Analysis
-
max time kernel
135s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
02-07-2024 08:13
Static task
static1
Behavioral task
behavioral1
Sample
1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118.exe
-
Size
186KB
-
MD5
1e98591806468a3bc9d68e7fa659a3e2
-
SHA1
af379098cad3f17e223ecd1aa8a026f927eda1bd
-
SHA256
9246aaa4119ab78c06e12f3cba6da3941c641b4a132a36b8fbcf45372ea08f56
-
SHA512
d03c238651a9f8e9309e46fb9131ff4e2b44b16668c43a5e9f9f12e574922eaaf2ed0ecf6ac382de5d53a91450b5b5ecb1adbdeb7f7e2b07dffa71826fb0faf2
-
SSDEEP
3072:knxwgxgfR/DVG7wBpEfdPbzIcJabw0ejQ7sDz1RNnF:4+xDVG0BpjcJa80mQ7sX1RJF
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118mgr.exeWaterMark.exepid process 2752 1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118mgr.exe 5064 WaterMark.exe -
Processes:
resource yara_rule behavioral2/memory/2752-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2752-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2752-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2752-26-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2656-20-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2752-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2752-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2752-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/5064-39-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/5064-40-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/5064-49-0x0000000000400000-0x000000000044E000-memory.dmp upx behavioral2/memory/5064-51-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
Processes:
1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118.exe1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118mgr.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px44BA.tmp 1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe 1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\px44BA.tmp 1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe 1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe 1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118mgr.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4280 552 WerFault.exe svchost.exe -
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3264486706" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31116375" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3264330949" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31116375" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3277612028" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116375" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426672969" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116375" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3278549863" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{EE282F74-384A-11EF-9D11-56995CF5AA0C} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116375" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{EE2CF429-384A-11EF-9D11-56995CF5AA0C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3264486706" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3264330949" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116375" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
WaterMark.exepid process 5064 WaterMark.exe 5064 WaterMark.exe 5064 WaterMark.exe 5064 WaterMark.exe 5064 WaterMark.exe 5064 WaterMark.exe 5064 WaterMark.exe 5064 WaterMark.exe 5064 WaterMark.exe 5064 WaterMark.exe 5064 WaterMark.exe 5064 WaterMark.exe 5064 WaterMark.exe 5064 WaterMark.exe 5064 WaterMark.exe 5064 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WaterMark.exedescription pid process Token: SeDebugPrivilege 5064 WaterMark.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 1624 iexplore.exe 4300 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 4300 iexplore.exe 1624 iexplore.exe 4300 iexplore.exe 1624 iexplore.exe 3160 IEXPLORE.EXE 3160 IEXPLORE.EXE 4956 IEXPLORE.EXE 4956 IEXPLORE.EXE 3160 IEXPLORE.EXE 3160 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 3 IoCs
Processes:
1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118mgr.exe1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118.exeWaterMark.exepid process 2752 1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118mgr.exe 2656 1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118.exe 5064 WaterMark.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118.exe1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118mgr.exeWaterMark.exeiexplore.exeiexplore.exedescription pid process target process PID 2656 wrote to memory of 2752 2656 1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118.exe 1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118mgr.exe PID 2656 wrote to memory of 2752 2656 1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118.exe 1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118mgr.exe PID 2656 wrote to memory of 2752 2656 1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118.exe 1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118mgr.exe PID 2752 wrote to memory of 5064 2752 1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118mgr.exe WaterMark.exe PID 2752 wrote to memory of 5064 2752 1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118mgr.exe WaterMark.exe PID 2752 wrote to memory of 5064 2752 1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118mgr.exe WaterMark.exe PID 5064 wrote to memory of 552 5064 WaterMark.exe svchost.exe PID 5064 wrote to memory of 552 5064 WaterMark.exe svchost.exe PID 5064 wrote to memory of 552 5064 WaterMark.exe svchost.exe PID 5064 wrote to memory of 552 5064 WaterMark.exe svchost.exe PID 5064 wrote to memory of 552 5064 WaterMark.exe svchost.exe PID 5064 wrote to memory of 552 5064 WaterMark.exe svchost.exe PID 5064 wrote to memory of 552 5064 WaterMark.exe svchost.exe PID 5064 wrote to memory of 552 5064 WaterMark.exe svchost.exe PID 5064 wrote to memory of 552 5064 WaterMark.exe svchost.exe PID 5064 wrote to memory of 1624 5064 WaterMark.exe iexplore.exe PID 5064 wrote to memory of 1624 5064 WaterMark.exe iexplore.exe PID 5064 wrote to memory of 4300 5064 WaterMark.exe iexplore.exe PID 5064 wrote to memory of 4300 5064 WaterMark.exe iexplore.exe PID 4300 wrote to memory of 4956 4300 iexplore.exe IEXPLORE.EXE PID 4300 wrote to memory of 4956 4300 iexplore.exe IEXPLORE.EXE PID 4300 wrote to memory of 4956 4300 iexplore.exe IEXPLORE.EXE PID 1624 wrote to memory of 3160 1624 iexplore.exe IEXPLORE.EXE PID 1624 wrote to memory of 3160 1624 iexplore.exe IEXPLORE.EXE PID 1624 wrote to memory of 3160 1624 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118mgr.exeC:\Users\Admin\AppData\Local\Temp\1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118mgr.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 2045⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1624 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4300 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 552 -ip 5521⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EE282F74-384A-11EF-9D11-56995CF5AA0C}.datFilesize
5KB
MD576a495a1035dca0b6db6d38b5fbe50b0
SHA1de2bd81d80ee01983842007c4862b8064bfab450
SHA256be57100e5c43fc34a81ca4df794a2ce8efb006a49bc9bc237a63e98f94e75516
SHA51297de1b69e9c3a9cdf9d66a8fd468aa6a0521a673639ad14f2fa0d573a2b6356695410120b5040c810afce24a089c9f889f7fdcc9a703474d35ddba4521366f40
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EE2CF429-384A-11EF-9D11-56995CF5AA0C}.datFilesize
3KB
MD5544ab0570b61675c13c88125ea66372e
SHA102ec4a58f5d8ceba4bf246268062b6961124f734
SHA2569a3e1f6d08b3866e90ff3c1c729f53ef4074f990568c652b5d2e1038e91aa44c
SHA51295d49882686a08a15cdf18875f63120c58ea6cb7c85ec8e062e4177d64d0cd346d28839ce4734ea1c3ca42571e43af0f0db71ea56e862235c567fc8ac5e4141b
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verC786.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQACG5HD\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\1e98591806468a3bc9d68e7fa659a3e2_JaffaCakes118mgr.exeFilesize
92KB
MD596cff787d9cd572c465811f1b072e852
SHA1f41dc6bbaa9e613f255484a125d83fa1b336148c
SHA2568735197d71a2a4c3894f43e1461e9ae4ccd4ca5c861332ae3c79e02f48143de9
SHA51219789b2071f8e04e186135c6d2495ece4e69da19c1cf748e6619ed6fcbfca36e6698cce5f0dc10bc7d81847be2eb36ea3f2b9504d26088ac8b9903e6506394ff
-
memory/552-43-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/552-44-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/2656-20-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2656-23-0x0000000000416000-0x0000000000420000-memory.dmpFilesize
40KB
-
memory/2656-0-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2656-24-0x0000000000401000-0x0000000000416000-memory.dmpFilesize
84KB
-
memory/2752-26-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2752-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2752-14-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2752-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2752-6-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2752-17-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2752-7-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2752-8-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2752-4-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/5064-30-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/5064-45-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/5064-46-0x0000000077A92000-0x0000000077A93000-memory.dmpFilesize
4KB
-
memory/5064-37-0x0000000000430000-0x0000000000431000-memory.dmpFilesize
4KB
-
memory/5064-40-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/5064-49-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/5064-51-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/5064-41-0x0000000077A92000-0x0000000077A93000-memory.dmpFilesize
4KB
-
memory/5064-39-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB