Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 09:18
Static task
static1
Behavioral task
behavioral1
Sample
199868098271f062541d8ad7347e09da_JaffaCakes118.dll
Resource
win7-20240419-en
General
-
Target
199868098271f062541d8ad7347e09da_JaffaCakes118.dll
-
Size
166KB
-
MD5
199868098271f062541d8ad7347e09da
-
SHA1
f88943a4b93f5df1b395df7d9f7486e523b0d3a1
-
SHA256
cedb22326170c6fba4720a9f26ffdac33ff3eb3dac7533551c67238db61a415d
-
SHA512
57bcc2b2333bf0341040d85ebd71466bbd072e8bb1fe5a5a714207382b82f6ce745b7e6eb3bc850fc0495238549e634333d3754b5b568c04f5966e96898f0629
-
SSDEEP
1536:95lTUKCYmCgV5bT/2d1QYeoJrc5p5yEmZtmnkUXB5Q+Vxzp0CY0voMS4yh:NTU56gVxj27NeGrejj0tmnJXBvzKcs
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 2840 regsvr32mgr.exe 2708 WaterMark.exe -
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exeregsvr32mgr.exepid process 1632 regsvr32.exe 1632 regsvr32.exe 2840 regsvr32mgr.exe 2840 regsvr32mgr.exe -
Processes:
resource yara_rule behavioral1/memory/2840-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2840-20-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2840-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2840-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2840-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2840-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2840-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2708-39-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2708-34-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2708-564-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
regsvr32.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jaas_nt.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\sqlite.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ps_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\settings.html svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\msdatl3.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jfxwebkit.dll svchost.exe File opened for modification C:\Program Files\Windows Mail\wabfind.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\msitss55.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdirectory_demux_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libgnutls_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe svchost.exe File opened for modification C:\Program Files\Internet Explorer\DiagnosticsTap.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libwgl_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\ReachFramework.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\keystore\libmemory_keystore_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\flyout.html svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\currency.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Xml.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatialaudio_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_asf_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libball_plugin.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\ipcclientcerts.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationProvider.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libglspectrum_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libcrystalhd_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqloledb.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libd3d11va_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
WaterMark.exesvchost.exepid process 2708 WaterMark.exe 2708 WaterMark.exe 2708 WaterMark.exe 2708 WaterMark.exe 2708 WaterMark.exe 2708 WaterMark.exe 2708 WaterMark.exe 2708 WaterMark.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe 1780 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 2708 WaterMark.exe Token: SeDebugPrivilege 1780 svchost.exe Token: SeDebugPrivilege 2708 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 2840 regsvr32mgr.exe 2708 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32mgr.exeWaterMark.exesvchost.exedescription pid process target process PID 2084 wrote to memory of 1632 2084 regsvr32.exe regsvr32.exe PID 2084 wrote to memory of 1632 2084 regsvr32.exe regsvr32.exe PID 2084 wrote to memory of 1632 2084 regsvr32.exe regsvr32.exe PID 2084 wrote to memory of 1632 2084 regsvr32.exe regsvr32.exe PID 2084 wrote to memory of 1632 2084 regsvr32.exe regsvr32.exe PID 2084 wrote to memory of 1632 2084 regsvr32.exe regsvr32.exe PID 2084 wrote to memory of 1632 2084 regsvr32.exe regsvr32.exe PID 1632 wrote to memory of 2840 1632 regsvr32.exe regsvr32mgr.exe PID 1632 wrote to memory of 2840 1632 regsvr32.exe regsvr32mgr.exe PID 1632 wrote to memory of 2840 1632 regsvr32.exe regsvr32mgr.exe PID 1632 wrote to memory of 2840 1632 regsvr32.exe regsvr32mgr.exe PID 2840 wrote to memory of 2708 2840 regsvr32mgr.exe WaterMark.exe PID 2840 wrote to memory of 2708 2840 regsvr32mgr.exe WaterMark.exe PID 2840 wrote to memory of 2708 2840 regsvr32mgr.exe WaterMark.exe PID 2840 wrote to memory of 2708 2840 regsvr32mgr.exe WaterMark.exe PID 2708 wrote to memory of 2748 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 2748 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 2748 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 2748 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 2748 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 2748 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 2748 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 2748 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 2748 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 2748 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 1780 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 1780 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 1780 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 1780 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 1780 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 1780 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 1780 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 1780 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 1780 2708 WaterMark.exe svchost.exe PID 2708 wrote to memory of 1780 2708 WaterMark.exe svchost.exe PID 1780 wrote to memory of 256 1780 svchost.exe smss.exe PID 1780 wrote to memory of 256 1780 svchost.exe smss.exe PID 1780 wrote to memory of 256 1780 svchost.exe smss.exe PID 1780 wrote to memory of 256 1780 svchost.exe smss.exe PID 1780 wrote to memory of 256 1780 svchost.exe smss.exe PID 1780 wrote to memory of 332 1780 svchost.exe csrss.exe PID 1780 wrote to memory of 332 1780 svchost.exe csrss.exe PID 1780 wrote to memory of 332 1780 svchost.exe csrss.exe PID 1780 wrote to memory of 332 1780 svchost.exe csrss.exe PID 1780 wrote to memory of 332 1780 svchost.exe csrss.exe PID 1780 wrote to memory of 384 1780 svchost.exe wininit.exe PID 1780 wrote to memory of 384 1780 svchost.exe wininit.exe PID 1780 wrote to memory of 384 1780 svchost.exe wininit.exe PID 1780 wrote to memory of 384 1780 svchost.exe wininit.exe PID 1780 wrote to memory of 384 1780 svchost.exe wininit.exe PID 1780 wrote to memory of 392 1780 svchost.exe csrss.exe PID 1780 wrote to memory of 392 1780 svchost.exe csrss.exe PID 1780 wrote to memory of 392 1780 svchost.exe csrss.exe PID 1780 wrote to memory of 392 1780 svchost.exe csrss.exe PID 1780 wrote to memory of 392 1780 svchost.exe csrss.exe PID 1780 wrote to memory of 432 1780 svchost.exe winlogon.exe PID 1780 wrote to memory of 432 1780 svchost.exe winlogon.exe PID 1780 wrote to memory of 432 1780 svchost.exe winlogon.exe PID 1780 wrote to memory of 432 1780 svchost.exe winlogon.exe PID 1780 wrote to memory of 432 1780 svchost.exe winlogon.exe PID 1780 wrote to memory of 476 1780 svchost.exe services.exe PID 1780 wrote to memory of 476 1780 svchost.exe services.exe PID 1780 wrote to memory of 476 1780 svchost.exe services.exe PID 1780 wrote to memory of 476 1780 svchost.exe services.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\199868098271f062541d8ad7347e09da_JaffaCakes118.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\199868098271f062541d8ad7347e09da_JaffaCakes118.dll3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.htmlFilesize
206KB
MD5a771c89ab82dc9520fcce0b64466c9b3
SHA137f7b1ecc75d78653f1da77e7911d282a279c33f
SHA256603d859110c07dae8336e8b154da382bedd23a0c3277024fa003df86376169b7
SHA512937599aa6134928ef4340697240ffdeec0dc02890c5a652b609a83d132a6b61a9bd28f57d2875d7c29806449d3c612615a388e0a76ceeb71dde5e7b2a8782bda
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.htmlFilesize
202KB
MD54837babb0e86462d474b5ffbb937bbf0
SHA107222dd132c0bc15079b9e448bd6f055abde9785
SHA2563b04736d7978471b7e87b587e12b09ed3cc78d00dea955883ae801825fe962b8
SHA512cbc67584f1a6a37f63babe77d834c2d12405f5f0a05674e3646563f327d3efa9c7f0bce77584662791f200302a6114ea2f76da94bb42a0d29b39384e5c6e7c07
-
\Windows\SysWOW64\regsvr32mgr.exeFilesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
memory/1632-1-0x0000000074B50000-0x0000000074B7C000-memory.dmpFilesize
176KB
-
memory/1632-3-0x0000000000350000-0x0000000000385000-memory.dmpFilesize
212KB
-
memory/1780-88-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1780-84-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1780-89-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1780-71-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1780-86-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1780-85-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/1780-81-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1780-87-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2708-39-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2708-40-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/2708-41-0x000000007792F000-0x0000000077930000-memory.dmpFilesize
4KB
-
memory/2708-34-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2708-69-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2708-564-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2748-53-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2748-54-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2748-59-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2748-64-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/2748-65-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2748-52-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/2748-45-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2748-43-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2840-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2840-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2840-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2840-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2840-17-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2840-19-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/2840-20-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2840-11-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2840-10-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB