Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 06:50
Static task
static1
Behavioral task
behavioral1
Sample
192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe
-
Size
166KB
-
MD5
192e139015c44fbc67b75a89abe99a86
-
SHA1
15599b909247601fbb064a7c27c8151aae1d6a6c
-
SHA256
7c547ff815f4f818f2f52ce61ecbfc00131167990209ff21c4a224888455fea6
-
SHA512
879e617162390934c36d513936615171a8f99f9ca4ea922420779e33a4f8fe22f6f4da5eb2f2410940fa16fbadcec4ddef8f3549bcb5b1b06fef0994fa833f50
-
SSDEEP
1536:5NpbWTono2PF9yJH9KBjH7ZoSQoL+Qz6AdvaLj30b9KVv6q7pbhD3fdaAsU3wNBz:wdKFOoL16Ady330wN6qb3MAxwgKaM
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exeWaterMark.exepid process 2860 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe 2664 WaterMark.exe -
Loads dropped DLL 4 IoCs
Processes:
192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exepid process 2204 192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe 2204 192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe 2860 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe 2860 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe -
Processes:
resource yara_rule behavioral1/memory/2860-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2860-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2860-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2860-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2860-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2860-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2860-20-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2664-39-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2664-549-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Speech.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Net.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Engine.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dirac_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe svchost.exe File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\MSADDNDR.DLL svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\OARPMANR.DLL svchost.exe File opened for modification C:\Program Files\Common Files\System\ado\msader15.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Selectors.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\micaut.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IO.Log.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromecast_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_delay_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libvisual_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jsdt.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\dt_socket.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\keystore\libmemory_keystore_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\ITIRCL55.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\hxdsui.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Windows.Presentation.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_pitch_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libwinhibit_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\xlsrvintl.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationProvider.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
WaterMark.exesvchost.exepid process 2664 WaterMark.exe 2664 WaterMark.exe 2664 WaterMark.exe 2664 WaterMark.exe 2664 WaterMark.exe 2664 WaterMark.exe 2664 WaterMark.exe 2664 WaterMark.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 2664 WaterMark.exe Token: SeDebugPrivilege 2584 svchost.exe Token: SeDebugPrivilege 2664 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exeWaterMark.exepid process 2860 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe 2664 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exeWaterMark.exesvchost.exedescription pid process target process PID 2204 wrote to memory of 2860 2204 192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe PID 2204 wrote to memory of 2860 2204 192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe PID 2204 wrote to memory of 2860 2204 192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe PID 2204 wrote to memory of 2860 2204 192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe PID 2860 wrote to memory of 2664 2860 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe WaterMark.exe PID 2860 wrote to memory of 2664 2860 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe WaterMark.exe PID 2860 wrote to memory of 2664 2860 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe WaterMark.exe PID 2860 wrote to memory of 2664 2860 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe WaterMark.exe PID 2664 wrote to memory of 2836 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2836 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2836 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2836 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2836 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2836 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2836 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2836 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2836 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2836 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2584 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2584 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2584 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2584 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2584 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2584 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2584 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2584 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2584 2664 WaterMark.exe svchost.exe PID 2664 wrote to memory of 2584 2664 WaterMark.exe svchost.exe PID 2584 wrote to memory of 256 2584 svchost.exe smss.exe PID 2584 wrote to memory of 256 2584 svchost.exe smss.exe PID 2584 wrote to memory of 256 2584 svchost.exe smss.exe PID 2584 wrote to memory of 256 2584 svchost.exe smss.exe PID 2584 wrote to memory of 256 2584 svchost.exe smss.exe PID 2584 wrote to memory of 336 2584 svchost.exe csrss.exe PID 2584 wrote to memory of 336 2584 svchost.exe csrss.exe PID 2584 wrote to memory of 336 2584 svchost.exe csrss.exe PID 2584 wrote to memory of 336 2584 svchost.exe csrss.exe PID 2584 wrote to memory of 336 2584 svchost.exe csrss.exe PID 2584 wrote to memory of 384 2584 svchost.exe wininit.exe PID 2584 wrote to memory of 384 2584 svchost.exe wininit.exe PID 2584 wrote to memory of 384 2584 svchost.exe wininit.exe PID 2584 wrote to memory of 384 2584 svchost.exe wininit.exe PID 2584 wrote to memory of 384 2584 svchost.exe wininit.exe PID 2584 wrote to memory of 392 2584 svchost.exe csrss.exe PID 2584 wrote to memory of 392 2584 svchost.exe csrss.exe PID 2584 wrote to memory of 392 2584 svchost.exe csrss.exe PID 2584 wrote to memory of 392 2584 svchost.exe csrss.exe PID 2584 wrote to memory of 392 2584 svchost.exe csrss.exe PID 2584 wrote to memory of 432 2584 svchost.exe winlogon.exe PID 2584 wrote to memory of 432 2584 svchost.exe winlogon.exe PID 2584 wrote to memory of 432 2584 svchost.exe winlogon.exe PID 2584 wrote to memory of 432 2584 svchost.exe winlogon.exe PID 2584 wrote to memory of 432 2584 svchost.exe winlogon.exe PID 2584 wrote to memory of 480 2584 svchost.exe services.exe PID 2584 wrote to memory of 480 2584 svchost.exe services.exe PID 2584 wrote to memory of 480 2584 svchost.exe services.exe PID 2584 wrote to memory of 480 2584 svchost.exe services.exe PID 2584 wrote to memory of 480 2584 svchost.exe services.exe PID 2584 wrote to memory of 488 2584 svchost.exe lsass.exe PID 2584 wrote to memory of 488 2584 svchost.exe lsass.exe PID 2584 wrote to memory of 488 2584 svchost.exe lsass.exe PID 2584 wrote to memory of 488 2584 svchost.exe lsass.exe PID 2584 wrote to memory of 488 2584 svchost.exe lsass.exe PID 2584 wrote to memory of 496 2584 svchost.exe lsm.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exeC:\Users\Admin\AppData\Local\Temp\192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.htmlFilesize
206KB
MD54664877800a1c390451073a6a7c8c052
SHA14482b3a54c258f726d2a558322cf46f018214f62
SHA256ed354b3dfed2618fdec8e1e6ebe2dfe13dc96273b00bf62c50665d5700e51357
SHA5121745fd67fd1a557a8fa89335063207f527c1f629eb22fc72b0f9383a1eecdc152329710e20656be93da669bc0ab1861f43caa26e7779c25087c24e41fa12de8b
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.htmlFilesize
202KB
MD54292576cc9025cd0318e231e0e0d42cd
SHA1cc3c248ae183ccd682f2f8094032e6aaa3d417f4
SHA25664663d4f27860f91b78526d90768a43762a9a42043d8e0a4dfbde0f6ef4e041d
SHA512e0778b5156440e3a35d111dbe36e66752cbf26e6e4b63df6524e4edb1a12e1eb7f73cf245f3004301aa814aec82065b985c99062f5a09860e5a0c27a3376fdda
-
C:\Users\Admin\AppData\Local\Temp\192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exeFilesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
memory/2204-0-0x0000000000DF0000-0x0000000000E1C000-memory.dmpFilesize
176KB
-
memory/2204-8-0x0000000000DF0000-0x0000000000E1C000-memory.dmpFilesize
176KB
-
memory/2584-87-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2584-81-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2584-91-0x00000000775F0000-0x00000000775F1000-memory.dmpFilesize
4KB
-
memory/2584-89-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/2584-90-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2584-88-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2584-86-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/2584-85-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2584-71-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2664-549-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2664-38-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/2664-42-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2664-39-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2664-80-0x00000000775EF000-0x00000000775F0000-memory.dmpFilesize
4KB
-
memory/2664-40-0x00000000775EF000-0x00000000775F0000-memory.dmpFilesize
4KB
-
memory/2664-69-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2836-65-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/2836-63-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/2836-61-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2836-52-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2836-64-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2836-57-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2836-45-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2836-43-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2836-770-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2860-20-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2860-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2860-17-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2860-15-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/2860-11-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2860-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2860-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2860-24-0x0000000000050000-0x0000000000085000-memory.dmpFilesize
212KB
-
memory/2860-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2860-10-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB