Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 20:53
Static task
static1
Behavioral task
behavioral1
Sample
21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
NsResize.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
NsResize.dll
Resource
win10v2004-20240419-en
General
-
Target
21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe
-
Size
241KB
-
MD5
21af27ba9ac8e0dc4124c57f82b7e514
-
SHA1
b653f8672df111229959112ba7d5c710f94dc578
-
SHA256
bdffd754d6462d9db91edb3d7e65cab81279265e28054564e47773e0def807d6
-
SHA512
ff90faab3d7a584fbedb2216ed7cc1101320bec809b91d4991c89202e1b634841383ac547a6c9bb1bf763d1c5534d0bc98b0ed2d7ebeb47f169e5bd938b706fd
-
SSDEEP
6144:Kn/L+GOmXqA8VtR4ZhSTpkdpNRauPmuRfV/A/ETrSQ1tuY:0zOmXqActRYhgk5Ra6mkflTrSM
Malware Config
Extracted
C:\Users\Admin\Documents\OneNote Notebooks\README.hta
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Contacts a large (531) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe -
Loads dropped DLL 4 IoCs
Processes:
21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exepid process 4336 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 4336 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 4336 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 4336 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpD954.bmp" 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exedescription pid process target process PID 4336 set thread context of 3720 4336 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe -
Drops file in Program Files directory 6 IoCs
Processes:
21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BLANK.ONE 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\PLANNERS.ONE 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\ACADEMIC.ONE 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BUSINESS.ONE 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\README.hta 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\DESIGNER.ONE 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2432 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exepid process 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exeWMIC.exevssvc.exeAUDIODG.EXEtaskkill.exedescription pid process Token: SeDebugPrivilege 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 4872 WMIC.exe Token: SeSecurityPrivilege 4872 WMIC.exe Token: SeTakeOwnershipPrivilege 4872 WMIC.exe Token: SeLoadDriverPrivilege 4872 WMIC.exe Token: SeSystemProfilePrivilege 4872 WMIC.exe Token: SeSystemtimePrivilege 4872 WMIC.exe Token: SeProfSingleProcessPrivilege 4872 WMIC.exe Token: SeIncBasePriorityPrivilege 4872 WMIC.exe Token: SeCreatePagefilePrivilege 4872 WMIC.exe Token: SeBackupPrivilege 4872 WMIC.exe Token: SeRestorePrivilege 4872 WMIC.exe Token: SeShutdownPrivilege 4872 WMIC.exe Token: SeDebugPrivilege 4872 WMIC.exe Token: SeSystemEnvironmentPrivilege 4872 WMIC.exe Token: SeRemoteShutdownPrivilege 4872 WMIC.exe Token: SeUndockPrivilege 4872 WMIC.exe Token: SeManageVolumePrivilege 4872 WMIC.exe Token: 33 4872 WMIC.exe Token: 34 4872 WMIC.exe Token: 35 4872 WMIC.exe Token: 36 4872 WMIC.exe Token: SeIncreaseQuotaPrivilege 4872 WMIC.exe Token: SeSecurityPrivilege 4872 WMIC.exe Token: SeTakeOwnershipPrivilege 4872 WMIC.exe Token: SeLoadDriverPrivilege 4872 WMIC.exe Token: SeSystemProfilePrivilege 4872 WMIC.exe Token: SeSystemtimePrivilege 4872 WMIC.exe Token: SeProfSingleProcessPrivilege 4872 WMIC.exe Token: SeIncBasePriorityPrivilege 4872 WMIC.exe Token: SeCreatePagefilePrivilege 4872 WMIC.exe Token: SeBackupPrivilege 4872 WMIC.exe Token: SeRestorePrivilege 4872 WMIC.exe Token: SeShutdownPrivilege 4872 WMIC.exe Token: SeDebugPrivilege 4872 WMIC.exe Token: SeSystemEnvironmentPrivilege 4872 WMIC.exe Token: SeRemoteShutdownPrivilege 4872 WMIC.exe Token: SeUndockPrivilege 4872 WMIC.exe Token: SeManageVolumePrivilege 4872 WMIC.exe Token: 33 4872 WMIC.exe Token: 34 4872 WMIC.exe Token: 35 4872 WMIC.exe Token: 36 4872 WMIC.exe Token: SeBackupPrivilege 1940 vssvc.exe Token: SeRestorePrivilege 1940 vssvc.exe Token: SeAuditPrivilege 1940 vssvc.exe Token: 33 3924 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3924 AUDIODG.EXE Token: SeDebugPrivilege 2432 taskkill.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.execmd.execmd.exedescription pid process target process PID 4336 wrote to memory of 3720 4336 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe PID 4336 wrote to memory of 3720 4336 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe PID 4336 wrote to memory of 3720 4336 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe PID 4336 wrote to memory of 3720 4336 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe PID 4336 wrote to memory of 3720 4336 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe PID 4336 wrote to memory of 3720 4336 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe PID 4336 wrote to memory of 3720 4336 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe PID 4336 wrote to memory of 3720 4336 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe PID 4336 wrote to memory of 3720 4336 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe PID 4336 wrote to memory of 3720 4336 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe PID 3720 wrote to memory of 4416 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe cmd.exe PID 3720 wrote to memory of 4416 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe cmd.exe PID 4416 wrote to memory of 4872 4416 cmd.exe WMIC.exe PID 4416 wrote to memory of 4872 4416 cmd.exe WMIC.exe PID 3720 wrote to memory of 4024 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe mshta.exe PID 3720 wrote to memory of 4024 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe mshta.exe PID 3720 wrote to memory of 4024 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe mshta.exe PID 3720 wrote to memory of 1284 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe cmd.exe PID 3720 wrote to memory of 1284 3720 21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe cmd.exe PID 1284 wrote to memory of 2432 1284 cmd.exe taskkill.exe PID 1284 wrote to memory of 2432 1284 cmd.exe taskkill.exe PID 1284 wrote to memory of 3648 1284 cmd.exe PING.EXE PID 1284 wrote to memory of 3648 1284 cmd.exe PING.EXE -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic.exe shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im "21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3b4 0x40c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsc4017.tmp\System.dllFilesize
11KB
MD5a436db0c473a087eb61ff5c53c34ba27
SHA165ea67e424e75f5065132b539c8b2eda88aa0506
SHA25675ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
-
C:\Users\Admin\AppData\Roaming\Addendum.HFilesize
189KB
MD579382b8ded97b3c296d13ec3174627c4
SHA10941ac3bcf63768986fc247587edf7b93ff14137
SHA25698d3bbb508f1e7dc27acc7820f91b6dfb4602bedaa76da8bca49ad33150524db
SHA51276eee44a156dc7183febf03978df9f378a2cbb873f5f70c9ed034dd78d07bae0ada72f022c1d07e9b828a9d14eeff7be994ecb77380ae91180ced57621a6eb5a
-
C:\Users\Admin\AppData\Roaming\NsResize.dllFilesize
28KB
MD5d53bd2d5591a78ea15b3bd59e2652bd6
SHA140968bcae13ee63469d241200679b25dfa5fdd4c
SHA2561734bceb77dab6739b80575fd7ee87c437327d8eb147339e1d93b7d3235c5394
SHA512c07bbab95251f16ac4b1c03e0324792b35badd111cced2e5c8e0de467226e572edfe5ca6e528c3494664f2569774f6a422806f54883cc2ef3726e21f4a011f5b
-
C:\Users\Admin\AppData\Roaming\article.appendix.title.properties.xmlFilesize
1KB
MD5adb1a285a2b926f98c062fbb74e1e992
SHA11f9799a61072673042a1a3da0fdf3fa93cf10f90
SHA2564ba4637bffa741ba5619c3de97b6c209b5a9deb330385efc7a588492a98b7b45
SHA512aa65628e34601645dfcdcb1f5f0347ae84555bd1a99432d4c25a50044dae932385bfa1f50551f6577d184de684f9264743facb53f4aa2e46bdfeff5c85bc6bd7
-
C:\Users\Admin\AppData\Roaming\btn-next-static.pngFilesize
3KB
MD5e3d0209f09f8349579195ceac89420bd
SHA1432bf86c5a8d68a775db1af0b29dcca92f11247d
SHA2562556a483b1557bc59f0d40ce87162d692e2e19d7fe8bef5740efc46153f63b92
SHA512d1dfcc9ccd6fc66c3a8f4f4e568a56401ead530fadd83978283e2bdbb71ca2ea04df566a732c9a8be33bcd3166ef6fa81a1e8d3a3176892cae6b5001b119cd7e
-
C:\Users\Admin\Documents\OneNote Notebooks\README.htaFilesize
61KB
MD5929cbd3b1533c579dee3803d8cea935a
SHA14bc02a8750dfe028ef3f82dee144432d9d523c96
SHA2566e4316d7fdfcdac224e5052c4b61a4e8d94a1ef68848d5f59c31098e659c89a2
SHA512341e5471a4410ecf7943654472fecab64a06fdbe07090d37323049c57c71e7a1028cbbdde6b4c763ff8134a61cc95a7c7dd358efbc8631d3966d17f6b562e898
-
memory/3720-710-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-719-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-40-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-39-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-33-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-32-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-27-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-369-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-26-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-707-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-24-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-713-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-716-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-34-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-722-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-725-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-728-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-731-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-734-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-737-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-740-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-743-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-746-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-749-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-752-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-759-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3720-764-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB