ramnit | 30a595af4395567d2b78f969b94e183a1a989f470aa373b8ac96320933e7df6a

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ff33c146ff7c55fb3b95f35c0f3f265_JaffaCakes118.dll
Size

135KB
MD5

0ff33c146ff7c55fb3b95f35c0f3f265
SHA1

82064ad8019338464a4163fc639f20ecc4c6b3f3
SHA256

30a595af4395567d2b78f969b94e183a1a989f470aa373b8ac96320933e7df6a
SHA512

7f562d5924b98842396947b8f1b895413c1b5bda9a65165172778a5e9281a2b4baee36175cd0b5ec993a4ed32788c2b5e8d43c4bea797a11c59fc501e8d4361c
SSDEEP

3072:aUIZOm2MxCIL9jXQPtZsk4Ul2pLwAxG1wdwtv/y5l:qOm2OCI9SLsk4Ulp1wdqH6

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 2 IoCs

pid	Process
1168	rundll32mgr.exe
2604	WaterMark.exe

Loads dropped DLL 4 IoCs

pid	Process
1260	rundll32.exe
1260	rundll32.exe
1168	rundll32mgr.exe
1168	rundll32mgr.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1168-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1168-16-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1168-17-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1168-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1168-20-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1168-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1168-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2604-40-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2604-559-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2604-562-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Journal\MSPVWCTL.DLL	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadcf.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\keystore\libmemory_keystore_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_flac_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\settings.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libnetsync_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\eula.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\VISSHE.DLL	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libdtv_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEREP.DLL	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEWDAT.DLL	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgaussianblur_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jfxwebkit.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationProvider.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCH.DLL	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\pipres.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEXBE.DLL	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\msvcp140.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libtcp_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\vdk150.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\dicjp.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libsubtitle_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libflaschen_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\hxdsui.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\currency.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.RunTime.Serialization.Resources.dll	svchost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2604	WaterMark.exe
2604	WaterMark.exe
2604	WaterMark.exe
2604	WaterMark.exe
2604	WaterMark.exe
2604	WaterMark.exe
2604	WaterMark.exe
2604	WaterMark.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe
556	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	WaterMark.exe
Token: SeDebugPrivilege	556	svchost.exe
Token: SeDebugPrivilege	2604	WaterMark.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1168	rundll32mgr.exe
2604	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 1260 wrote to memory of 1168	1260	rundll32.exe	29
PID 1260 wrote to memory of 1168	1260	rundll32.exe	29
PID 1260 wrote to memory of 1168	1260	rundll32.exe	29
PID 1260 wrote to memory of 1168	1260	rundll32.exe	29
PID 1168 wrote to memory of 2604	1168	rundll32mgr.exe	30
PID 1168 wrote to memory of 2604	1168	rundll32mgr.exe	30
PID 1168 wrote to memory of 2604	1168	rundll32mgr.exe	30
PID 1168 wrote to memory of 2604	1168	rundll32mgr.exe	30
PID 2604 wrote to memory of 2084	2604	WaterMark.exe	31
PID 2604 wrote to memory of 2084	2604	WaterMark.exe	31
PID 2604 wrote to memory of 2084	2604	WaterMark.exe	31
PID 2604 wrote to memory of 2084	2604	WaterMark.exe	31
PID 2604 wrote to memory of 2084	2604	WaterMark.exe	31
PID 2604 wrote to memory of 2084	2604	WaterMark.exe	31
PID 2604 wrote to memory of 2084	2604	WaterMark.exe	31
PID 2604 wrote to memory of 2084	2604	WaterMark.exe	31
PID 2604 wrote to memory of 2084	2604	WaterMark.exe	31
PID 2604 wrote to memory of 2084	2604	WaterMark.exe	31
PID 2604 wrote to memory of 556	2604	WaterMark.exe	32
PID 2604 wrote to memory of 556	2604	WaterMark.exe	32
PID 2604 wrote to memory of 556	2604	WaterMark.exe	32
PID 2604 wrote to memory of 556	2604	WaterMark.exe	32
PID 2604 wrote to memory of 556	2604	WaterMark.exe	32
PID 2604 wrote to memory of 556	2604	WaterMark.exe	32
PID 2604 wrote to memory of 556	2604	WaterMark.exe	32
PID 2604 wrote to memory of 556	2604	WaterMark.exe	32
PID 2604 wrote to memory of 556	2604	WaterMark.exe	32
PID 2604 wrote to memory of 556	2604	WaterMark.exe	32
PID 556 wrote to memory of 260	556	svchost.exe	1
PID 556 wrote to memory of 260	556	svchost.exe	1
PID 556 wrote to memory of 260	556	svchost.exe	1
PID 556 wrote to memory of 260	556	svchost.exe	1
PID 556 wrote to memory of 260	556	svchost.exe	1
PID 556 wrote to memory of 336	556	svchost.exe	2
PID 556 wrote to memory of 336	556	svchost.exe	2
PID 556 wrote to memory of 336	556	svchost.exe	2
PID 556 wrote to memory of 336	556	svchost.exe	2
PID 556 wrote to memory of 336	556	svchost.exe	2
PID 556 wrote to memory of 388	556	svchost.exe	3
PID 556 wrote to memory of 388	556	svchost.exe	3
PID 556 wrote to memory of 388	556	svchost.exe	3
PID 556 wrote to memory of 388	556	svchost.exe	3
PID 556 wrote to memory of 388	556	svchost.exe	3
PID 556 wrote to memory of 400	556	svchost.exe	4
PID 556 wrote to memory of 400	556	svchost.exe	4
PID 556 wrote to memory of 400	556	svchost.exe	4
PID 556 wrote to memory of 400	556	svchost.exe	4
PID 556 wrote to memory of 400	556	svchost.exe	4
PID 556 wrote to memory of 436	556	svchost.exe	5
PID 556 wrote to memory of 436	556	svchost.exe	5
PID 556 wrote to memory of 436	556	svchost.exe	5
PID 556 wrote to memory of 436	556	svchost.exe	5
PID 556 wrote to memory of 436	556	svchost.exe	5
PID 556 wrote to memory of 480	556	svchost.exe	6
PID 556 wrote to memory of 480	556	svchost.exe	6
PID 556 wrote to memory of 480	556	svchost.exe	6
PID 556 wrote to memory of 480	556	svchost.exe	6

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:336

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:388
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:480
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:616
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1956
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe -Embedding
      4⤵
      PID:2396
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:692
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:764
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:840
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1176
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:876
  - - C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:1048
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:1000
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:348
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1032
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1092
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1132
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:1256
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2376
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:496
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:504

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:400

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ff33c146ff7c55fb3b95f35c0f3f265_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ff33c146ff7c55fb3b95f35c0f3f265_JaffaCakes118.dll,#1
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\Windows\SysWOW64\rundll32mgr.exe
      C:\Windows\SysWOW64\rundll32mgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:1168
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:2604
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        
        PID:2084
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
252KB

MD5
a43602413708f34ded639b669ddd2efc

SHA1
e330b2d0a1d424b9cd87148d41f18267e166db2e

SHA256
62fb77bcdf7d157a5ec048fcd40c6615d8da08ab21317bc03f75129bd94bc5f0

SHA512
d57d917ec97743f5dede9fb2ab2b0da17152bbc0bbf96d673b1a74eed8b8ffd5654162522228ea27c7e06b25490172764fdbf6566375f9ea74fa12ba09bf99aa

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
248KB

MD5
5b325baa2cc23ab6cea275b24c801bff

SHA1
b88141d440570b54db5090da580fe4c604f04416

SHA256
6d01b2ec9e3981cf72e90a62e1d3e0569d04c2a9e081cfd0317104bb09f5bf3b

SHA512
d72d72468043034bd8324db3f2cba91fffed1afd4dfec1813a33d8ecfcb6e3c511fa820f277f64687d6fb5edd3b39dfee755238ad3e476b9e1d5e16f9a53e40d

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
119KB

MD5
9d5d609dc8e2554054733d19eed45c5c

SHA1
ce72453fca9f477940a9def32bd8463549c6e1e4

SHA256
7a85b3db04beb0c4b6a8929fdf79726bcf1084efab0a9f04a8ebaa0a2bc9e0b1

SHA512
012cabde17ed1c1d1a48b5bc136591ff9c8e261e5da8bc7f67d0bd235a32150f63274362cdeef2376d2d5a38dfb0c9acc7cd3aa5244c1858b88b183f8cbe550b

Download Submit
memory/556-74-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/556-94-0x00000000776C0000-0x00000000776C1000-memory.dmp

Filesize
4KB

Download
memory/556-91-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/556-93-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/556-92-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/556-90-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/556-89-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/556-84-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/556-88-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1168-20-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1168-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1168-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1168-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1168-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1168-17-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1168-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1168-21-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1168-29-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download
memory/1168-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1260-10-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/1260-1-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/1260-3-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/2084-46-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2084-68-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/2084-56-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2084-61-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2084-54-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/2084-55-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2084-44-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2084-66-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2084-69-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2084-1003-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2604-41-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/2604-42-0x00000000776BF000-0x00000000776C0000-memory.dmp

Filesize
4KB

Download
memory/2604-559-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2604-562-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2604-72-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2604-40-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2604-83-0x00000000776BF000-0x00000000776C0000-memory.dmp

Filesize
4KB

Download