Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-07-2024 06:39
Static task
static1
Behavioral task
behavioral1
Sample
1e55ef17eb41550c40642c93cdec852e_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
1e55ef17eb41550c40642c93cdec852e_JaffaCakes118.exe
-
Size
166KB
-
MD5
1e55ef17eb41550c40642c93cdec852e
-
SHA1
7dcb56049b5f873d8050f592f819873bae429596
-
SHA256
a5a95361759ad39e5a3081fa96b3a1935ff2a24403f2466f677dd6e0fcc0629e
-
SHA512
8ed322f26fbf7d4192fd1c98a756a7eda7a5015825448f20764f5e4913bd793c64b8b654c7650877a1acb090d8c4f445f20b58e16467caad72e180e6bbe4f13d
-
SSDEEP
3072:EdKFOoL16A6L99ZgyXf9MWebpjMGlDCdra:QKF/LA37vBsGda
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exeWaterMark.exepid process 2864 1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exe 2600 WaterMark.exe -
Loads dropped DLL 4 IoCs
Processes:
1e55ef17eb41550c40642c93cdec852e_JaffaCakes118.exe1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exepid process 2232 1e55ef17eb41550c40642c93cdec852e_JaffaCakes118.exe 2232 1e55ef17eb41550c40642c93cdec852e_JaffaCakes118.exe 2864 1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exe 2864 1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exe -
Processes:
resource yara_rule behavioral1/memory/2864-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2864-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2864-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2864-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2864-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2864-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2864-20-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2600-40-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2600-556-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClientsideProviders.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_file_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\Microsoft.Ink.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACETXT.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledb32r.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\eula.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\zip.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\mozavutil.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.RunTime.Serialization.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AiodLite.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\ITIRCL55.DLL svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\ReachFramework.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\More Games\MoreGames.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libafile_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\clock.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\penusa.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\nss3.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\settings.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwLatin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationFramework.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Conversion.v3.5.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\sqlite.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\javafx-font.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Speech.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcer.dll svchost.exe File opened for modification C:\Program Files\DVD Maker\Pipeline.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libvod_rtsp_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libskiptags_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
WaterMark.exesvchost.exepid process 2600 WaterMark.exe 2600 WaterMark.exe 2600 WaterMark.exe 2600 WaterMark.exe 2600 WaterMark.exe 2600 WaterMark.exe 2600 WaterMark.exe 2600 WaterMark.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe 1504 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 2600 WaterMark.exe Token: SeDebugPrivilege 1504 svchost.exe Token: SeDebugPrivilege 2600 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exeWaterMark.exepid process 2864 1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exe 2600 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1e55ef17eb41550c40642c93cdec852e_JaffaCakes118.exe1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exeWaterMark.exesvchost.exedescription pid process target process PID 2232 wrote to memory of 2864 2232 1e55ef17eb41550c40642c93cdec852e_JaffaCakes118.exe 1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exe PID 2232 wrote to memory of 2864 2232 1e55ef17eb41550c40642c93cdec852e_JaffaCakes118.exe 1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exe PID 2232 wrote to memory of 2864 2232 1e55ef17eb41550c40642c93cdec852e_JaffaCakes118.exe 1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exe PID 2232 wrote to memory of 2864 2232 1e55ef17eb41550c40642c93cdec852e_JaffaCakes118.exe 1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exe PID 2864 wrote to memory of 2600 2864 1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exe WaterMark.exe PID 2864 wrote to memory of 2600 2864 1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exe WaterMark.exe PID 2864 wrote to memory of 2600 2864 1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exe WaterMark.exe PID 2864 wrote to memory of 2600 2864 1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exe WaterMark.exe PID 2600 wrote to memory of 2488 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 2488 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 2488 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 2488 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 2488 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 2488 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 2488 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 2488 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 2488 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 2488 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 1504 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 1504 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 1504 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 1504 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 1504 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 1504 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 1504 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 1504 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 1504 2600 WaterMark.exe svchost.exe PID 2600 wrote to memory of 1504 2600 WaterMark.exe svchost.exe PID 1504 wrote to memory of 260 1504 svchost.exe smss.exe PID 1504 wrote to memory of 260 1504 svchost.exe smss.exe PID 1504 wrote to memory of 260 1504 svchost.exe smss.exe PID 1504 wrote to memory of 260 1504 svchost.exe smss.exe PID 1504 wrote to memory of 260 1504 svchost.exe smss.exe PID 1504 wrote to memory of 340 1504 svchost.exe csrss.exe PID 1504 wrote to memory of 340 1504 svchost.exe csrss.exe PID 1504 wrote to memory of 340 1504 svchost.exe csrss.exe PID 1504 wrote to memory of 340 1504 svchost.exe csrss.exe PID 1504 wrote to memory of 340 1504 svchost.exe csrss.exe PID 1504 wrote to memory of 388 1504 svchost.exe wininit.exe PID 1504 wrote to memory of 388 1504 svchost.exe wininit.exe PID 1504 wrote to memory of 388 1504 svchost.exe wininit.exe PID 1504 wrote to memory of 388 1504 svchost.exe wininit.exe PID 1504 wrote to memory of 388 1504 svchost.exe wininit.exe PID 1504 wrote to memory of 400 1504 svchost.exe csrss.exe PID 1504 wrote to memory of 400 1504 svchost.exe csrss.exe PID 1504 wrote to memory of 400 1504 svchost.exe csrss.exe PID 1504 wrote to memory of 400 1504 svchost.exe csrss.exe PID 1504 wrote to memory of 400 1504 svchost.exe csrss.exe PID 1504 wrote to memory of 436 1504 svchost.exe winlogon.exe PID 1504 wrote to memory of 436 1504 svchost.exe winlogon.exe PID 1504 wrote to memory of 436 1504 svchost.exe winlogon.exe PID 1504 wrote to memory of 436 1504 svchost.exe winlogon.exe PID 1504 wrote to memory of 436 1504 svchost.exe winlogon.exe PID 1504 wrote to memory of 480 1504 svchost.exe services.exe PID 1504 wrote to memory of 480 1504 svchost.exe services.exe PID 1504 wrote to memory of 480 1504 svchost.exe services.exe PID 1504 wrote to memory of 480 1504 svchost.exe services.exe PID 1504 wrote to memory of 480 1504 svchost.exe services.exe PID 1504 wrote to memory of 496 1504 svchost.exe lsass.exe PID 1504 wrote to memory of 496 1504 svchost.exe lsass.exe PID 1504 wrote to memory of 496 1504 svchost.exe lsass.exe PID 1504 wrote to memory of 496 1504 svchost.exe lsass.exe PID 1504 wrote to memory of 496 1504 svchost.exe lsass.exe PID 1504 wrote to memory of 504 1504 svchost.exe lsm.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\1e55ef17eb41550c40642c93cdec852e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1e55ef17eb41550c40642c93cdec852e_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exeC:\Users\Admin\AppData\Local\Temp\1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.htmlFilesize
206KB
MD5b65dd38bb56e381bc9f7ca8907a2883d
SHA14aa3d037ec088646a049caeacf856b31a86d5c51
SHA2569af703ba880449e241caa6ce03022cb0218667416bdc0fe8f347249d340edddd
SHA5123a4cbb9d877d6a5771fa0bb196f2c75395eb88141f0396f390c888eda7f66909e13f933bcf4247e8349d13155354490aab3f1cf307270d803a8890adecda54ae
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.htmlFilesize
202KB
MD51fb122cca9dd971a7bc6532c8b9a5ce2
SHA131e0f130c5e97ad52e70fa8cafef7d6738c0dddc
SHA256518a2213a65331784d26ada61d083f73dc00202d7a617ed842e0d8676dff3b34
SHA51200597d0650f323f98777c1a37b08081cf763e8bd766db9db5d5219e13829b4a2de766138e3f407b36e69fb89f3d9841b30a80fb1ec6000f81f15b1070e5a956d
-
C:\Users\Admin\AppData\Local\Temp\1e55ef17eb41550c40642c93cdec852e_JaffaCakes118mgr.exeFilesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
memory/1504-88-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1504-322-0x0000000077790000-0x0000000077791000-memory.dmpFilesize
4KB
-
memory/1504-89-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1504-91-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1504-92-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1504-90-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1504-87-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1504-83-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1504-73-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2232-8-0x0000000000A70000-0x0000000000A9C000-memory.dmpFilesize
176KB
-
memory/2232-0-0x0000000000A70000-0x0000000000A9C000-memory.dmpFilesize
176KB
-
memory/2488-65-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2488-58-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2488-45-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/2488-43-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2488-53-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2488-66-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2488-777-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2488-64-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/2488-62-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/2488-61-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/2600-82-0x000000007778F000-0x0000000077790000-memory.dmpFilesize
4KB
-
memory/2600-71-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2600-38-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/2600-40-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2600-41-0x000000007778F000-0x0000000077790000-memory.dmpFilesize
4KB
-
memory/2600-556-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2864-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2864-20-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2864-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2864-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2864-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2864-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2864-19-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/2864-29-0x0000000000050000-0x0000000000085000-memory.dmpFilesize
212KB
-
memory/2864-11-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2864-10-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB