Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 13:07
Static task
static1
Behavioral task
behavioral1
Sample
1a3c1d02d0e6e30be07bead6ac817401_JaffaCakes118.dll
Resource
win7-20240419-en
General
-
Target
1a3c1d02d0e6e30be07bead6ac817401_JaffaCakes118.dll
-
Size
337KB
-
MD5
1a3c1d02d0e6e30be07bead6ac817401
-
SHA1
ce09a71cc8551e3b93553afbd03c5efa078ecc2a
-
SHA256
2d8d24f9d8137dd1518b80e11bcaac699dfa7116bed817cbca4eefe6601d7b37
-
SHA512
9fc3aaf378bad9174348bce40d3ecdddb641e5321052b38be5708916304bdd993217c160803633bc14e7906d9e1e73840aada88e27fba2fb9e8841ca74372f88
-
SSDEEP
6144:cN0yr1sO/wIKS0FKtOT/OrDtgUi0uvQee7Qee/0QeesQeeglQeekQeeDC7M3HCR7:sG6wndYtamDSU1MHCRflZ
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 2004 regsvr32mgr.exe 2960 WaterMark.exe -
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exeregsvr32mgr.exepid process 3004 regsvr32.exe 3004 regsvr32.exe 2004 regsvr32mgr.exe 2004 regsvr32mgr.exe -
Processes:
resource yara_rule behavioral1/memory/2004-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2004-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2004-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2004-21-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2004-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2004-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2004-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2960-39-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2960-41-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2960-565-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
regsvr32.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\WMPNSSUI.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\gui\libskins2_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll svchost.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll svchost.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfreeze_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\settings.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\lgpllibs.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libvmem_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\JdbcOdbc.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\AccessibleHandler.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\wlsrvc.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\pdfshell.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2ssv.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Utilities.v3.5.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_description_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\flyout.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\qipcap64.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libhttps_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_shmem.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\README.HTM svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\VISSHE.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatialaudio_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.exe svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\CsiSoap.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\libxslt.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html svchost.exe File opened for modification C:\Program Files\DVD Maker\Pipeline.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationProvider.resources.dll svchost.exe -
Modifies registry class 4 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58F1580-0DF3-401C-93B1-2D9DDA61CF04}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58F1580-0DF3-401C-93B1-2D9DDA61CF04} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58F1580-0DF3-401C-93B1-2D9DDA61CF04}\1.0 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
WaterMark.exesvchost.exepid process 2960 WaterMark.exe 2960 WaterMark.exe 2960 WaterMark.exe 2960 WaterMark.exe 2960 WaterMark.exe 2960 WaterMark.exe 2960 WaterMark.exe 2960 WaterMark.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 2960 WaterMark.exe Token: SeDebugPrivilege 2248 svchost.exe Token: SeDebugPrivilege 2960 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 2004 regsvr32mgr.exe 2960 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32mgr.exeWaterMark.exesvchost.exedescription pid process target process PID 3008 wrote to memory of 3004 3008 regsvr32.exe regsvr32.exe PID 3008 wrote to memory of 3004 3008 regsvr32.exe regsvr32.exe PID 3008 wrote to memory of 3004 3008 regsvr32.exe regsvr32.exe PID 3008 wrote to memory of 3004 3008 regsvr32.exe regsvr32.exe PID 3008 wrote to memory of 3004 3008 regsvr32.exe regsvr32.exe PID 3008 wrote to memory of 3004 3008 regsvr32.exe regsvr32.exe PID 3008 wrote to memory of 3004 3008 regsvr32.exe regsvr32.exe PID 3004 wrote to memory of 2004 3004 regsvr32.exe regsvr32mgr.exe PID 3004 wrote to memory of 2004 3004 regsvr32.exe regsvr32mgr.exe PID 3004 wrote to memory of 2004 3004 regsvr32.exe regsvr32mgr.exe PID 3004 wrote to memory of 2004 3004 regsvr32.exe regsvr32mgr.exe PID 2004 wrote to memory of 2960 2004 regsvr32mgr.exe WaterMark.exe PID 2004 wrote to memory of 2960 2004 regsvr32mgr.exe WaterMark.exe PID 2004 wrote to memory of 2960 2004 regsvr32mgr.exe WaterMark.exe PID 2004 wrote to memory of 2960 2004 regsvr32mgr.exe WaterMark.exe PID 2960 wrote to memory of 2688 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2688 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2688 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2688 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2688 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2688 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2688 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2688 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2688 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2688 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2248 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2248 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2248 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2248 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2248 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2248 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2248 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2248 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2248 2960 WaterMark.exe svchost.exe PID 2960 wrote to memory of 2248 2960 WaterMark.exe svchost.exe PID 2248 wrote to memory of 256 2248 svchost.exe smss.exe PID 2248 wrote to memory of 256 2248 svchost.exe smss.exe PID 2248 wrote to memory of 256 2248 svchost.exe smss.exe PID 2248 wrote to memory of 256 2248 svchost.exe smss.exe PID 2248 wrote to memory of 256 2248 svchost.exe smss.exe PID 2248 wrote to memory of 336 2248 svchost.exe csrss.exe PID 2248 wrote to memory of 336 2248 svchost.exe csrss.exe PID 2248 wrote to memory of 336 2248 svchost.exe csrss.exe PID 2248 wrote to memory of 336 2248 svchost.exe csrss.exe PID 2248 wrote to memory of 336 2248 svchost.exe csrss.exe PID 2248 wrote to memory of 384 2248 svchost.exe wininit.exe PID 2248 wrote to memory of 384 2248 svchost.exe wininit.exe PID 2248 wrote to memory of 384 2248 svchost.exe wininit.exe PID 2248 wrote to memory of 384 2248 svchost.exe wininit.exe PID 2248 wrote to memory of 384 2248 svchost.exe wininit.exe PID 2248 wrote to memory of 392 2248 svchost.exe csrss.exe PID 2248 wrote to memory of 392 2248 svchost.exe csrss.exe PID 2248 wrote to memory of 392 2248 svchost.exe csrss.exe PID 2248 wrote to memory of 392 2248 svchost.exe csrss.exe PID 2248 wrote to memory of 392 2248 svchost.exe csrss.exe PID 2248 wrote to memory of 432 2248 svchost.exe winlogon.exe PID 2248 wrote to memory of 432 2248 svchost.exe winlogon.exe PID 2248 wrote to memory of 432 2248 svchost.exe winlogon.exe PID 2248 wrote to memory of 432 2248 svchost.exe winlogon.exe PID 2248 wrote to memory of 432 2248 svchost.exe winlogon.exe PID 2248 wrote to memory of 476 2248 svchost.exe services.exe PID 2248 wrote to memory of 476 2248 svchost.exe services.exe PID 2248 wrote to memory of 476 2248 svchost.exe services.exe PID 2248 wrote to memory of 476 2248 svchost.exe services.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1a3c1d02d0e6e30be07bead6ac817401_JaffaCakes118.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1a3c1d02d0e6e30be07bead6ac817401_JaffaCakes118.dll3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.htmlFilesize
206KB
MD554407957f5d65508c09886eaae5f69d6
SHA14071f7e8dc3dc466b3d7a852777755c1fbdaef18
SHA25655fda98b4071b43a9815a03a3d1bf1ed4e3327dfff10fa42447a188addeb3642
SHA5128a87daf216a160d30b2886718208fcc8a76893c55902581448409c4565f9edd33fa237c367b958219f008c0030276695c294665c8f7feaa6c5d889f63d59c863
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.htmlFilesize
202KB
MD5307824720f3c14e909eef2df28460f4b
SHA17154d019e4198dcddb0ee51ffdcbe964cbdfdf3b
SHA2568b13acc303db24083fdb2409abaf3a6c87842039f741eb575b095e07ed0c758c
SHA512cba911e7cbf67fa984d62618efe85f7cd54c70a5e373c5f8e82a112afd12661275e23a0448fe5c4b5e58e88e96916d0735cecc0af3aeead3a8bca36323704f97
-
\Windows\SysWOW64\regsvr32mgr.exeFilesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
memory/2004-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2004-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2004-11-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2004-10-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2004-20-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/2004-21-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2004-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2004-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2004-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2004-24-0x0000000000050000-0x0000000000085000-memory.dmpFilesize
212KB
-
memory/2248-72-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2248-85-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2248-82-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2248-86-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2248-87-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2248-88-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2248-89-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2248-90-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2688-55-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2688-46-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2688-53-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/2688-64-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/2688-65-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2688-54-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2688-44-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2688-60-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2960-70-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2960-39-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2960-40-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2960-41-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2960-42-0x000000007704F000-0x0000000077050000-memory.dmpFilesize
4KB
-
memory/2960-565-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2960-31-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/3004-0-0x0000000074260000-0x00000000742B7000-memory.dmpFilesize
348KB
-
memory/3004-3-0x00000000001D0000-0x0000000000205000-memory.dmpFilesize
212KB