Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 10:25
Static task
static1
Behavioral task
behavioral1
Sample
1aefdbcfb99f7161560c5afe82a1c1b5_JaffaCakes118.dll
Resource
win7-20240611-en
General
-
Target
1aefdbcfb99f7161560c5afe82a1c1b5_JaffaCakes118.dll
-
Size
337KB
-
MD5
1aefdbcfb99f7161560c5afe82a1c1b5
-
SHA1
e5160d0a118e5b83bae31e013eeb7e8024500be1
-
SHA256
22e0e4136de571527d5fbe9c4f7813367c7ba7aba51f31cbacdc9e8a2cf436a4
-
SHA512
7ac11d3271f4a0b7e711af14858e5cac960a64bcccea1884bd64f54afee314b81a3281722edcdc42d36bc1e60e239df8e238f742cedc8af377cf74e20f22cf0b
-
SSDEEP
6144:FN0yr1sO/wIKS0FKtOT/OrDtgUi0uvQee7Qee/0QeesQeeglQeekQeeDC7M3HCR+:7G6wndYtamDSU1MHCRflI
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 2120 regsvr32mgr.exe 2280 WaterMark.exe -
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exeregsvr32mgr.exepid process 1736 regsvr32.exe 1736 regsvr32.exe 2120 regsvr32mgr.exe 2120 regsvr32mgr.exe -
Processes:
resource yara_rule behavioral1/memory/2120-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2120-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2120-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2120-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2120-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2120-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2120-20-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2280-41-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2280-34-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2280-566-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
regsvr32.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\settings.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckg.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmotionblur_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\net.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Conversion.v3.5.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2native.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libx26410b_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Journal\NBMapTIP.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\weather.html svchost.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationFramework.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\logger\libconsole_logger_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm svchost.exe File opened for modification C:\Program Files\Internet Explorer\iedvtool.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationTypes.resources.dll svchost.exe File opened for modification C:\Program Files\Windows Journal\JNTFiltr.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\calendar.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIBUtils.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_h264_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\w2k_lsa_auth.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\wsdetect.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdtv_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libglwin32_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\settings.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\sqlite.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\rtscom.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdarem.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\management.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\INLAUNCH.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsBase.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_cycle_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_nv12_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\settings.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACERCLR.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\axvlc.dll svchost.exe -
Modifies registry class 4 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58F1580-0DF3-401C-93B1-2D9DDA61CF04}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58F1580-0DF3-401C-93B1-2D9DDA61CF04} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58F1580-0DF3-401C-93B1-2D9DDA61CF04}\1.0 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
WaterMark.exesvchost.exepid process 2280 WaterMark.exe 2280 WaterMark.exe 2280 WaterMark.exe 2280 WaterMark.exe 2280 WaterMark.exe 2280 WaterMark.exe 2280 WaterMark.exe 2280 WaterMark.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe 3024 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 2280 WaterMark.exe Token: SeDebugPrivilege 3024 svchost.exe Token: SeDebugPrivilege 2280 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 2120 regsvr32mgr.exe 2280 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32mgr.exeWaterMark.exesvchost.exedescription pid process target process PID 1528 wrote to memory of 1736 1528 regsvr32.exe regsvr32.exe PID 1528 wrote to memory of 1736 1528 regsvr32.exe regsvr32.exe PID 1528 wrote to memory of 1736 1528 regsvr32.exe regsvr32.exe PID 1528 wrote to memory of 1736 1528 regsvr32.exe regsvr32.exe PID 1528 wrote to memory of 1736 1528 regsvr32.exe regsvr32.exe PID 1528 wrote to memory of 1736 1528 regsvr32.exe regsvr32.exe PID 1528 wrote to memory of 1736 1528 regsvr32.exe regsvr32.exe PID 1736 wrote to memory of 2120 1736 regsvr32.exe regsvr32mgr.exe PID 1736 wrote to memory of 2120 1736 regsvr32.exe regsvr32mgr.exe PID 1736 wrote to memory of 2120 1736 regsvr32.exe regsvr32mgr.exe PID 1736 wrote to memory of 2120 1736 regsvr32.exe regsvr32mgr.exe PID 2120 wrote to memory of 2280 2120 regsvr32mgr.exe WaterMark.exe PID 2120 wrote to memory of 2280 2120 regsvr32mgr.exe WaterMark.exe PID 2120 wrote to memory of 2280 2120 regsvr32mgr.exe WaterMark.exe PID 2120 wrote to memory of 2280 2120 regsvr32mgr.exe WaterMark.exe PID 2280 wrote to memory of 2776 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 2776 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 2776 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 2776 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 2776 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 2776 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 2776 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 2776 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 2776 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 2776 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 3024 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 3024 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 3024 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 3024 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 3024 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 3024 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 3024 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 3024 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 3024 2280 WaterMark.exe svchost.exe PID 2280 wrote to memory of 3024 2280 WaterMark.exe svchost.exe PID 3024 wrote to memory of 256 3024 svchost.exe smss.exe PID 3024 wrote to memory of 256 3024 svchost.exe smss.exe PID 3024 wrote to memory of 256 3024 svchost.exe smss.exe PID 3024 wrote to memory of 256 3024 svchost.exe smss.exe PID 3024 wrote to memory of 256 3024 svchost.exe smss.exe PID 3024 wrote to memory of 336 3024 svchost.exe csrss.exe PID 3024 wrote to memory of 336 3024 svchost.exe csrss.exe PID 3024 wrote to memory of 336 3024 svchost.exe csrss.exe PID 3024 wrote to memory of 336 3024 svchost.exe csrss.exe PID 3024 wrote to memory of 336 3024 svchost.exe csrss.exe PID 3024 wrote to memory of 384 3024 svchost.exe wininit.exe PID 3024 wrote to memory of 384 3024 svchost.exe wininit.exe PID 3024 wrote to memory of 384 3024 svchost.exe wininit.exe PID 3024 wrote to memory of 384 3024 svchost.exe wininit.exe PID 3024 wrote to memory of 384 3024 svchost.exe wininit.exe PID 3024 wrote to memory of 396 3024 svchost.exe csrss.exe PID 3024 wrote to memory of 396 3024 svchost.exe csrss.exe PID 3024 wrote to memory of 396 3024 svchost.exe csrss.exe PID 3024 wrote to memory of 396 3024 svchost.exe csrss.exe PID 3024 wrote to memory of 396 3024 svchost.exe csrss.exe PID 3024 wrote to memory of 432 3024 svchost.exe winlogon.exe PID 3024 wrote to memory of 432 3024 svchost.exe winlogon.exe PID 3024 wrote to memory of 432 3024 svchost.exe winlogon.exe PID 3024 wrote to memory of 432 3024 svchost.exe winlogon.exe PID 3024 wrote to memory of 432 3024 svchost.exe winlogon.exe PID 3024 wrote to memory of 476 3024 svchost.exe services.exe PID 3024 wrote to memory of 476 3024 svchost.exe services.exe PID 3024 wrote to memory of 476 3024 svchost.exe services.exe PID 3024 wrote to memory of 476 3024 svchost.exe services.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1aefdbcfb99f7161560c5afe82a1c1b5_JaffaCakes118.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1aefdbcfb99f7161560c5afe82a1c1b5_JaffaCakes118.dll3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.htmlFilesize
206KB
MD5311ea88bd7267c8461e692c684661267
SHA105600aeadcabc64966de2f1ec9b0a98cba123f2f
SHA256565b0ca13c6bc89323c4a4d887e8ef828142f894074eb3ba39296a1a73d9f930
SHA512571ad0e396352a1f83a951689c18cd50a1bd7e2da1b2010686569e46628d695b2d43bffa8733c7368168c05fc15ea8a8fad90bddbe1f9e6439c1836ca805b393
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.htmlFilesize
202KB
MD529369d75edac5be7148fd91bfec42995
SHA118c0370f177f8b3262c311ccdafa3498d75ee9a1
SHA256f6e9ec5b9301dfe1dc0b93d3d9431b4aa0e52dbde765d578aa10bfac572420a8
SHA512e10c100d2e1f8a7c93acf887601d05c34cd7caeceef4001fbe98d5cbc55171583a8cf30beefbbe488c6db1c76a26ac4bf6d0776ad41ab5e963cf3d6a798967f1
-
\Windows\SysWOW64\regsvr32mgr.exeFilesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
memory/1736-3-0x0000000000200000-0x0000000000235000-memory.dmpFilesize
212KB
-
memory/1736-10-0x0000000000200000-0x0000000000235000-memory.dmpFilesize
212KB
-
memory/1736-1-0x00000000747B0000-0x0000000074807000-memory.dmpFilesize
348KB
-
memory/2120-11-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2120-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2120-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2120-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2120-20-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2120-19-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/2120-33-0x0000000000840000-0x0000000000875000-memory.dmpFilesize
212KB
-
memory/2120-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2120-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2280-41-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2280-34-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2280-566-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2280-39-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/2280-71-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2280-42-0x00000000775AF000-0x00000000775B0000-memory.dmpFilesize
4KB
-
memory/2776-55-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/2776-56-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2776-46-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/2776-67-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2776-54-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/2776-61-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2776-66-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/2776-44-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/3024-83-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/3024-87-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/3024-89-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/3024-91-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/3024-90-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/3024-88-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/3024-86-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/3024-73-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB