Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 13:07
Static task
static1
Behavioral task
behavioral1
Sample
1a3c1d02d0e6e30be07bead6ac817401_JaffaCakes118.dll
Resource
win7-20240419-en
General
-
Target
1a3c1d02d0e6e30be07bead6ac817401_JaffaCakes118.dll
-
Size
337KB
-
MD5
1a3c1d02d0e6e30be07bead6ac817401
-
SHA1
ce09a71cc8551e3b93553afbd03c5efa078ecc2a
-
SHA256
2d8d24f9d8137dd1518b80e11bcaac699dfa7116bed817cbca4eefe6601d7b37
-
SHA512
9fc3aaf378bad9174348bce40d3ecdddb641e5321052b38be5708916304bdd993217c160803633bc14e7906d9e1e73840aada88e27fba2fb9e8841ca74372f88
-
SSDEEP
6144:cN0yr1sO/wIKS0FKtOT/OrDtgUi0uvQee7Qee/0QeesQeeglQeekQeeDC7M3HCR7:sG6wndYtamDSU1MHCRflZ
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 4400 regsvr32mgr.exe 468 WaterMark.exe -
Processes:
resource yara_rule behavioral2/memory/4400-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4400-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4400-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/468-31-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/468-28-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/468-27-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4400-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4400-9-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4400-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4400-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/468-38-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
Processes:
regsvr32.exedescription ioc process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe -
Drops file in Program Files directory 3 IoCs
Processes:
regsvr32mgr.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px37C9.tmp regsvr32mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe regsvr32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe regsvr32mgr.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4888 64 WerFault.exe svchost.exe -
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1084446824" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1086634330" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115612" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426345045" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1084290730" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115612" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115612" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1084290730" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1084446824" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115612" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1086634330" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115612" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6C40F32E-354F-11EF-8383-56995CF5AA0C} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115612" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115612" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6C4355F9-354F-11EF-8383-56995CF5AA0C} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1086790223" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1086790223" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115612" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Modifies registry class 4 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58F1580-0DF3-401C-93B1-2D9DDA61CF04}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58F1580-0DF3-401C-93B1-2D9DDA61CF04} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58F1580-0DF3-401C-93B1-2D9DDA61CF04}\1.0 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
WaterMark.exepid process 468 WaterMark.exe 468 WaterMark.exe 468 WaterMark.exe 468 WaterMark.exe 468 WaterMark.exe 468 WaterMark.exe 468 WaterMark.exe 468 WaterMark.exe 468 WaterMark.exe 468 WaterMark.exe 468 WaterMark.exe 468 WaterMark.exe 468 WaterMark.exe 468 WaterMark.exe 468 WaterMark.exe 468 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WaterMark.exedescription pid process Token: SeDebugPrivilege 468 WaterMark.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 4692 iexplore.exe 1244 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 1244 iexplore.exe 1244 iexplore.exe 4692 iexplore.exe 4692 iexplore.exe 748 IEXPLORE.EXE 748 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 4400 regsvr32mgr.exe 468 WaterMark.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32mgr.exeWaterMark.exeiexplore.exeiexplore.exedescription pid process target process PID 3088 wrote to memory of 620 3088 regsvr32.exe regsvr32.exe PID 3088 wrote to memory of 620 3088 regsvr32.exe regsvr32.exe PID 3088 wrote to memory of 620 3088 regsvr32.exe regsvr32.exe PID 620 wrote to memory of 4400 620 regsvr32.exe regsvr32mgr.exe PID 620 wrote to memory of 4400 620 regsvr32.exe regsvr32mgr.exe PID 620 wrote to memory of 4400 620 regsvr32.exe regsvr32mgr.exe PID 4400 wrote to memory of 468 4400 regsvr32mgr.exe WaterMark.exe PID 4400 wrote to memory of 468 4400 regsvr32mgr.exe WaterMark.exe PID 4400 wrote to memory of 468 4400 regsvr32mgr.exe WaterMark.exe PID 468 wrote to memory of 64 468 WaterMark.exe svchost.exe PID 468 wrote to memory of 64 468 WaterMark.exe svchost.exe PID 468 wrote to memory of 64 468 WaterMark.exe svchost.exe PID 468 wrote to memory of 64 468 WaterMark.exe svchost.exe PID 468 wrote to memory of 64 468 WaterMark.exe svchost.exe PID 468 wrote to memory of 64 468 WaterMark.exe svchost.exe PID 468 wrote to memory of 64 468 WaterMark.exe svchost.exe PID 468 wrote to memory of 64 468 WaterMark.exe svchost.exe PID 468 wrote to memory of 64 468 WaterMark.exe svchost.exe PID 468 wrote to memory of 1244 468 WaterMark.exe iexplore.exe PID 468 wrote to memory of 1244 468 WaterMark.exe iexplore.exe PID 468 wrote to memory of 4692 468 WaterMark.exe iexplore.exe PID 468 wrote to memory of 4692 468 WaterMark.exe iexplore.exe PID 4692 wrote to memory of 748 4692 iexplore.exe IEXPLORE.EXE PID 4692 wrote to memory of 748 4692 iexplore.exe IEXPLORE.EXE PID 4692 wrote to memory of 748 4692 iexplore.exe IEXPLORE.EXE PID 1244 wrote to memory of 2776 1244 iexplore.exe IEXPLORE.EXE PID 1244 wrote to memory of 2776 1244 iexplore.exe IEXPLORE.EXE PID 1244 wrote to memory of 2776 1244 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1a3c1d02d0e6e30be07bead6ac817401_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1a3c1d02d0e6e30be07bead6ac817401_JaffaCakes118.dll2⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 2046⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1244 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4692 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 64 -ip 641⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6C40F32E-354F-11EF-8383-56995CF5AA0C}.datFilesize
5KB
MD57d0cd85a9f6d34496bbd3a73c39b1e1a
SHA16f17e157f1f8b70b3a28585911ba910182334af0
SHA256e70d7986db619bfcbe4c85d4bd0ce83063c93f57d6588520cd222b86d2a9a560
SHA5128ee218fe428f1f26e8b2f1268f6b5a39ee2533050d480206eaacaffdc8d9dd5366a54c57a27a96655f7715f25695b6a95bc678f01c5f9d4a06be5bf6b1a05a59
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6C4355F9-354F-11EF-8383-56995CF5AA0C}.datFilesize
3KB
MD5ad1bf5b7d79232fc9b315064a0b95ae2
SHA111a9a59efe584246c9371675f5731cfd88f1fde4
SHA256bc11c538f58d1480d0fdab80233493cb6fd2254da53e1210fea2e1abe8f04417
SHA512e37b40600a7b3d1fb4f1fd141ec814774ae43ec377db14ddc303bcf5378e9161efae2b6be237853bd5b85593fbc16fbd4af49f1afcae2f81cdd62ce8f88f9f38
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verBA28.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Windows\SysWOW64\regsvr32mgr.exeFilesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
memory/64-33-0x0000000000F70000-0x0000000000F71000-memory.dmpFilesize
4KB
-
memory/64-32-0x0000000000F90000-0x0000000000F91000-memory.dmpFilesize
4KB
-
memory/468-34-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/468-29-0x0000000077622000-0x0000000077623000-memory.dmpFilesize
4KB
-
memory/468-31-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/468-38-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/468-28-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/468-27-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/468-26-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/468-35-0x0000000077622000-0x0000000077623000-memory.dmpFilesize
4KB
-
memory/620-0-0x0000000074FA0000-0x0000000074FF7000-memory.dmpFilesize
348KB
-
memory/4400-7-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4400-6-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4400-9-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4400-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4400-11-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4400-10-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4400-15-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4400-8-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4400-5-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB