ec49f2c2aaafce8bb9cdef73554a7e66d8ae9cb2c408298b885ec172857af33f

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c6809c45d0015efbaf6fe7551567ed3_JaffaCakes118.exe
Size

257KB
MD5

3c6809c45d0015efbaf6fe7551567ed3
SHA1

bf5bbb77dc0d1184e6e6ad0ba70a55b7a7b496da
SHA256

ec49f2c2aaafce8bb9cdef73554a7e66d8ae9cb2c408298b885ec172857af33f
SHA512

5e9ebd3ca0a832be535e42687a9230c1589635e54cc83a3880cdaa32957bdca90b4023c8f7bdf57a451a5640a62116686fa179212024dfe16f259487fbbdb6e0
SSDEEP

6144:Ex8Gil+sosZu5yzrdFw/ZcLFASSqoPaNVagoXe4GESQ78nxiL7g:E6RZu52bwznPsIr18X

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	3c6809c45d0015efbaf6fe7551567ed3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	wmpscfgs.exe

Executes dropped EXE 5 IoCs

pid	Process
3036	wmpscfgs.exe
4172	wmpscfgs.exe
1044	wmpscfgs.exe
2464	wmpscfgs.exe
2820	wmpscfgs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "c:\\program files (x86)\\internet explorer\\wmpscfgs.exe"	3c6809c45d0015efbaf6fe7551567ed3_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "c:\\program files (x86)\\internet explorer\\wmpscfgs.exe"	wmpscfgs.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\adobe\acrotray.exe	3c6809c45d0015efbaf6fe7551567ed3_JaffaCakes118.exe
File created	\??\c:\program files (x86)\internet explorer\wmpscfgs.exe	3c6809c45d0015efbaf6fe7551567ed3_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrotray .exe	wmpscfgs.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrotray.exe	wmpscfgs.exe
File created	\??\c:\program files (x86)\adobe\acrotray .exe	3c6809c45d0015efbaf6fe7551567ed3_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmpscfgs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c6809c45d0015efbaf6fe7551567ed3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmpscfgs.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f62d53f81cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{756D2CA9-88EB-11EF-BDBF-CA65FB447F0B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1243652562"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000013dbeb74f69550459d232b3693c378ca00000000020000000000106600000001000020000000e508c0740f593cf597785b1d6f357d04099bd2b642ca4cf981508fb95dfe62cd000000000e800000000200002000000095b73e27ac1bd92321eb9d6f6f4a636303704f5d43cbec8975915a57a2dc2a8b200000001b75dca276d6063b0afa147f0fd894c16f1c78770b183fc9e44407cc2daf2554400000002e018201b093102164b663d513a523cca9d06143b083e996919c29796b18d71391ed4bbb301922027b0bdca9561f3e235ebc1783ef8d6cf5f0ea1a5e05f9e1cb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000013dbeb74f69550459d232b3693c378ca00000000020000000000106600000001000020000000a13ee7db75c3b9d6f5aebd477d07fa90a2f5b9eefe90be84220f1db3f87d1f94000000000e8000000002000020000000df68629f1fc367d2e570ebfc1fbdd42e676c4733650b2c23586902e1c3dfc23220000000500e33118a498141a59a14a96bda106ae31d480ece69718ec8993ab36f57773840000000e2ed73b0b0b273d6d2e9a033140cc832143c63b340ec64738600c4cff0c3f1cf6a9452c5a935c36cb1c51598eb7a008e4e99136d253815c23a528ceaf9eef4fb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1243652562"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c11c49f81cdb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31137016"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31137016"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2244	3c6809c45d0015efbaf6fe7551567ed3_JaffaCakes118.exe
2244	3c6809c45d0015efbaf6fe7551567ed3_JaffaCakes118.exe
4172	wmpscfgs.exe
4172	wmpscfgs.exe
3036	wmpscfgs.exe
3036	wmpscfgs.exe
3036	wmpscfgs.exe
3036	wmpscfgs.exe
4172	wmpscfgs.exe
4172	wmpscfgs.exe
1044	wmpscfgs.exe
1044	wmpscfgs.exe
2820	wmpscfgs.exe
2820	wmpscfgs.exe
2464	wmpscfgs.exe
2464	wmpscfgs.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2244	3c6809c45d0015efbaf6fe7551567ed3_JaffaCakes118.exe
Token: SeDebugPrivilege	4172	wmpscfgs.exe
Token: SeDebugPrivilege	3036	wmpscfgs.exe
Token: SeDebugPrivilege	1044	wmpscfgs.exe
Token: SeDebugPrivilege	2820	wmpscfgs.exe
Token: SeDebugPrivilege	2464	wmpscfgs.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2580	iexplore.exe
2580	iexplore.exe
2580	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2580	iexplore.exe
2580	iexplore.exe
1068	IEXPLORE.EXE
1068	IEXPLORE.EXE
2580	iexplore.exe
2580	iexplore.exe
3156	IEXPLORE.EXE
3156	IEXPLORE.EXE
2580	iexplore.exe
2580	iexplore.exe
4376	IEXPLORE.EXE
4376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 3036	2244	3c6809c45d0015efbaf6fe7551567ed3_JaffaCakes118.exe	86
PID 2244 wrote to memory of 3036	2244	3c6809c45d0015efbaf6fe7551567ed3_JaffaCakes118.exe	86
PID 2244 wrote to memory of 3036	2244	3c6809c45d0015efbaf6fe7551567ed3_JaffaCakes118.exe	86
PID 2244 wrote to memory of 4172	2244	3c6809c45d0015efbaf6fe7551567ed3_JaffaCakes118.exe	87
PID 2244 wrote to memory of 4172	2244	3c6809c45d0015efbaf6fe7551567ed3_JaffaCakes118.exe	87
PID 2244 wrote to memory of 4172	2244	3c6809c45d0015efbaf6fe7551567ed3_JaffaCakes118.exe	87
PID 4172 wrote to memory of 1044	4172	wmpscfgs.exe	88
PID 4172 wrote to memory of 1044	4172	wmpscfgs.exe	88
PID 4172 wrote to memory of 1044	4172	wmpscfgs.exe	88
PID 4172 wrote to memory of 2464	4172	wmpscfgs.exe	94
PID 4172 wrote to memory of 2464	4172	wmpscfgs.exe	94
PID 4172 wrote to memory of 2464	4172	wmpscfgs.exe	94
PID 4172 wrote to memory of 2820	4172	wmpscfgs.exe	95
PID 4172 wrote to memory of 2820	4172	wmpscfgs.exe	95
PID 4172 wrote to memory of 2820	4172	wmpscfgs.exe	95
PID 2580 wrote to memory of 1068	2580	iexplore.exe	99
PID 2580 wrote to memory of 1068	2580	iexplore.exe	99
PID 2580 wrote to memory of 1068	2580	iexplore.exe	99
PID 2580 wrote to memory of 3156	2580	iexplore.exe	101
PID 2580 wrote to memory of 3156	2580	iexplore.exe	101
PID 2580 wrote to memory of 3156	2580	iexplore.exe	101
PID 2580 wrote to memory of 4376	2580	iexplore.exe	102
PID 2580 wrote to memory of 4376	2580	iexplore.exe	102
PID 2580 wrote to memory of 4376	2580	iexplore.exe	102

C:\Users\Admin\AppData\Local\Temp\3c6809c45d0015efbaf6fe7551567ed3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c6809c45d0015efbaf6fe7551567ed3_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244
- C:\program files (x86)\internet explorer\wmpscfgs.exe
  "C:\program files (x86)\internet explorer\wmpscfgs.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
  C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\program files (x86)\internet explorer\wmpscfgs.exe
    "C:\program files (x86)\internet explorer\wmpscfgs.exe" Files (x86)\Internet Explorer\wmpscfgs.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1044
- - C:\program files (x86)\internet explorer\wmpscfgs.exe
    "C:\program files (x86)\internet explorer\wmpscfgs.exe" Files (x86)\Internet Explorer\wmpscfgs.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2464
- - C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
    C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2820

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1888

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:17416 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:17424 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

Filesize
264KB

MD5
42a8b22a4b79432226f1a57a378fd33c

SHA1
e4478393bb766c78348bea427b24593311594c17

SHA256
28e1d14c13bb19ffef3946f7d935ebecdd8b9e50456094c0fca12fb3321dd421

SHA512
8aafdf6d3ee5ab2a9556100b13d3a719989c4ce94f6afe93fe35aa4209aed9024854b2a94c3bfdb6aa3345c3b7be474a1ee5ef05839ee52465ce0407ef5b3432

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YUS9Q6F\bsvmRggPb[1].js

Filesize
33KB

MD5
285520bc859a840449187cc43864a1cb

SHA1
3d85ac9801d3cc9a3577bc6f6ef3c754d2677dff

SHA256
ac8e37a73437f2c13789726ea053c21fcdfd485896aabd6498702064968e34da

SHA512
7d99e9b95ed4fdc8a510b3830e7948be99d55edfac91ec71c4c7e534176a25ebe48c1955dc39a950f1a3322ef7d18910048c16492ebb9ff54d517a294602d6a5

Download Submit
\??\c:\program files (x86)\adobe\acrotray .exe

Filesize
268KB

MD5
6219b5445c1db486d99e611882a17e54

SHA1
5733e3eea2ae2e3496bd034f08c3899cc7b7a6df

SHA256
11517eab3b0bab3637587d7d37f8787efa48bea5f63da02f20ad7ebca786fb78

SHA512
400379b6e2bb63054672ffcf5c9cadecdca06c4bd7c3e1ec4ccfd8bce7c1a376e29512721f47ab6768fea3706c80c14badd5624a7691b43e7946ef991a190fc0

Download Submit
\??\c:\program files (x86)\adobe\acrotray.exe

Filesize
269KB

MD5
823b791cfc416a367d9e03a4119bde6e

SHA1
f4562a6daf4dc50075d6e83d51b539adac1568fd

SHA256
645122f841fd461b8541d7a714f8d66b20ecfbd578a65f7731e5405ab610c6fd

SHA512
7992b9771f87009e7f3f4f0d0da30b564274d8056ae06a081e8a802d6d95ef43d2bdc2a0cca3e66b33c3b5865f6d07a6670bce71ddc87bca883645d87f7373e4

Download Submit
memory/2244-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download