Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 18:49
Static task
static1
Behavioral task
behavioral1
Sample
1c1d55781c8af09004cfeb04baeb5fc4_JaffaCakes118.dll
Resource
win7-20240220-en
General
-
Target
1c1d55781c8af09004cfeb04baeb5fc4_JaffaCakes118.dll
-
Size
337KB
-
MD5
1c1d55781c8af09004cfeb04baeb5fc4
-
SHA1
542de04aa7fd7e720a60c686b55aa63347eeb101
-
SHA256
e4420e94466c2b5d706dadf5c87ca47351a6e5d414cda5412f96a181a23b1cd7
-
SHA512
706dcf2219cfb678ac30c7d7fa285248c48dbe931593a19d54b54c9bbf0659e65e75e4fe095d18bcbcb86a3d9bc521785bb73c5c2518a6c7578ef58b39c82459
-
SSDEEP
6144:bN0yr1sO/wIKS0FKtOT/OrDtgUi0uvQee7Qee/0QeesQeeglQeekQeeDC7MdqyMU:RG6wndYtamDSU1GqyMA5
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 2784 regsvr32mgr.exe 2552 WaterMark.exe -
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exeregsvr32mgr.exepid process 3068 regsvr32.exe 3068 regsvr32.exe 2784 regsvr32mgr.exe 2784 regsvr32mgr.exe -
Processes:
resource yara_rule behavioral1/memory/2784-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2784-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2784-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2784-19-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2784-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2784-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2784-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2552-39-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2552-37-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2552-41-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2552-565-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
regsvr32.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exeregsvr32mgr.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_a52_plugin.dll svchost.exe File opened for modification C:\Program Files\DVD Maker\OmdProject.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\cpu.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\net.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Client.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatialaudio_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\pdfshell.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwgst.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Design.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\msvcr100.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libftp_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\pkeyconfig.companion.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\attach.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationFramework.resources.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\freebl3.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationBuildTasks.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\gui\libskins2_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\slideShow.html svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\java_crw_demo.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\settings.html svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcor.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\jsdebuggeride.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Defender\MpSvc.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\weather.html svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jaas_nt.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\dt_socket.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClientsideProviders.resources.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\weather.html svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe regsvr32mgr.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEWSTR.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ReachFramework.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Printing.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libupnp_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfps_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\README.html svchost.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll svchost.exe -
Modifies registry class 4 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58F1580-0DF3-401C-93B1-2D9DDA61CF04}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58F1580-0DF3-401C-93B1-2D9DDA61CF04}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58F1580-0DF3-401C-93B1-2D9DDA61CF04} regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
WaterMark.exesvchost.exepid process 2552 WaterMark.exe 2552 WaterMark.exe 2552 WaterMark.exe 2552 WaterMark.exe 2552 WaterMark.exe 2552 WaterMark.exe 2552 WaterMark.exe 2552 WaterMark.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 2552 WaterMark.exe Token: SeDebugPrivilege 1464 svchost.exe Token: SeDebugPrivilege 2552 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 2784 regsvr32mgr.exe 2552 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32mgr.exeWaterMark.exesvchost.exedescription pid process target process PID 2924 wrote to memory of 3068 2924 regsvr32.exe regsvr32.exe PID 2924 wrote to memory of 3068 2924 regsvr32.exe regsvr32.exe PID 2924 wrote to memory of 3068 2924 regsvr32.exe regsvr32.exe PID 2924 wrote to memory of 3068 2924 regsvr32.exe regsvr32.exe PID 2924 wrote to memory of 3068 2924 regsvr32.exe regsvr32.exe PID 2924 wrote to memory of 3068 2924 regsvr32.exe regsvr32.exe PID 2924 wrote to memory of 3068 2924 regsvr32.exe regsvr32.exe PID 3068 wrote to memory of 2784 3068 regsvr32.exe regsvr32mgr.exe PID 3068 wrote to memory of 2784 3068 regsvr32.exe regsvr32mgr.exe PID 3068 wrote to memory of 2784 3068 regsvr32.exe regsvr32mgr.exe PID 3068 wrote to memory of 2784 3068 regsvr32.exe regsvr32mgr.exe PID 2784 wrote to memory of 2552 2784 regsvr32mgr.exe WaterMark.exe PID 2784 wrote to memory of 2552 2784 regsvr32mgr.exe WaterMark.exe PID 2784 wrote to memory of 2552 2784 regsvr32mgr.exe WaterMark.exe PID 2784 wrote to memory of 2552 2784 regsvr32mgr.exe WaterMark.exe PID 2552 wrote to memory of 2636 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 2636 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 2636 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 2636 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 2636 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 2636 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 2636 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 2636 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 2636 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 2636 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 1464 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 1464 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 1464 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 1464 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 1464 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 1464 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 1464 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 1464 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 1464 2552 WaterMark.exe svchost.exe PID 2552 wrote to memory of 1464 2552 WaterMark.exe svchost.exe PID 1464 wrote to memory of 260 1464 svchost.exe smss.exe PID 1464 wrote to memory of 260 1464 svchost.exe smss.exe PID 1464 wrote to memory of 260 1464 svchost.exe smss.exe PID 1464 wrote to memory of 260 1464 svchost.exe smss.exe PID 1464 wrote to memory of 260 1464 svchost.exe smss.exe PID 1464 wrote to memory of 340 1464 svchost.exe csrss.exe PID 1464 wrote to memory of 340 1464 svchost.exe csrss.exe PID 1464 wrote to memory of 340 1464 svchost.exe csrss.exe PID 1464 wrote to memory of 340 1464 svchost.exe csrss.exe PID 1464 wrote to memory of 340 1464 svchost.exe csrss.exe PID 1464 wrote to memory of 388 1464 svchost.exe wininit.exe PID 1464 wrote to memory of 388 1464 svchost.exe wininit.exe PID 1464 wrote to memory of 388 1464 svchost.exe wininit.exe PID 1464 wrote to memory of 388 1464 svchost.exe wininit.exe PID 1464 wrote to memory of 388 1464 svchost.exe wininit.exe PID 1464 wrote to memory of 400 1464 svchost.exe csrss.exe PID 1464 wrote to memory of 400 1464 svchost.exe csrss.exe PID 1464 wrote to memory of 400 1464 svchost.exe csrss.exe PID 1464 wrote to memory of 400 1464 svchost.exe csrss.exe PID 1464 wrote to memory of 400 1464 svchost.exe csrss.exe PID 1464 wrote to memory of 436 1464 svchost.exe winlogon.exe PID 1464 wrote to memory of 436 1464 svchost.exe winlogon.exe PID 1464 wrote to memory of 436 1464 svchost.exe winlogon.exe PID 1464 wrote to memory of 436 1464 svchost.exe winlogon.exe PID 1464 wrote to memory of 436 1464 svchost.exe winlogon.exe PID 1464 wrote to memory of 484 1464 svchost.exe services.exe PID 1464 wrote to memory of 484 1464 svchost.exe services.exe PID 1464 wrote to memory of 484 1464 svchost.exe services.exe PID 1464 wrote to memory of 484 1464 svchost.exe services.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1c1d55781c8af09004cfeb04baeb5fc4_JaffaCakes118.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1c1d55781c8af09004cfeb04baeb5fc4_JaffaCakes118.dll3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.htmlFilesize
206KB
MD51d49551f8fd03008395db9ed07a99cc4
SHA12d592a28429e88710e3df85964614a619f71ca58
SHA256e1926295576a5ebf3c0b9ba35c093ca10760b4b09004ba7c17552a74506f73e6
SHA512e16d7077e57f042426ee3a43bbeb8911481dfa5a4ec2613c10f8a2d56673484957a3acaffaf8f5a9af477c63e0ec08a082a9b39cbf86b7a1536a494d53b4576f
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.htmlFilesize
202KB
MD5b2dc44ed47a71a89855c1c35c4a8cc6e
SHA107a30fa1c179ff5fb65c77368b60109d93a35fc0
SHA256bb06d56a24e9a7e4228becd1c89138c4a7a24e5bb8386eae11e626ceecf77537
SHA512c51830795b68adb16fc08747d9f63c4831a497562babba33d293675e51dfccab7f2e218c9eee5038e119b3aefe212a72d42f402c7cdbd0fd7073fbf82630257a
-
\Windows\SysWOW64\regsvr32mgr.exeFilesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
memory/1464-86-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/1464-82-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1464-89-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1464-90-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1464-87-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1464-72-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1464-85-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1464-88-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2552-29-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2552-40-0x000000007742F000-0x0000000077430000-memory.dmpFilesize
4KB
-
memory/2552-39-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2552-38-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB
-
memory/2552-37-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2552-41-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2552-70-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2552-565-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2636-43-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2636-53-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/2636-55-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2636-60-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2636-64-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2636-66-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/2636-54-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/2636-45-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/2784-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2784-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2784-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2784-18-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2784-19-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2784-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2784-10-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2784-11-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3068-3-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/3068-2-0x0000000074640000-0x0000000074697000-memory.dmpFilesize
348KB