Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 12:35
Static task
static1
Behavioral task
behavioral1
Sample
1a221a46e51a4f64a9f2960d8db944a0_JaffaCakes118.dll
Resource
win7-20240611-en
General
-
Target
1a221a46e51a4f64a9f2960d8db944a0_JaffaCakes118.dll
-
Size
996KB
-
MD5
1a221a46e51a4f64a9f2960d8db944a0
-
SHA1
90226d2e7392017afbb2bf4968cc597f15782277
-
SHA256
e7ed4cedf8c089393e5599f43c39b66b2227afa941ff4d8a445c8df34f0d1e43
-
SHA512
a48cc8d3082f73ae1c7bad8cc2d0b9a52103a8ab5b8b45402256a2742d1beb9dbdb005876cf52d44b36ff27a4a0005265375676fbfaa41700861b8ec90795eba
-
SSDEEP
24576:hf2VfWlcKu6Gavkg3NydIbbbI4IBAUZLYdk8wBEY7:VuscKu6GaXUT4IBAUZLYdkN/
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
rundll32mgr.exeWaterMark.exepid process 2812 rundll32mgr.exe 2752 WaterMark.exe -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exerundll32mgr.exepid process 3052 rundll32.exe 3052 rundll32.exe 2812 rundll32mgr.exe 2812 rundll32mgr.exe -
Processes:
resource yara_rule behavioral1/memory/2812-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2812-21-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2812-18-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2812-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2812-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2812-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2812-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2752-41-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2752-39-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2752-618-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
rundll32.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcanvas_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcer.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.RunTime.Serialization.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsusf_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libps_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\penkor.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Xml.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsfsstorage_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libinteger_mixer_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEREP.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe svchost.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libqsv_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\hxds.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Client.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libskiptags_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_nv12_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsBase.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libadaptive_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libprefetch_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Mail\MSOERES.dll svchost.exe File opened for modification C:\Program Files\Windows Photo Viewer\PhotoAcq.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\RSSFeeds.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\hxdsui.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\ipcclientcerts.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\librss_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libadf_plugin.dll svchost.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2144 3052 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
WaterMark.exesvchost.exepid process 2752 WaterMark.exe 2752 WaterMark.exe 2752 WaterMark.exe 2752 WaterMark.exe 2752 WaterMark.exe 2752 WaterMark.exe 2752 WaterMark.exe 2752 WaterMark.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
WaterMark.exesvchost.exerundll32.exeWerFault.exedescription pid process Token: SeDebugPrivilege 2752 WaterMark.exe Token: SeDebugPrivilege 2828 svchost.exe Token: SeDebugPrivilege 3052 rundll32.exe Token: SeDebugPrivilege 2144 WerFault.exe Token: SeDebugPrivilege 2752 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
rundll32mgr.exeWaterMark.exepid process 2812 rundll32mgr.exe 2752 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exerundll32mgr.exeWaterMark.exesvchost.exedescription pid process target process PID 1180 wrote to memory of 3052 1180 rundll32.exe rundll32.exe PID 1180 wrote to memory of 3052 1180 rundll32.exe rundll32.exe PID 1180 wrote to memory of 3052 1180 rundll32.exe rundll32.exe PID 1180 wrote to memory of 3052 1180 rundll32.exe rundll32.exe PID 1180 wrote to memory of 3052 1180 rundll32.exe rundll32.exe PID 1180 wrote to memory of 3052 1180 rundll32.exe rundll32.exe PID 1180 wrote to memory of 3052 1180 rundll32.exe rundll32.exe PID 3052 wrote to memory of 2812 3052 rundll32.exe rundll32mgr.exe PID 3052 wrote to memory of 2812 3052 rundll32.exe rundll32mgr.exe PID 3052 wrote to memory of 2812 3052 rundll32.exe rundll32mgr.exe PID 3052 wrote to memory of 2812 3052 rundll32.exe rundll32mgr.exe PID 3052 wrote to memory of 2144 3052 rundll32.exe WerFault.exe PID 3052 wrote to memory of 2144 3052 rundll32.exe WerFault.exe PID 3052 wrote to memory of 2144 3052 rundll32.exe WerFault.exe PID 3052 wrote to memory of 2144 3052 rundll32.exe WerFault.exe PID 2812 wrote to memory of 2752 2812 rundll32mgr.exe WaterMark.exe PID 2812 wrote to memory of 2752 2812 rundll32mgr.exe WaterMark.exe PID 2812 wrote to memory of 2752 2812 rundll32mgr.exe WaterMark.exe PID 2812 wrote to memory of 2752 2812 rundll32mgr.exe WaterMark.exe PID 2752 wrote to memory of 2572 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2572 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2572 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2572 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2572 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2572 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2572 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2572 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2572 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2572 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2828 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2828 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2828 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2828 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2828 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2828 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2828 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2828 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2828 2752 WaterMark.exe svchost.exe PID 2752 wrote to memory of 2828 2752 WaterMark.exe svchost.exe PID 2828 wrote to memory of 256 2828 svchost.exe smss.exe PID 2828 wrote to memory of 256 2828 svchost.exe smss.exe PID 2828 wrote to memory of 256 2828 svchost.exe smss.exe PID 2828 wrote to memory of 256 2828 svchost.exe smss.exe PID 2828 wrote to memory of 256 2828 svchost.exe smss.exe PID 2828 wrote to memory of 336 2828 svchost.exe csrss.exe PID 2828 wrote to memory of 336 2828 svchost.exe csrss.exe PID 2828 wrote to memory of 336 2828 svchost.exe csrss.exe PID 2828 wrote to memory of 336 2828 svchost.exe csrss.exe PID 2828 wrote to memory of 336 2828 svchost.exe csrss.exe PID 2828 wrote to memory of 384 2828 svchost.exe wininit.exe PID 2828 wrote to memory of 384 2828 svchost.exe wininit.exe PID 2828 wrote to memory of 384 2828 svchost.exe wininit.exe PID 2828 wrote to memory of 384 2828 svchost.exe wininit.exe PID 2828 wrote to memory of 384 2828 svchost.exe wininit.exe PID 2828 wrote to memory of 392 2828 svchost.exe csrss.exe PID 2828 wrote to memory of 392 2828 svchost.exe csrss.exe PID 2828 wrote to memory of 392 2828 svchost.exe csrss.exe PID 2828 wrote to memory of 392 2828 svchost.exe csrss.exe PID 2828 wrote to memory of 392 2828 svchost.exe csrss.exe PID 2828 wrote to memory of 432 2828 svchost.exe winlogon.exe PID 2828 wrote to memory of 432 2828 svchost.exe winlogon.exe PID 2828 wrote to memory of 432 2828 svchost.exe winlogon.exe PID 2828 wrote to memory of 432 2828 svchost.exe winlogon.exe PID 2828 wrote to memory of 432 2828 svchost.exe winlogon.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1a221a46e51a4f64a9f2960d8db944a0_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1a221a46e51a4f64a9f2960d8db944a0_JaffaCakes118.dll,#13⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 2244⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.htmlFilesize
259KB
MD572c4e040515f858e00a5aacaac47cc22
SHA1dd0baa73da763cb967865c19d2bb84421b6f2d68
SHA25634fdfee597218018c44dc1b38f4a5dbc4d93e0e6d4d28ee2f5402c82fb7c46e5
SHA51202a7907993ecd8d2fc0b6f275a4e47155e4ebd93649100394a0f99e9bde2e005fe661547968d003604a3ee517fac941201c58d1380494e5e5939298a93585f99
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.htmlFilesize
255KB
MD5fbdc8caebc73f22200f8123101fdb222
SHA128e6bbce59652ff6ec237c70671ea31935118f8e
SHA256766177543ea3db7ab3c67f11225be7ace83a162bb134bd273558887d8c3c247a
SHA512f23d4fa58852a11a1b32521a9c7de504f430cd57939a56b67803523dd7d7d293dff2fcb3631ede76038d8d661ab07e8c0c9e18e6a7fc266fd01c421b9fef7a16
-
\Windows\SysWOW64\rundll32mgr.exeFilesize
123KB
MD558ae04d47a7587cba542671907b6a9af
SHA11f1e13105f87605281aac5666e8e448ab388b113
SHA256aaaccf3120e3a27abb632e12c69b5e21056ec88780f001605d763eed9a2d1709
SHA51278e2ecd54578cf8413f025f060412df7855ba661c07fafe0891a6827295a80caa8c3eae2be771786bc49ef5492163530319b86eba10cc6627d40b1677a496401
-
memory/2572-53-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2572-58-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2572-46-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2572-849-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2572-68-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2572-44-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2572-64-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/2572-65-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2572-66-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/2752-71-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2752-82-0x000000007782F000-0x0000000077830000-memory.dmpFilesize
4KB
-
memory/2752-42-0x000000007782F000-0x0000000077830000-memory.dmpFilesize
4KB
-
memory/2752-41-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2752-40-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2752-39-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2752-618-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2812-25-0x0000000000050000-0x000000000007B000-memory.dmpFilesize
172KB
-
memory/2812-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2812-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2812-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2812-11-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2812-17-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2812-18-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2812-20-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/2812-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2812-21-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2828-83-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2828-87-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2828-90-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2828-93-0x0000000077830000-0x0000000077831000-memory.dmpFilesize
4KB
-
memory/2828-92-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2828-91-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2828-89-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2828-88-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2828-73-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/3052-2-0x0000000010000000-0x00000000100F9000-memory.dmpFilesize
996KB
-
memory/3052-8-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/3052-9-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB