ramnit | 102086ef20e66c7998b51ab78ede0e1f2d287519bdbdfea81c0b5764bbb63166

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2025 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_60fc4495858dc357f1c40bcdc1d01576.exe
Size

95KB
MD5

60fc4495858dc357f1c40bcdc1d01576
SHA1

5be470751f45e1f0422fe53a1d4fc979badb1f0c
SHA256

102086ef20e66c7998b51ab78ede0e1f2d287519bdbdfea81c0b5764bbb63166
SHA512

1d55c28bfc64a176455e5c1aaa27209ba0b21505e1a6b45ebd7c20f1718aa9e6703c7de26d72522b4202c42116c5404bcf971cc303e744f52a37d26d381970a7
SSDEEP

768:806R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9Y:CR0vxn3Pc0LCH9MtbvabUDzJYWu3B

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 1 IoCs

pid	Process
4208	WaterMark.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4080-11-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4208-22-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/4208-27-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4080-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4080-9-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4080-6-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4080-5-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4080-4-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4080-3-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4208-34-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4208-37-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px9A7B.tmp	JaffaCakes118_60fc4495858dc357f1c40bcdc1d01576.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	JaffaCakes118_60fc4495858dc357f1c40bcdc1d01576.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	JaffaCakes118_60fc4495858dc357f1c40bcdc1d01576.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4624	1160	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_60fc4495858dc357f1c40bcdc1d01576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 45 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31156107"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "466506478"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31156107"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "464631535"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "466506478"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{473518E2-D37E-11EF-B319-CAF61997B0B0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "464475597"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{47377C9D-D37E-11EF-B319-CAF61997B0B0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443737454"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31156107"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31156107"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4208	WaterMark.exe
4208	WaterMark.exe
4208	WaterMark.exe
4208	WaterMark.exe
4208	WaterMark.exe
4208	WaterMark.exe
4208	WaterMark.exe
4208	WaterMark.exe
4208	WaterMark.exe
4208	WaterMark.exe
4208	WaterMark.exe
4208	WaterMark.exe
4208	WaterMark.exe
4208	WaterMark.exe
4208	WaterMark.exe
4208	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4208	WaterMark.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4936	iexplore.exe
2420	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4936	iexplore.exe
4936	iexplore.exe
2420	iexplore.exe
2420	iexplore.exe
232	IEXPLORE.EXE
232	IEXPLORE.EXE
4308	IEXPLORE.EXE
4308	IEXPLORE.EXE
232	IEXPLORE.EXE
232	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4080	JaffaCakes118_60fc4495858dc357f1c40bcdc1d01576.exe
4208	WaterMark.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 4208	4080	JaffaCakes118_60fc4495858dc357f1c40bcdc1d01576.exe	83
PID 4080 wrote to memory of 4208	4080	JaffaCakes118_60fc4495858dc357f1c40bcdc1d01576.exe	83
PID 4080 wrote to memory of 4208	4080	JaffaCakes118_60fc4495858dc357f1c40bcdc1d01576.exe	83
PID 4208 wrote to memory of 1160	4208	WaterMark.exe	84
PID 4208 wrote to memory of 1160	4208	WaterMark.exe	84
PID 4208 wrote to memory of 1160	4208	WaterMark.exe	84
PID 4208 wrote to memory of 1160	4208	WaterMark.exe	84
PID 4208 wrote to memory of 1160	4208	WaterMark.exe	84
PID 4208 wrote to memory of 1160	4208	WaterMark.exe	84
PID 4208 wrote to memory of 1160	4208	WaterMark.exe	84
PID 4208 wrote to memory of 1160	4208	WaterMark.exe	84
PID 4208 wrote to memory of 1160	4208	WaterMark.exe	84
PID 4208 wrote to memory of 4936	4208	WaterMark.exe	89
PID 4208 wrote to memory of 4936	4208	WaterMark.exe	89
PID 4208 wrote to memory of 2420	4208	WaterMark.exe	90
PID 4208 wrote to memory of 2420	4208	WaterMark.exe	90
PID 4936 wrote to memory of 232	4936	iexplore.exe	92
PID 4936 wrote to memory of 232	4936	iexplore.exe	92
PID 4936 wrote to memory of 232	4936	iexplore.exe	92
PID 2420 wrote to memory of 4308	2420	iexplore.exe	93
PID 2420 wrote to memory of 4308	2420	iexplore.exe	93
PID 2420 wrote to memory of 4308	2420	iexplore.exe	93

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_60fc4495858dc357f1c40bcdc1d01576.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_60fc4495858dc357f1c40bcdc1d01576.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Program Files (x86)\Microsoft\WaterMark.exe
  "C:\Program Files (x86)\Microsoft\WaterMark.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1160
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 204
      4⤵
      Program crash
      PID:4624
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4936 CREDAT:17410 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:232
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:17410 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1160 -ip 1160
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
95KB

MD5
60fc4495858dc357f1c40bcdc1d01576

SHA1
5be470751f45e1f0422fe53a1d4fc979badb1f0c

SHA256
102086ef20e66c7998b51ab78ede0e1f2d287519bdbdfea81c0b5764bbb63166

SHA512
1d55c28bfc64a176455e5c1aaa27209ba0b21505e1a6b45ebd7c20f1718aa9e6703c7de26d72522b4202c42116c5404bcf971cc303e744f52a37d26d381970a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
9e22a9c34466faf7bc9cf642444b3f30

SHA1
0ac45262532cce40083cc9049fb12d4efb06c01f

SHA256
57569469879a3144b391cf9def258ad9ef29d7fd1d3d70a28cfb506443d7a119

SHA512
c60649fb0ecdd14c9a6d8f9ea7ac4356b24a5e1a238705bbc8294b72ea2fda21965af200746ae20dd5f45e386fc30e2189de6007e08ff3d7ec72b8dfc39435fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
57ee592a12985a9f48f1929fe3c243c5

SHA1
ed7fe3d0dfa277e2eae716773a43a26b394bf53b

SHA256
e2202ac179e85eb768719864575a0f657689c405b7d67625ae2afe332705b8af

SHA512
b3018ea053d15ac1d80f83677bcde771c0cae30ec6d98273a05734fee3af270769afd25611064036ff01c492b906b15721d8090c4f6dc61996bf7be881366c72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
f6cac6f841b8136a740d2bf288f21c86

SHA1
22e0343e43e6813db014957a63d7e2a0f546ecd8

SHA256
c022ec53ed14a97c7846c28025bce5cbdbc452cd761974842006dbc8ad8bd706

SHA512
4aa1796ed62c800a3ce4cec02b6e300b4bd8f432efc5571ca93288d6f7d82f1b9097b6cdee441c2a49c58b59e3d0de272b02963597c7d78a0822d7fd33522659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{473518E2-D37E-11EF-B319-CAF61997B0B0}.dat

Filesize
5KB

MD5
360d2022ef42bc201f8418f2a4c8741a

SHA1
00da43b8a5441653037da108c35fb0dee2ff9f75

SHA256
79d5e982d7c91e55cbe54c555760fe35418f7cbe0018d575a682dbf8de2b5126

SHA512
7cb6968d1dd50a21c4edaf1dd7ec47746207d829282538fa6572d80381f7ddb555d0c79dedadc4e8c53602eee3bc0d87ddb75597a784c642060821b708bde1da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{47377C9D-D37E-11EF-B319-CAF61997B0B0}.dat

Filesize
3KB

MD5
4f949e5fa8f12d833045226253457c8e

SHA1
3fb75f415f90ccb6a7d621ecf08db38e921b118d

SHA256
c022ba084aae8ac051765e06ef9ebbdcea55aa5bc8051700443f7c8a447f9c70

SHA512
301270b739f1b956ed3c7490fd19983dd78e3e875fa3f77b9cd8a1ebed1e9d68c39f898edc212dc3619315a0a9eb54b6017ff0e1e96e9dc63c3532ea3beb53e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8R55UT9S\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
memory/1160-31-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/1160-30-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/4080-7-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4080-3-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4080-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/4080-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4080-9-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4080-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4080-6-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4080-5-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4080-4-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4080-2-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4080-8-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/4080-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4208-34-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4208-28-0x0000000077192000-0x0000000077193000-memory.dmp

Filesize
4KB

Download
memory/4208-22-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4208-37-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4208-33-0x0000000077192000-0x0000000077193000-memory.dmp

Filesize
4KB

Download
memory/4208-32-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/4208-25-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/4208-27-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download