Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 16:49
Static task
static1
Behavioral task
behavioral1
Sample
1bc1ec8789758ea996e78b7be429ee06_JaffaCakes118.dll
Resource
win7-20240419-en
General
-
Target
1bc1ec8789758ea996e78b7be429ee06_JaffaCakes118.dll
-
Size
132KB
-
MD5
1bc1ec8789758ea996e78b7be429ee06
-
SHA1
7e52a3f078a0fc3cf522f06a14406a5db6a5cc8d
-
SHA256
622ace3bd4b8fe20fccc53365a4c9189af3482a000b56ac7576aef7d1e9af780
-
SHA512
f1a28f8a66dbfc79239e7107ac6fc3fda18f9a267af85086af844a0eaeb7cc9bac6b2fec06d29f6735685fa847368689e4e61d251385497e7e685f58eed1b6df
-
SSDEEP
3072:po6nwLqrSa4I+VC2L99ZgyXf9MWebpjMGlDCdrv:W6ux7vBsGdv
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 2768 regsvr32mgr.exe 2644 WaterMark.exe -
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exeregsvr32mgr.exepid process 2056 regsvr32.exe 2056 regsvr32.exe 2768 regsvr32mgr.exe 2768 regsvr32mgr.exe -
Processes:
resource yara_rule behavioral1/memory/2768-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2644-40-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2644-41-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2644-39-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2644-35-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2768-21-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2768-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2768-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2768-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2768-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2768-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2644-564-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
regsvr32.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exeregsvr32mgr.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe svchost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\WebKit.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jsound.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll svchost.exe File opened for modification C:\Program Files\Windows Mail\wab.exe svchost.exe File opened for modification C:\Program Files\Common Files\System\ado\msadomd.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\net.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\currency.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\hxdsui.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\dicjp.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwjpn.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_copy_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DAO\dao360.dll svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px10C3.tmp regsvr32mgr.exe File opened for modification C:\Program Files\Java\jre7\bin\java.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libclone_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\flyout.html svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\weather.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\msvcr100.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\RSSFeeds.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\vdk150.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\notificationserver.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ogg_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libwall_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\EEINTL.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libhttps_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libfloat_mixer_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libswscale_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Journal\MSPVWCTL.DLL svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\clock.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\InkDiv.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libsdp_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\liboldrc_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_display_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
WaterMark.exesvchost.exepid process 2644 WaterMark.exe 2644 WaterMark.exe 2644 WaterMark.exe 2644 WaterMark.exe 2644 WaterMark.exe 2644 WaterMark.exe 2644 WaterMark.exe 2644 WaterMark.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe 1324 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 2644 WaterMark.exe Token: SeDebugPrivilege 1324 svchost.exe Token: SeDebugPrivilege 2644 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 2768 regsvr32mgr.exe 2644 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32mgr.exeWaterMark.exesvchost.exedescription pid process target process PID 1648 wrote to memory of 2056 1648 regsvr32.exe regsvr32.exe PID 1648 wrote to memory of 2056 1648 regsvr32.exe regsvr32.exe PID 1648 wrote to memory of 2056 1648 regsvr32.exe regsvr32.exe PID 1648 wrote to memory of 2056 1648 regsvr32.exe regsvr32.exe PID 1648 wrote to memory of 2056 1648 regsvr32.exe regsvr32.exe PID 1648 wrote to memory of 2056 1648 regsvr32.exe regsvr32.exe PID 1648 wrote to memory of 2056 1648 regsvr32.exe regsvr32.exe PID 2056 wrote to memory of 2768 2056 regsvr32.exe regsvr32mgr.exe PID 2056 wrote to memory of 2768 2056 regsvr32.exe regsvr32mgr.exe PID 2056 wrote to memory of 2768 2056 regsvr32.exe regsvr32mgr.exe PID 2056 wrote to memory of 2768 2056 regsvr32.exe regsvr32mgr.exe PID 2768 wrote to memory of 2644 2768 regsvr32mgr.exe WaterMark.exe PID 2768 wrote to memory of 2644 2768 regsvr32mgr.exe WaterMark.exe PID 2768 wrote to memory of 2644 2768 regsvr32mgr.exe WaterMark.exe PID 2768 wrote to memory of 2644 2768 regsvr32mgr.exe WaterMark.exe PID 2644 wrote to memory of 2848 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 2848 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 2848 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 2848 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 2848 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 2848 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 2848 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 2848 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 2848 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 2848 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 1324 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 1324 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 1324 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 1324 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 1324 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 1324 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 1324 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 1324 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 1324 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 1324 2644 WaterMark.exe svchost.exe PID 1324 wrote to memory of 256 1324 svchost.exe smss.exe PID 1324 wrote to memory of 256 1324 svchost.exe smss.exe PID 1324 wrote to memory of 256 1324 svchost.exe smss.exe PID 1324 wrote to memory of 256 1324 svchost.exe smss.exe PID 1324 wrote to memory of 256 1324 svchost.exe smss.exe PID 1324 wrote to memory of 332 1324 svchost.exe csrss.exe PID 1324 wrote to memory of 332 1324 svchost.exe csrss.exe PID 1324 wrote to memory of 332 1324 svchost.exe csrss.exe PID 1324 wrote to memory of 332 1324 svchost.exe csrss.exe PID 1324 wrote to memory of 332 1324 svchost.exe csrss.exe PID 1324 wrote to memory of 380 1324 svchost.exe wininit.exe PID 1324 wrote to memory of 380 1324 svchost.exe wininit.exe PID 1324 wrote to memory of 380 1324 svchost.exe wininit.exe PID 1324 wrote to memory of 380 1324 svchost.exe wininit.exe PID 1324 wrote to memory of 380 1324 svchost.exe wininit.exe PID 1324 wrote to memory of 392 1324 svchost.exe csrss.exe PID 1324 wrote to memory of 392 1324 svchost.exe csrss.exe PID 1324 wrote to memory of 392 1324 svchost.exe csrss.exe PID 1324 wrote to memory of 392 1324 svchost.exe csrss.exe PID 1324 wrote to memory of 392 1324 svchost.exe csrss.exe PID 1324 wrote to memory of 432 1324 svchost.exe winlogon.exe PID 1324 wrote to memory of 432 1324 svchost.exe winlogon.exe PID 1324 wrote to memory of 432 1324 svchost.exe winlogon.exe PID 1324 wrote to memory of 432 1324 svchost.exe winlogon.exe PID 1324 wrote to memory of 432 1324 svchost.exe winlogon.exe PID 1324 wrote to memory of 476 1324 svchost.exe services.exe PID 1324 wrote to memory of 476 1324 svchost.exe services.exe PID 1324 wrote to memory of 476 1324 svchost.exe services.exe PID 1324 wrote to memory of 476 1324 svchost.exe services.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1bc1ec8789758ea996e78b7be429ee06_JaffaCakes118.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1bc1ec8789758ea996e78b7be429ee06_JaffaCakes118.dll3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.htmlFilesize
206KB
MD54a77e73c0c39f66296355fc46a79d491
SHA18d3814497b576194eb9e35618196ef29928ddd6e
SHA256332327ce8bda33dca03d75e55c63e0b63484e13ef849bb4102abebf0e29b4635
SHA512f689e8950eca3e50d7dee6db28eee61e43d56fb775978bff0f9878b6d3391e254d387743d8331233b5e071d9068e39acdd333d484d7ec3b83bb48836a8e9507a
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.htmlFilesize
202KB
MD5d185e67c25439fede8977cd891d4d6bf
SHA16652ac24810420faddefb1b73cf46ad8d88fbb2a
SHA25637f17761c4c5824ab42b64c32c4b8641f502e8485ec32f27fd6da8cf7228e110
SHA512e7b35dc5209c0fce37b0f91bc85b2f5ce9d1325af9564a565da21f15b264cf0cfd09a1b2cd96911e2babd38e7c74531733118bf199484f178ee20f4ccc33dbfb
-
\Windows\SysWOW64\regsvr32mgr.exeFilesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
memory/1324-71-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1324-81-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1324-84-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1324-85-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1324-86-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1324-88-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1324-89-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1324-87-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2056-4-0x0000000000180000-0x00000000001B5000-memory.dmpFilesize
212KB
-
memory/2056-3-0x0000000000150000-0x0000000000174000-memory.dmpFilesize
144KB
-
memory/2056-11-0x0000000000180000-0x00000000001B5000-memory.dmpFilesize
212KB
-
memory/2056-0-0x0000000000150000-0x0000000000174000-memory.dmpFilesize
144KB
-
memory/2644-69-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2644-42-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2644-39-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2644-35-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2644-40-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2644-564-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2644-41-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2644-43-0x0000000076F7F000-0x0000000076F80000-memory.dmpFilesize
4KB
-
memory/2768-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2768-20-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/2768-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2768-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2768-17-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2768-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2768-21-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2768-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2848-52-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2848-64-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/2848-65-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2848-66-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/2848-62-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2848-57-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2848-47-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2848-45-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB