1712 2420 regsvr32mgr.exe WaterMark.exe PID 2420 wrote to memory of 1712 2420 regsvr32mgr.exe WaterMark.exe PID 2420 wrote to memory of 1712 2420 regsvr32mgr.exe WaterMark.exe PID 1712 wrote to memory of 2724 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2724 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2724 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2724 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2724 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2724 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2724 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2724 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2724 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2724 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2528 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2528 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2528 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2528 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2528 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2528 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2528 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2528 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2528 1712 WaterMark.exe svchost.exe PID 1712 wrote to memory of 2528 1712 WaterMark.exe svchost.exe PID 2528 wrote to memory of 256 2528 svchost.exe smss.exe PID 2528 wrote to memory of 256 2528 svchost.exe smss.exe PID 2528 wrote to memory of 256 2528 svchost.exe smss.exe PID 2528 wrote to memory of 256 2528 svchost.exe smss.exe PID 2528 wrote to memory of 256 2528 svchost.exe smss.exe PID 2528 wrote to memory of 332 2528 svchost.exe csrss.exe PID 2528 wrote to memory of 332 2528 svchost.exe csrss.exe PID 2528 wrote to memory of 332 2528 svchost.exe csrss.exe PID 2528 wrote to memory of 332 2528 svchost.exe csrss.exe PID 2528 wrote to memory of 332 2528 svchost.exe csrss.exe PID 2528 wrote to memory of 384 2528 svchost.exe wininit.exe PID 2528 wrote to memory of 384 2528 svchost.exe wininit.exe PID 2528 wrote to memory of 384 2528 svchost.exe wininit.exe PID 2528 wrote to memory of 384 2528 svchost.exe wininit.exe PID 2528 wrote to memory of 384 2528 svchost.exe wininit.exe PID 2528 wrote to memory of 392 2528 svchost.exe csrss.exe PID 2528 wrote to memory of 392 2528 svchost.exe csrss.exe PID 2528 wrote to memory of 392 2528 svchost.exe csrss.exe PID 2528 wrote to memory of 392 2528 svchost.exe csrss.exe PID 2528 wrote to memory of 392 2528 svchost.exe csrss.exe PID 2528 wrote to memory of 432 2528 svchost.exe winlogon.exe PID 2528 wrote to memory of 432 2528 svchost.exe winlogon.exe PID 2528 wrote to memory of 432 2528 svchost.exe winlogon.exe PID 2528 wrote to memory of 432 2528 svchost.exe winlogon.exe PID 2528 wrote to memory of 432 2528 svchost.exe winlogon.exe PID 2528 wrote to memory of 476 2528 svchost.exe services.exe PID 2528 wrote to memory of 476 2528 svchost.exe services.exe PID 2528 wrote to memory of 476 2528 svchost.exe services.exe PID 2528 wrote to memory of 476 2528 svchost.exe services.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\15d00fc2efbd85c50422b973081840bc_JaffaCakes118.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\15d00fc2efbd85c50422b973081840bc_JaffaCakes118.dll3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.htmlFilesize
206KB
MD5f705cf5f5d402776a3f883538d4f75e0
SHA1db8064bd28595f56e57426aacfd7875b18c1ecac
SHA256e2481e772bda0b1faba2fcf4b8c6aa5a22a126d3d4ef44f25de9406ef82936ed
SHA5126bf037f84af1df01daab74b01a7e8d034a671c5af7473dd60a92ad9758b821b2ff9fdfb7a36c9aa7107da23097507b0fbc7917733c4576c1b67228e3bef25a50
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.htmlFilesize
202KB
MD5f3e3cb4ebbf134b9c24d08b1ecf79bb3
SHA1fa422fc2a7026261059d9f220dd471b829871897
SHA256373c5e99a90a446e10c7c06102cd6855347eccab7691db5f38cdf7da8644d3fe
SHA5120aef0149fb74d03ee223f476afc349dfdecd8dedac01896f4ae6d8f6bd70bf3d59e9a3841dd10a1a696956716df4494d94458299e4aac759e764d360af3b9702
-
\Windows\SysWOW64\regsvr32mgr.exeFilesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
memory/1712-566-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1712-71-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/1712-41-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/1712-42-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/1712-43-0x00000000771FF000-0x0000000077200000-memory.dmpFilesize
4KB
-
memory/1712-39-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1712-40-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1740-1-0x0000000074400000-0x0000000074457000-memory.dmpFilesize
348KB
-
memory/1740-10-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1740-3-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2420-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2420-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2420-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2420-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2420-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2420-17-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2420-22-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2420-23-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2420-11-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2528-73-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2528-91-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2528-89-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2528-90-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2528-88-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2528-87-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2528-86-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2528-83-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2724-61-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/2724-60-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/2724-59-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/2724-67-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2724-62-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2724-54-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2724-44-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2724-46-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB