Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 12:02
Static task
static1
Behavioral task
behavioral1
Sample
9a98bae4321155184d55065a53b76236_JaffaCakes118.msi
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9a98bae4321155184d55065a53b76236_JaffaCakes118.msi
Resource
win10v2004-20240508-en
General
-
Target
9a98bae4321155184d55065a53b76236_JaffaCakes118.msi
-
Size
2.0MB
-
MD5
9a98bae4321155184d55065a53b76236
-
SHA1
7abf0f142b3f9ca0e3508eeb14a0a752007913fd
-
SHA256
550df7471a02ec62986380b84708162fa0dca4bf4e4eef643b1625a512a92c2a
-
SHA512
744ab49e4a2c7ecf0ab84e7716a72e2ca7f7be6693e517fbadd5cb183f89532565677feaec09b906548e1c1c4593d80b587682694e20843d8e47a6c928adc2f6
-
SSDEEP
49152:z6G3sBlgF4UpsUzD1PPxSc+ic4AuJZDsz5MY7os0f54HnT:mG3c2hsUzDZPQScXunDsz+Yk354Hn
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/2120-89-0x00000000032B0000-0x00000000032BC000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SynTPHelper.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SynTPHelp = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\History\\SynTPHelper.exe -boot" SynTPHelper.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
IMSynTPHelper.exeSynTPHelp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation IMSynTPHelper.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation SynTPHelp.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SynTPHelper.exedescription pid process target process PID 2120 set thread context of 3220 2120 SynTPHelper.exe InstallUtil.exe -
Drops file in Windows directory 11 IoCs
Processes:
msiexec.exeexpand.exedescription ioc process File opened for modification C:\Windows\Installer\MSIABD1.tmp msiexec.exe File created C:\Windows\Installer\e57829d.msi msiexec.exe File opened for modification C:\Windows\Installer\e57829d.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{58568EB6-23A1-404A-9945-088F534449B8} msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log expand.exe File opened for modification C:\Windows\LOGS\DPX\setuperr.log expand.exe File opened for modification C:\Windows\Installer\MSIAC01.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI8359.tmp msiexec.exe -
Executes dropped EXE 3 IoCs
Processes:
IMSynTPHelper.exeSynTPHelp.exeSynTPHelper.exepid process 2464 IMSynTPHelper.exe 1612 SynTPHelp.exe 2120 SynTPHelper.exe -
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exeMsiExec.exepid process 4140 MsiExec.exe 5048 MsiExec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003f3ccc8c3b3921e10000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003f3ccc8c0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003f3ccc8c000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3f3ccc8c000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003f3ccc8c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
Processes:
msiexec.exedescription ioc process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 4644 msiexec.exe 4644 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
InstallUtil.exepid process 3220 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exesrtasks.exeIMSynTPHelper.exeSynTPHelp.exeSynTPHelper.exedescription pid process Token: SeShutdownPrivilege 2648 msiexec.exe Token: SeIncreaseQuotaPrivilege 2648 msiexec.exe Token: SeSecurityPrivilege 4644 msiexec.exe Token: SeCreateTokenPrivilege 2648 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2648 msiexec.exe Token: SeLockMemoryPrivilege 2648 msiexec.exe Token: SeIncreaseQuotaPrivilege 2648 msiexec.exe Token: SeMachineAccountPrivilege 2648 msiexec.exe Token: SeTcbPrivilege 2648 msiexec.exe Token: SeSecurityPrivilege 2648 msiexec.exe Token: SeTakeOwnershipPrivilege 2648 msiexec.exe Token: SeLoadDriverPrivilege 2648 msiexec.exe Token: SeSystemProfilePrivilege 2648 msiexec.exe Token: SeSystemtimePrivilege 2648 msiexec.exe Token: SeProfSingleProcessPrivilege 2648 msiexec.exe Token: SeIncBasePriorityPrivilege 2648 msiexec.exe Token: SeCreatePagefilePrivilege 2648 msiexec.exe Token: SeCreatePermanentPrivilege 2648 msiexec.exe Token: SeBackupPrivilege 2648 msiexec.exe Token: SeRestorePrivilege 2648 msiexec.exe Token: SeShutdownPrivilege 2648 msiexec.exe Token: SeDebugPrivilege 2648 msiexec.exe Token: SeAuditPrivilege 2648 msiexec.exe Token: SeSystemEnvironmentPrivilege 2648 msiexec.exe Token: SeChangeNotifyPrivilege 2648 msiexec.exe Token: SeRemoteShutdownPrivilege 2648 msiexec.exe Token: SeUndockPrivilege 2648 msiexec.exe Token: SeSyncAgentPrivilege 2648 msiexec.exe Token: SeEnableDelegationPrivilege 2648 msiexec.exe Token: SeManageVolumePrivilege 2648 msiexec.exe Token: SeImpersonatePrivilege 2648 msiexec.exe Token: SeCreateGlobalPrivilege 2648 msiexec.exe Token: SeBackupPrivilege 3032 vssvc.exe Token: SeRestorePrivilege 3032 vssvc.exe Token: SeAuditPrivilege 3032 vssvc.exe Token: SeBackupPrivilege 4644 msiexec.exe Token: SeRestorePrivilege 4644 msiexec.exe Token: SeRestorePrivilege 4644 msiexec.exe Token: SeTakeOwnershipPrivilege 4644 msiexec.exe Token: SeRestorePrivilege 4644 msiexec.exe Token: SeTakeOwnershipPrivilege 4644 msiexec.exe Token: SeBackupPrivilege 4348 srtasks.exe Token: SeRestorePrivilege 4348 srtasks.exe Token: SeSecurityPrivilege 4348 srtasks.exe Token: SeTakeOwnershipPrivilege 4348 srtasks.exe Token: SeBackupPrivilege 4348 srtasks.exe Token: SeRestorePrivilege 4348 srtasks.exe Token: SeSecurityPrivilege 4348 srtasks.exe Token: SeTakeOwnershipPrivilege 4348 srtasks.exe Token: SeDebugPrivilege 2464 IMSynTPHelper.exe Token: 33 2464 IMSynTPHelper.exe Token: SeIncBasePriorityPrivilege 2464 IMSynTPHelper.exe Token: SeRestorePrivilege 4644 msiexec.exe Token: SeTakeOwnershipPrivilege 4644 msiexec.exe Token: SeRestorePrivilege 4644 msiexec.exe Token: SeTakeOwnershipPrivilege 4644 msiexec.exe Token: SeDebugPrivilege 1612 SynTPHelp.exe Token: 33 1612 SynTPHelp.exe Token: SeIncBasePriorityPrivilege 1612 SynTPHelp.exe Token: SeRestorePrivilege 4644 msiexec.exe Token: SeTakeOwnershipPrivilege 4644 msiexec.exe Token: SeRestorePrivilege 4644 msiexec.exe Token: SeTakeOwnershipPrivilege 4644 msiexec.exe Token: SeDebugPrivilege 2120 SynTPHelper.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 2648 msiexec.exe 2648 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 3220 InstallUtil.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
msiexec.exeMsiExec.exeIMSynTPHelper.execmd.exeSynTPHelp.execmd.exeSynTPHelper.exedescription pid process target process PID 4644 wrote to memory of 4348 4644 msiexec.exe srtasks.exe PID 4644 wrote to memory of 4348 4644 msiexec.exe srtasks.exe PID 4644 wrote to memory of 4140 4644 msiexec.exe MsiExec.exe PID 4644 wrote to memory of 4140 4644 msiexec.exe MsiExec.exe PID 4644 wrote to memory of 4140 4644 msiexec.exe MsiExec.exe PID 4140 wrote to memory of 1676 4140 MsiExec.exe expand.exe PID 4140 wrote to memory of 1676 4140 MsiExec.exe expand.exe PID 4140 wrote to memory of 1676 4140 MsiExec.exe expand.exe PID 4140 wrote to memory of 2464 4140 MsiExec.exe IMSynTPHelper.exe PID 4140 wrote to memory of 2464 4140 MsiExec.exe IMSynTPHelper.exe PID 4140 wrote to memory of 2464 4140 MsiExec.exe IMSynTPHelper.exe PID 2464 wrote to memory of 4352 2464 IMSynTPHelper.exe cmd.exe PID 2464 wrote to memory of 4352 2464 IMSynTPHelper.exe cmd.exe PID 2464 wrote to memory of 4352 2464 IMSynTPHelper.exe cmd.exe PID 4352 wrote to memory of 1612 4352 cmd.exe SynTPHelp.exe PID 4352 wrote to memory of 1612 4352 cmd.exe SynTPHelp.exe PID 4352 wrote to memory of 1612 4352 cmd.exe SynTPHelp.exe PID 4644 wrote to memory of 5048 4644 msiexec.exe MsiExec.exe PID 4644 wrote to memory of 5048 4644 msiexec.exe MsiExec.exe PID 4644 wrote to memory of 5048 4644 msiexec.exe MsiExec.exe PID 1612 wrote to memory of 4748 1612 SynTPHelp.exe cmd.exe PID 1612 wrote to memory of 4748 1612 SynTPHelp.exe cmd.exe PID 1612 wrote to memory of 4748 1612 SynTPHelp.exe cmd.exe PID 1612 wrote to memory of 536 1612 SynTPHelp.exe cmd.exe PID 1612 wrote to memory of 536 1612 SynTPHelp.exe cmd.exe PID 1612 wrote to memory of 536 1612 SynTPHelp.exe cmd.exe PID 1612 wrote to memory of 748 1612 SynTPHelp.exe cmd.exe PID 1612 wrote to memory of 748 1612 SynTPHelp.exe cmd.exe PID 1612 wrote to memory of 748 1612 SynTPHelp.exe cmd.exe PID 748 wrote to memory of 2120 748 cmd.exe SynTPHelper.exe PID 748 wrote to memory of 2120 748 cmd.exe SynTPHelper.exe PID 748 wrote to memory of 2120 748 cmd.exe SynTPHelper.exe PID 2120 wrote to memory of 3220 2120 SynTPHelper.exe InstallUtil.exe PID 2120 wrote to memory of 3220 2120 SynTPHelper.exe InstallUtil.exe PID 2120 wrote to memory of 3220 2120 SynTPHelper.exe InstallUtil.exe PID 2120 wrote to memory of 3220 2120 SynTPHelper.exe InstallUtil.exe PID 2120 wrote to memory of 3220 2120 SynTPHelper.exe InstallUtil.exe PID 2120 wrote to memory of 3220 2120 SynTPHelper.exe InstallUtil.exe PID 2120 wrote to memory of 3220 2120 SynTPHelper.exe InstallUtil.exe PID 2120 wrote to memory of 3220 2120 SynTPHelper.exe InstallUtil.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\9a98bae4321155184d55065a53b76236_JaffaCakes118.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F903818CFD97C6B2371B5E437FF6AD702⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\expand.exe"C:\Windows\System32\expand.exe" -R files.cab -F:* files3⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\MW-a04f914b-93ba-46b4-ab51-27e673425bba\files\IMSynTPHelper.exe"C:\Users\Admin\AppData\Local\Temp\MW-a04f914b-93ba-46b4-ab51-27e673425bba\files\IMSynTPHelper.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /c, "C:\Users\Admin\AppData\Local\Temp\SynTPHelp.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SynTPHelp.exe"C:\Users\Admin\AppData\Local\Temp\SynTPHelp.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /c, "C:\Users\Admin\Documents\b106484eb915e4ad6df697dc1442cbff-EDITED.jpg"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\SynTPHelp.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\History\SynTPHelper.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /c, "C:\Users\Admin\AppData\Local\Microsoft\Windows\History\SynTPHelper.exe"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\History\SynTPHelper.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\History\SynTPHelper.exe"7⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"8⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2B6CA5F282C7CFB4EAF8AE592F52FD7C E Global\MSI00002⤵
- Loads dropped DLL
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MW-a04f914b-93ba-46b4-ab51-27e673425bba\files.cabFilesize
1.8MB
MD5e9386820dcef0fb94373a902ebef0be8
SHA190067e9b1a618f31f13d6ddb9aae2b80a3550317
SHA2562623b39263417ac2e7124d2c941636cc40ac899193c6f37aeb4770846e1dfd5b
SHA5121abf56744def334f944b49a6a1c58e205b6c4f318908078679dc74317582d83c69165b46e965573d1110d0197e6a39608e0b0a80a0b410a92bfd7c2bed021511
-
C:\Users\Admin\AppData\Local\Temp\MW-a04f914b-93ba-46b4-ab51-27e673425bba\files\IMSynTPHelper.exeFilesize
1.8MB
MD5fd35e3dede843aa7bb4aa89349f82356
SHA1f20157d7feaabe773c4fbe23f1cb5568e1662a2a
SHA256fcf7eb055d5188a51816fa9147ced8a1d88290dd249d1ced2c77c57a35d2068d
SHA51250e3d66edb1cc0992edfe85077046168b4cdd05d0d4711e72e6d7069db5b9ed601eed1caac0d27adf654f9cdedcd27e2c9e466584921df95eb7a0be9cf673a08
-
C:\Users\Admin\AppData\Local\Temp\MW-a04f914b-93ba-46b4-ab51-27e673425bba\msiwrapper.iniFilesize
488B
MD5138e4ee6eb4f9cfbd0f3431a4c9487a0
SHA1d293325f14335c9efe94bcde561e96eb086f4dd5
SHA2563d7124bd43322231af036a73e4d825869250e8efc0d02d2412d4cfd86d551d2f
SHA512e71ed3f3362f333fd82a5be8d0f751d9fe1ada7c730ceea366450c485d2cac032b6af042fb692e55b1e11bef462e35ab66f17af4cc5d236f8ba0251732ef2fb6
-
C:\Users\Admin\Documents\b106484eb915e4ad6df697dc1442cbff-EDITED.jpgFilesize
1.2MB
MD55b9849e016ab5210cbc8e78a1fdd3671
SHA1560091b2bdf518dd892016722da62fa613d5e958
SHA25676a430452cf0bbb0e429675afd0bf1ff9bb9391f6d41dc293afd6ef06abb7c15
SHA5127975184dadbbb612cad14d01fa03d6ece12d28d9dbd1ba5ccc05b1c10f52b866693354d25c8b667c709ad345ac4a8715ec6e425702d0e3a73d606026bcaba659
-
C:\Users\Admin\Documents\b106484eb915e4ad6df697dc1442cbff-EDITED.txtFilesize
32B
MD55487dd5ec11b05c9f40df10892a2be77
SHA1f280495646fbe745db0a59d4c4d9c4529a205321
SHA2569dbd45db8495aeb79115856938096941222a3860c642a9c42f0c0f186683909a
SHA512d9128a6bb1534915cc2737d64145fb0e243a5cf709b03d3703570cd3fa6d5d703e02b056b371787288225a7225a3d8f16aee0831ad30e433c2d3110121101945
-
C:\Windows\Installer\MSI8359.tmpFilesize
131KB
MD5a06ba919e980d32e0ebe80ddfa099524
SHA12a1c0cbec1cbf5774a6d00fc3a14d2ce979026d1
SHA256b8074d53c56f7deb5832af3894ec20a21d1162252f177984807eb30fc1152fc8
SHA512c8be0aa247baec6c2a7061086c0bbec166099de3dd0f40e50558fb1515dbe9324662ea7c80797208e4eb2f2243c96067702edf385602773e7b3ccc36896f1d13
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2Filesize
23.7MB
MD5af1b70212d52cb5ef8c2f4df4c0adfcb
SHA192c8e33341bfd8cda795047e1eecb56233657df6
SHA25643e07efe1776a95ad00881dc1043cbb67207eafa91d3936fda4dfe65419d465d
SHA51287c3ae343cf050f086a6511e59cf013102e0f934f023c61cc46777f46e6fd2d3042972c87cc437ba4ccd4d431f8bb3b4ea9ae75c835df50ca637f07608f7a775
-
\??\Volume{8ccc3c3f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b32eee57-87f8-4b9a-91b7-16b25c854dd8}_OnDiskSnapshotPropFilesize
6KB
MD53c6bc007e345a5516c6ab029f95d0e9a
SHA185959b8de105d26fb6d3b5a37b7462e4047b7f41
SHA256edee90e67f47970eecd0a147031771902d3001899ec55dada759eca53b22b1b3
SHA51264cae411e7c760689b41fe374495194621f1240452d61950ebdbace479cb3625de9d444236236c6efcd5e035bc80918d6dd978fc1ed46de02c784546614af145
-
memory/2120-90-0x0000000008130000-0x00000000081CC000-memory.dmpFilesize
624KB
-
memory/2120-89-0x00000000032B0000-0x00000000032BC000-memory.dmpFilesize
48KB
-
memory/2464-48-0x0000000000280000-0x000000000045E000-memory.dmpFilesize
1.9MB
-
memory/2464-53-0x0000000007540000-0x000000000754A000-memory.dmpFilesize
40KB
-
memory/2464-52-0x00000000075B0000-0x0000000007642000-memory.dmpFilesize
584KB
-
memory/2464-51-0x0000000004E30000-0x0000000004E54000-memory.dmpFilesize
144KB
-
memory/2464-50-0x0000000007A80000-0x0000000008024000-memory.dmpFilesize
5.6MB
-
memory/2464-49-0x00000000072F0000-0x00000000074D2000-memory.dmpFilesize
1.9MB
-
memory/3220-93-0x0000000005660000-0x0000000005670000-memory.dmpFilesize
64KB
-
memory/3220-91-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/3220-94-0x0000000005860000-0x000000000590E000-memory.dmpFilesize
696KB
-
memory/3220-95-0x0000000008C90000-0x0000000008CB8000-memory.dmpFilesize
160KB
-
memory/3220-96-0x0000000007990000-0x00000000079F6000-memory.dmpFilesize
408KB
-
memory/3220-97-0x0000000007E90000-0x0000000007EA8000-memory.dmpFilesize
96KB
-
memory/3220-98-0x0000000007FF0000-0x0000000008006000-memory.dmpFilesize
88KB
-
memory/3220-99-0x0000000005AF0000-0x0000000005AFA000-memory.dmpFilesize
40KB