Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 02:54
Static task
static1
Behavioral task
behavioral1
Sample
f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118.exe
-
Size
166KB
-
MD5
f9589ae7b3f830c212b5343cc13c310a
-
SHA1
1751dfa44484e6d94341770debd776cf23bc428b
-
SHA256
c449790b63dcde8577f8ad226e94bd231f01e0af9dd9ed860de86ee124e82fe4
-
SHA512
dcfb2c928fa71b583895e1fb26d418cc1055217f92d4ca3966b3e507837e7a5f2b47c78244ffa58baabeaa401de694fbe5bc809be0acd3e5fd96cfe8300a4b0f
-
SSDEEP
3072:8dKFOoL16A6L99ZgyXf9MWebpjMGlDCdrs:4KF/LA37vBsGds
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exeWaterMark.exepid process 2348 f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exe 2560 WaterMark.exe -
Loads dropped DLL 4 IoCs
Processes:
f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118.exef9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exepid process 828 f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118.exe 828 f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118.exe 2348 f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exe 2348 f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exe -
Processes:
resource yara_rule behavioral1/memory/2348-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2348-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2348-12-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2348-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2348-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2348-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2348-18-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2348-21-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2560-40-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2560-91-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2560-458-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\msdaps.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.RunTime.Serialization.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libnoseek_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libantiflicker_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Conversion.v3.5.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_livehttp_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libdav1d_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\settings.html svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe svchost.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Utilities.v3.5.resources.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2iexp.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\nssckbi.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libftp_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE svchost.exe File opened for modification C:\Program Files\Common Files\System\ado\msadomd.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libhttps_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libedgedetection_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgrain_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Journal\JNWDRV.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libpng_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_standard_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jaas_nt.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\settings.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\deploy.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\libremoteosd_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\RSSFeeds.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2ssv.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libscte27_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromaprint_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll svchost.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
WaterMark.exesvchost.exepid process 2560 WaterMark.exe 2560 WaterMark.exe 2560 WaterMark.exe 2560 WaterMark.exe 2560 WaterMark.exe 2560 WaterMark.exe 2560 WaterMark.exe 2560 WaterMark.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe 2204 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 2560 WaterMark.exe Token: SeDebugPrivilege 2204 svchost.exe Token: SeDebugPrivilege 2560 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exeWaterMark.exepid process 2348 f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exe 2560 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118.exef9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exeWaterMark.exesvchost.exedescription pid process target process PID 828 wrote to memory of 2348 828 f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118.exe f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exe PID 828 wrote to memory of 2348 828 f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118.exe f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exe PID 828 wrote to memory of 2348 828 f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118.exe f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exe PID 828 wrote to memory of 2348 828 f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118.exe f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exe PID 2348 wrote to memory of 2560 2348 f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exe WaterMark.exe PID 2348 wrote to memory of 2560 2348 f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exe WaterMark.exe PID 2348 wrote to memory of 2560 2348 f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exe WaterMark.exe PID 2348 wrote to memory of 2560 2348 f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exe WaterMark.exe PID 2560 wrote to memory of 2956 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2956 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2956 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2956 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2956 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2956 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2956 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2956 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2956 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2956 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2204 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2204 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2204 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2204 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2204 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2204 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2204 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2204 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2204 2560 WaterMark.exe svchost.exe PID 2560 wrote to memory of 2204 2560 WaterMark.exe svchost.exe PID 2204 wrote to memory of 260 2204 svchost.exe smss.exe PID 2204 wrote to memory of 260 2204 svchost.exe smss.exe PID 2204 wrote to memory of 260 2204 svchost.exe smss.exe PID 2204 wrote to memory of 260 2204 svchost.exe smss.exe PID 2204 wrote to memory of 260 2204 svchost.exe smss.exe PID 2204 wrote to memory of 336 2204 svchost.exe csrss.exe PID 2204 wrote to memory of 336 2204 svchost.exe csrss.exe PID 2204 wrote to memory of 336 2204 svchost.exe csrss.exe PID 2204 wrote to memory of 336 2204 svchost.exe csrss.exe PID 2204 wrote to memory of 336 2204 svchost.exe csrss.exe PID 2204 wrote to memory of 372 2204 svchost.exe wininit.exe PID 2204 wrote to memory of 372 2204 svchost.exe wininit.exe PID 2204 wrote to memory of 372 2204 svchost.exe wininit.exe PID 2204 wrote to memory of 372 2204 svchost.exe wininit.exe PID 2204 wrote to memory of 372 2204 svchost.exe wininit.exe PID 2204 wrote to memory of 384 2204 svchost.exe csrss.exe PID 2204 wrote to memory of 384 2204 svchost.exe csrss.exe PID 2204 wrote to memory of 384 2204 svchost.exe csrss.exe PID 2204 wrote to memory of 384 2204 svchost.exe csrss.exe PID 2204 wrote to memory of 384 2204 svchost.exe csrss.exe PID 2204 wrote to memory of 420 2204 svchost.exe winlogon.exe PID 2204 wrote to memory of 420 2204 svchost.exe winlogon.exe PID 2204 wrote to memory of 420 2204 svchost.exe winlogon.exe PID 2204 wrote to memory of 420 2204 svchost.exe winlogon.exe PID 2204 wrote to memory of 420 2204 svchost.exe winlogon.exe PID 2204 wrote to memory of 468 2204 svchost.exe services.exe PID 2204 wrote to memory of 468 2204 svchost.exe services.exe PID 2204 wrote to memory of 468 2204 svchost.exe services.exe PID 2204 wrote to memory of 468 2204 svchost.exe services.exe PID 2204 wrote to memory of 468 2204 svchost.exe services.exe PID 2204 wrote to memory of 476 2204 svchost.exe lsass.exe PID 2204 wrote to memory of 476 2204 svchost.exe lsass.exe PID 2204 wrote to memory of 476 2204 svchost.exe lsass.exe PID 2204 wrote to memory of 476 2204 svchost.exe lsass.exe PID 2204 wrote to memory of 476 2204 svchost.exe lsass.exe PID 2204 wrote to memory of 484 2204 svchost.exe lsm.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exeC:\Users\Admin\AppData\Local\Temp\f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.htmlFilesize
206KB
MD5c9a54e5b6d740776b73c5efe97068ebd
SHA15c1a6d54b6264c69e4c6aee576bbae905151ba6b
SHA2565683645cd3a99fa7f580e0b7db89442c15fb65dccb192e4f1a602477e0d33afb
SHA512a9af98bd1e2029ccb00976dfd14c187771697b691f57190b25ac5ce1b0a2b5824478525b48f12b589cf1cd9779518fe0ac5ce221ef9df43ced79f8380baf09fc
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.htmlFilesize
202KB
MD56f062bd36294a957ec8ae0190d945988
SHA1c2818c1a62bfac2561a6145f3076d385ab504d4e
SHA256509822faeaec991cd9153f0e9e1026a8510d3886bdac1d7e18ac41be6c4f7db2
SHA5126bbb40f5f734bfe4f6580dee232f3f633b56bb62f0ef3f8e234433b6623595d51860c1e560f586dfc2734b5302add46275810a5473e060b1c12f93ac45549c74
-
C:\Users\Admin\AppData\Local\Temp\f9589ae7b3f830c212b5343cc13c310a_JaffaCakes118mgr.exeFilesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
memory/828-8-0x0000000000170000-0x00000000001A5000-memory.dmpFilesize
212KB
-
memory/828-9-0x0000000000950000-0x000000000097C000-memory.dmpFilesize
176KB
-
memory/828-0-0x0000000000950000-0x000000000097C000-memory.dmpFilesize
176KB
-
memory/2204-90-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/2204-72-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2204-92-0x00000000775F0000-0x00000000775F1000-memory.dmpFilesize
4KB
-
memory/2204-93-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2204-87-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/2204-88-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2204-89-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2204-86-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2204-82-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2348-18-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2348-30-0x0000000000050000-0x0000000000085000-memory.dmpFilesize
212KB
-
memory/2348-11-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2348-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2348-12-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2348-14-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/2348-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2348-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2348-17-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2348-21-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2560-287-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2560-285-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB
-
memory/2560-40-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2560-70-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2560-458-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2560-41-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/2560-297-0x00000000775F0000-0x00000000775F1000-memory.dmpFilesize
4KB
-
memory/2560-91-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2560-296-0x00000000775EF000-0x00000000775F0000-memory.dmpFilesize
4KB
-
memory/2560-42-0x00000000775EF000-0x00000000775F0000-memory.dmpFilesize
4KB
-
memory/2956-61-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2956-55-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2956-54-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2956-53-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/2956-57-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/2956-455-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2956-66-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2956-46-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2956-44-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB