Analysis
-
max time kernel
91s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 14:22
Static task
static1
Behavioral task
behavioral1
Sample
1ba0d79e8bf2c95f62ad73aa4602bfb4_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
1ba0d79e8bf2c95f62ad73aa4602bfb4_JaffaCakes118.exe
-
Size
124KB
-
MD5
1ba0d79e8bf2c95f62ad73aa4602bfb4
-
SHA1
9026519e8d82470409dce9bb10d7dd7799b2b52c
-
SHA256
ad0f8619d5cc2ee7ceb2a679be0cf7aa3766fb08b23e1ef7f20568bada179304
-
SHA512
29aa37154cb4a89dd4abca16b088aeff03f4a62e9234f8e72b8d0ba494395ccee264e287e79223b06a9d7248ca2108fdddb1f02162401cbbd8e33bff4a187617
-
SSDEEP
1536:ZVZnxm6MG9xgfrvEaoiT/GyphjXDYjKwttoswRmhApEH5y:pnxwgxgfR/DVG7wBpEZy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
WaterMark.exepid process 1220 WaterMark.exe -
Processes:
resource yara_rule behavioral2/memory/3816-3-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3816-9-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3816-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1220-25-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1220-30-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1220-29-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral2/memory/3816-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3816-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3816-4-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3816-2-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1220-36-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
1ba0d79e8bf2c95f62ad73aa4602bfb4_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px5A84.tmp 1ba0d79e8bf2c95f62ad73aa4602bfb4_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe 1ba0d79e8bf2c95f62ad73aa4602bfb4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe 1ba0d79e8bf2c95f62ad73aa4602bfb4_JaffaCakes118.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2288 3788 WerFault.exe svchost.exe -
Processes:
IEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116226" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "912001580" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "912001580" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116226" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116226" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{61F9A4D6-37B5-11EF-9519-62C35996CAED} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "912469668" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{61FE686E-37B5-11EF-9519-62C35996CAED} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426608739" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116226" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31116226" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "914344744" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "914188406" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31116226" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "912469668" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
WaterMark.exepid process 1220 WaterMark.exe 1220 WaterMark.exe 1220 WaterMark.exe 1220 WaterMark.exe 1220 WaterMark.exe 1220 WaterMark.exe 1220 WaterMark.exe 1220 WaterMark.exe 1220 WaterMark.exe 1220 WaterMark.exe 1220 WaterMark.exe 1220 WaterMark.exe 1220 WaterMark.exe 1220 WaterMark.exe 1220 WaterMark.exe 1220 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WaterMark.exedescription pid process Token: SeDebugPrivilege 1220 WaterMark.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 644 iexplore.exe 1820 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 1820 iexplore.exe 1820 iexplore.exe 644 iexplore.exe 644 iexplore.exe 2656 IEXPLORE.EXE 2656 IEXPLORE.EXE 4620 IEXPLORE.EXE 4620 IEXPLORE.EXE 2656 IEXPLORE.EXE 2656 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
1ba0d79e8bf2c95f62ad73aa4602bfb4_JaffaCakes118.exeWaterMark.exepid process 3816 1ba0d79e8bf2c95f62ad73aa4602bfb4_JaffaCakes118.exe 1220 WaterMark.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
1ba0d79e8bf2c95f62ad73aa4602bfb4_JaffaCakes118.exeWaterMark.exeiexplore.exeiexplore.exedescription pid process target process PID 3816 wrote to memory of 1220 3816 1ba0d79e8bf2c95f62ad73aa4602bfb4_JaffaCakes118.exe WaterMark.exe PID 3816 wrote to memory of 1220 3816 1ba0d79e8bf2c95f62ad73aa4602bfb4_JaffaCakes118.exe WaterMark.exe PID 3816 wrote to memory of 1220 3816 1ba0d79e8bf2c95f62ad73aa4602bfb4_JaffaCakes118.exe WaterMark.exe PID 1220 wrote to memory of 3788 1220 WaterMark.exe svchost.exe PID 1220 wrote to memory of 3788 1220 WaterMark.exe svchost.exe PID 1220 wrote to memory of 3788 1220 WaterMark.exe svchost.exe PID 1220 wrote to memory of 3788 1220 WaterMark.exe svchost.exe PID 1220 wrote to memory of 3788 1220 WaterMark.exe svchost.exe PID 1220 wrote to memory of 3788 1220 WaterMark.exe svchost.exe PID 1220 wrote to memory of 3788 1220 WaterMark.exe svchost.exe PID 1220 wrote to memory of 3788 1220 WaterMark.exe svchost.exe PID 1220 wrote to memory of 3788 1220 WaterMark.exe svchost.exe PID 1220 wrote to memory of 1820 1220 WaterMark.exe iexplore.exe PID 1220 wrote to memory of 1820 1220 WaterMark.exe iexplore.exe PID 1220 wrote to memory of 644 1220 WaterMark.exe iexplore.exe PID 1220 wrote to memory of 644 1220 WaterMark.exe iexplore.exe PID 644 wrote to memory of 2656 644 iexplore.exe IEXPLORE.EXE PID 644 wrote to memory of 2656 644 iexplore.exe IEXPLORE.EXE PID 644 wrote to memory of 2656 644 iexplore.exe IEXPLORE.EXE PID 1820 wrote to memory of 4620 1820 iexplore.exe IEXPLORE.EXE PID 1820 wrote to memory of 4620 1820 iexplore.exe IEXPLORE.EXE PID 1820 wrote to memory of 4620 1820 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ba0d79e8bf2c95f62ad73aa4602bfb4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1ba0d79e8bf2c95f62ad73aa4602bfb4_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 2044⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:644 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3788 -ip 37881⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
124KB
MD51ba0d79e8bf2c95f62ad73aa4602bfb4
SHA19026519e8d82470409dce9bb10d7dd7799b2b52c
SHA256ad0f8619d5cc2ee7ceb2a679be0cf7aa3766fb08b23e1ef7f20568bada179304
SHA51229aa37154cb4a89dd4abca16b088aeff03f4a62e9234f8e72b8d0ba494395ccee264e287e79223b06a9d7248ca2108fdddb1f02162401cbbd8e33bff4a187617
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5df3b51cc5929f3af03350336b1afc568
SHA148453c44facbbea059f9da8565cf25b1c2cb9ce0
SHA2562375353160c5f8c4cadce5954ff4a7cc5b9c403890f0404791ff85c8ec0dd748
SHA512d8eaa0761def6d74462748aa794198b5f32fa593662bf373c81e1d300f3f76ecc1c723cef52774caa6482527f26524fd2677a5e2253285cb6d0984b044347e8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD57416dad90e8cb201018cc71b3706cab4
SHA1bf238898faa12cb258f0566c8de7617dc4b282f8
SHA256ab2d708ddfe22bc51d2a6220378f191cda1c750f56fc634652b3dd7d8aef885b
SHA5128737e01ed6be26160bf58c4449f0805663ef76e457601413bfba90d1f9facfbdb9a0e6d684d0e72f930f8999e2d9d66d8b043f9fa6705faed44b29a0c7a27fbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD59876ad1bf13da9dbe7e2d0e8cc59a251
SHA18ff0d5436909a6d691497fabfa27d3d3d399bf42
SHA25675256b528f3a75668a76134050ec4456369d233a23e572053dc133a73e9afee5
SHA5123a27102dc4e677b9bb72f1632c43b3db719129f38080142b0ef6e3faeefa9f277d253dfdf80b65fc22d75badab893bf50441a60446d1b3fd810756564d77b2d0
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{61F9A4D6-37B5-11EF-9519-62C35996CAED}.datFilesize
3KB
MD5bf3873804997342a137490a87366eacf
SHA1791920c203a0412a0a41f4d5dd96a1ffe2a09e48
SHA25603becbc344758b3ab8a423a5cdbf8d61a27794c7f8a2e425279d5bd8b15eeb46
SHA5122b89aa1505f7131361e7a12063bce0a795991e4c7ec02360d054a7818d1741167a74b17d6b9a1e94304707bb5a1da3d70d2bd0646f982bd5b2d9ca49836edd16
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{61FE686E-37B5-11EF-9519-62C35996CAED}.datFilesize
5KB
MD54f74540b7d9e630777c1412366248b4a
SHA1350d3dad69dff7979f2bfb1b6a1d850ba78ebbd3
SHA256284369a1923b8b04637dd4b633021bf1625168dc821c3eaac198b2fa4bdce812
SHA512d4141fe2915cf50a90d04e59d707fc0184d434013a219f7be87c473c1166b468f5a20900ed9ee652b74ae9ee1cf5770f28a628849bbfbd28f7748b3bf9208fe1
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verDD12.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VLW1SL5J\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
memory/1220-33-0x0000000077342000-0x0000000077343000-memory.dmpFilesize
4KB
-
memory/1220-32-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/1220-36-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1220-30-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1220-31-0x0000000077342000-0x0000000077343000-memory.dmpFilesize
4KB
-
memory/1220-29-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1220-25-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1220-22-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/3788-28-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/3788-27-0x0000000000420000-0x0000000000421000-memory.dmpFilesize
4KB
-
memory/3816-23-0x0000000000416000-0x0000000000420000-memory.dmpFilesize
40KB
-
memory/3816-2-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3816-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3816-0-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3816-24-0x0000000000401000-0x0000000000416000-memory.dmpFilesize
84KB
-
memory/3816-6-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3816-4-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3816-8-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3816-9-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3816-7-0x0000000002C50000-0x0000000002C51000-memory.dmpFilesize
4KB
-
memory/3816-3-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3816-1-0x0000000000401000-0x0000000000402000-memory.dmpFilesize
4KB