Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 07:42
Static task
static1
Behavioral task
behavioral1
Sample
1a79fcfbbdff1f6b860bf3e8849c969c_JaffaCakes118.dll
Resource
win7-20240611-en
General
-
Target
1a79fcfbbdff1f6b860bf3e8849c969c_JaffaCakes118.dll
-
Size
132KB
-
MD5
1a79fcfbbdff1f6b860bf3e8849c969c
-
SHA1
0ff7e1838e1a8d3bbcbd4adabf675de49c9c9962
-
SHA256
9db443cd3a2b65f9f6f425f6aa81ae96ac42bfb11833e8a41e761842178bac82
-
SHA512
a9df0cc6c086046c4ee91b87f51bd7341e25f504258d2c7134c2d9021eb3af6fd4f2570356bda0d5e7cc97cae752f7fa7c9c555959ed12aa8309a7bbfbc787a3
-
SSDEEP
3072:3o6nwLqrSa4I+VCvJzT5/2GqMITcEW1W5:46uo5OGUTpW1c
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 2568 regsvr32mgr.exe 2636 WaterMark.exe -
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exeregsvr32mgr.exepid process 2244 regsvr32.exe 2244 regsvr32.exe 2568 regsvr32mgr.exe 2568 regsvr32mgr.exe -
Processes:
resource yara_rule behavioral1/memory/2568-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2636-40-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2636-39-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2568-22-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2568-20-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2568-19-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2568-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2568-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2568-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2636-567-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
regsvr32.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Acrofx32.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcs.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunec.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_a52_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\calendar.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Selectors.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libx26410b_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ts_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libhds_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsharpen_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libtdummy_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libripple_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadds.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\java.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\softokn3.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.ServiceModel.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmjpeg_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dirac_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\libxslt.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\qipcap64.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libnsc_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libgoom_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Utilities.v3.5.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegaudio_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\libarchive_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libwave_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\vdk150.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libvod_rtsp_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Management.Instrumentation.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libgme_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libpodcast_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Defender\MsMpCom.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_wasapi_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_cycle_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
WaterMark.exesvchost.exepid process 2636 WaterMark.exe 2636 WaterMark.exe 2636 WaterMark.exe 2636 WaterMark.exe 2636 WaterMark.exe 2636 WaterMark.exe 2636 WaterMark.exe 2636 WaterMark.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 2636 WaterMark.exe Token: SeDebugPrivilege 1256 svchost.exe Token: SeDebugPrivilege 2636 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 2568 regsvr32mgr.exe 2636 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32mgr.exeWaterMark.exesvchost.exedescription pid process target process PID 2180 wrote to memory of 2244 2180 regsvr32.exe regsvr32.exe PID 2180 wrote to memory of 2244 2180 regsvr32.exe regsvr32.exe PID 2180 wrote to memory of 2244 2180 regsvr32.exe regsvr32.exe PID 2180 wrote to memory of 2244 2180 regsvr32.exe regsvr32.exe PID 2180 wrote to memory of 2244 2180 regsvr32.exe regsvr32.exe PID 2180 wrote to memory of 2244 2180 regsvr32.exe regsvr32.exe PID 2180 wrote to memory of 2244 2180 regsvr32.exe regsvr32.exe PID 2244 wrote to memory of 2568 2244 regsvr32.exe regsvr32mgr.exe PID 2244 wrote to memory of 2568 2244 regsvr32.exe regsvr32mgr.exe PID 2244 wrote to memory of 2568 2244 regsvr32.exe regsvr32mgr.exe PID 2244 wrote to memory of 2568 2244 regsvr32.exe regsvr32mgr.exe PID 2568 wrote to memory of 2636 2568 regsvr32mgr.exe WaterMark.exe PID 2568 wrote to memory of 2636 2568 regsvr32mgr.exe WaterMark.exe PID 2568 wrote to memory of 2636 2568 regsvr32mgr.exe WaterMark.exe PID 2568 wrote to memory of 2636 2568 regsvr32mgr.exe WaterMark.exe PID 2636 wrote to memory of 2648 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 2648 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 2648 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 2648 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 2648 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 2648 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 2648 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 2648 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 2648 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 2648 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 1256 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 1256 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 1256 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 1256 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 1256 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 1256 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 1256 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 1256 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 1256 2636 WaterMark.exe svchost.exe PID 2636 wrote to memory of 1256 2636 WaterMark.exe svchost.exe PID 1256 wrote to memory of 256 1256 svchost.exe smss.exe PID 1256 wrote to memory of 256 1256 svchost.exe smss.exe PID 1256 wrote to memory of 256 1256 svchost.exe smss.exe PID 1256 wrote to memory of 256 1256 svchost.exe smss.exe PID 1256 wrote to memory of 256 1256 svchost.exe smss.exe PID 1256 wrote to memory of 332 1256 svchost.exe csrss.exe PID 1256 wrote to memory of 332 1256 svchost.exe csrss.exe PID 1256 wrote to memory of 332 1256 svchost.exe csrss.exe PID 1256 wrote to memory of 332 1256 svchost.exe csrss.exe PID 1256 wrote to memory of 332 1256 svchost.exe csrss.exe PID 1256 wrote to memory of 368 1256 svchost.exe wininit.exe PID 1256 wrote to memory of 368 1256 svchost.exe wininit.exe PID 1256 wrote to memory of 368 1256 svchost.exe wininit.exe PID 1256 wrote to memory of 368 1256 svchost.exe wininit.exe PID 1256 wrote to memory of 368 1256 svchost.exe wininit.exe PID 1256 wrote to memory of 380 1256 svchost.exe csrss.exe PID 1256 wrote to memory of 380 1256 svchost.exe csrss.exe PID 1256 wrote to memory of 380 1256 svchost.exe csrss.exe PID 1256 wrote to memory of 380 1256 svchost.exe csrss.exe PID 1256 wrote to memory of 380 1256 svchost.exe csrss.exe PID 1256 wrote to memory of 416 1256 svchost.exe winlogon.exe PID 1256 wrote to memory of 416 1256 svchost.exe winlogon.exe PID 1256 wrote to memory of 416 1256 svchost.exe winlogon.exe PID 1256 wrote to memory of 416 1256 svchost.exe winlogon.exe PID 1256 wrote to memory of 416 1256 svchost.exe winlogon.exe PID 1256 wrote to memory of 460 1256 svchost.exe services.exe PID 1256 wrote to memory of 460 1256 svchost.exe services.exe PID 1256 wrote to memory of 460 1256 svchost.exe services.exe PID 1256 wrote to memory of 460 1256 svchost.exe services.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1a79fcfbbdff1f6b860bf3e8849c969c_JaffaCakes118.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1a79fcfbbdff1f6b860bf3e8849c969c_JaffaCakes118.dll3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.htmlFilesize
206KB
MD5a7ace30bee750db51be2880c910faf3d
SHA138ecd6a3e8b0d377e9d662001010c26beaa0240c
SHA256f642c133a7d61a330ad570f4e3ebac1a15f7d7f817c1ba013f325930250b3ff3
SHA5123b6696c312ce2081b643208481b7e361474126f844b7c0a73689a8a5d919c7adb641cd672bd183ac2335a149417b34cab8265d8a990b5f6e3710663a96c49612
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.htmlFilesize
202KB
MD533af59656f8561d4de3eedacb27022f1
SHA134a04fd174de5ee3bdda8f444eacbf8000409ba0
SHA2560052995ec9caefce3c463d20b387676e0b7672a7944f98999a076053b5359a70
SHA51201d98d97586a893198a9b9d860b99cea4e260511811ea3789da3098b9da6e99acbf1f0b30cc0737e2824684cf58ae1c8bf46c49888689cd76b06abd359717d61
-
\Windows\SysWOW64\regsvr32mgr.exeFilesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
memory/1256-91-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/1256-84-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1256-87-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1256-89-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1256-88-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/1256-74-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1256-92-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1256-90-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2244-11-0x0000000000240000-0x0000000000275000-memory.dmpFilesize
212KB
-
memory/2244-0-0x0000000000140000-0x0000000000164000-memory.dmpFilesize
144KB
-
memory/2244-4-0x0000000000240000-0x0000000000275000-memory.dmpFilesize
212KB
-
memory/2244-1-0x0000000000140000-0x0000000000164000-memory.dmpFilesize
144KB
-
memory/2568-20-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2568-19-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2568-18-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/2568-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2568-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2568-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2568-22-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2568-12-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2568-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2636-42-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2636-39-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2636-72-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2636-40-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2636-43-0x0000000077C0F000-0x0000000077C10000-memory.dmpFilesize
4KB
-
memory/2636-567-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2648-63-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2648-56-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/2648-45-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2648-47-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/2648-55-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/2648-57-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2648-67-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2648-61-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB