ramnit | 2a70d4686db401ea97d64d6ed1dd17923e15b4e35f8e00361e30aa3159c9bdf6

Analysis

max time kernel
93s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e835a9b809c7ed567aeb5e43be004840.exe
Size

176KB
MD5

e835a9b809c7ed567aeb5e43be004840
SHA1

ad5fe5ddca50d5377a9812484611efc790c00dfb
SHA256

2a70d4686db401ea97d64d6ed1dd17923e15b4e35f8e00361e30aa3159c9bdf6
SHA512

baf42235326a6bb72e763d8f8eda5609b4a72016b3f59ad23ad8ae6f7bcca0ea95d9c548159ce70121e7dc8f21eeedee46ce2fff5ec0897f280395c9c09b86bf
SSDEEP

1536:YVZnxm6MG9xgfrvEaoiT/GyphjXDYjKwttoswRmhApEPEBu/Ob0Kvqy55IFzID/:InxwgxgfR/DVG7wBpEPKlqK/

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 1 IoCs

pid	Process
1124	WaterMark.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/812-4-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/812-8-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/812-3-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/812-2-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/812-10-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/812-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/812-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1124-26-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1124-33-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1124-35-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1124-38-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px64A5.tmp	JaffaCakes118_e835a9b809c7ed567aeb5e43be004840.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	JaffaCakes118_e835a9b809c7ed567aeb5e43be004840.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	JaffaCakes118_e835a9b809c7ed567aeb5e43be004840.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2868	1828	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e835a9b809c7ed567aeb5e43be004840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 45 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7AD846F8-D72F-11EF-AF2A-5227CD58F2D9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1340963830"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1340963830"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31157052"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "444143415"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31157052"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1340963830"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1340963830"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31157052"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31157052"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7ADD0ADC-D72F-11EF-AF2A-5227CD58F2D9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1124	WaterMark.exe
1124	WaterMark.exe
1124	WaterMark.exe
1124	WaterMark.exe
1124	WaterMark.exe
1124	WaterMark.exe
1124	WaterMark.exe
1124	WaterMark.exe
1124	WaterMark.exe
1124	WaterMark.exe
1124	WaterMark.exe
1124	WaterMark.exe
1124	WaterMark.exe
1124	WaterMark.exe
1124	WaterMark.exe
1124	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	WaterMark.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
468	iexplore.exe
3388	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
468	iexplore.exe
468	iexplore.exe
3388	iexplore.exe
3388	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
812	JaffaCakes118_e835a9b809c7ed567aeb5e43be004840.exe
1124	WaterMark.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 1124	812	JaffaCakes118_e835a9b809c7ed567aeb5e43be004840.exe	84
PID 812 wrote to memory of 1124	812	JaffaCakes118_e835a9b809c7ed567aeb5e43be004840.exe	84
PID 812 wrote to memory of 1124	812	JaffaCakes118_e835a9b809c7ed567aeb5e43be004840.exe	84
PID 1124 wrote to memory of 1828	1124	WaterMark.exe	85
PID 1124 wrote to memory of 1828	1124	WaterMark.exe	85
PID 1124 wrote to memory of 1828	1124	WaterMark.exe	85
PID 1124 wrote to memory of 1828	1124	WaterMark.exe	85
PID 1124 wrote to memory of 1828	1124	WaterMark.exe	85
PID 1124 wrote to memory of 1828	1124	WaterMark.exe	85
PID 1124 wrote to memory of 1828	1124	WaterMark.exe	85
PID 1124 wrote to memory of 1828	1124	WaterMark.exe	85
PID 1124 wrote to memory of 1828	1124	WaterMark.exe	85
PID 1124 wrote to memory of 3388	1124	WaterMark.exe	90
PID 1124 wrote to memory of 3388	1124	WaterMark.exe	90
PID 1124 wrote to memory of 468	1124	WaterMark.exe	91
PID 1124 wrote to memory of 468	1124	WaterMark.exe	91
PID 468 wrote to memory of 2560	468	iexplore.exe	93
PID 468 wrote to memory of 2560	468	iexplore.exe	93
PID 468 wrote to memory of 2560	468	iexplore.exe	93
PID 3388 wrote to memory of 1632	3388	iexplore.exe	94
PID 3388 wrote to memory of 1632	3388	iexplore.exe	94
PID 3388 wrote to memory of 1632	3388	iexplore.exe	94

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e835a9b809c7ed567aeb5e43be004840.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e835a9b809c7ed567aeb5e43be004840.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:812
- C:\Program Files (x86)\Microsoft\WaterMark.exe
  "C:\Program Files (x86)\Microsoft\WaterMark.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1828
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 212
      4⤵
      Program crash
      PID:2868
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3388 CREDAT:17410 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1632
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:468
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:468 CREDAT:17410 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1828 -ip 1828
1⤵
PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
176KB

MD5
e835a9b809c7ed567aeb5e43be004840

SHA1
ad5fe5ddca50d5377a9812484611efc790c00dfb

SHA256
2a70d4686db401ea97d64d6ed1dd17923e15b4e35f8e00361e30aa3159c9bdf6

SHA512
baf42235326a6bb72e763d8f8eda5609b4a72016b3f59ad23ad8ae6f7bcca0ea95d9c548159ce70121e7dc8f21eeedee46ce2fff5ec0897f280395c9c09b86bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
0ada2095c461df5a751955aa41dd491e

SHA1
8366c54b31e1ddc8016aa22aab8c83f73c690810

SHA256
80cd542688ed3a45669b53243c3f4922d6eb21a34d8dfeebc6c101484d3bac09

SHA512
135991affe343d4358bb15a693effa7a6813d6715e555729d2aa04a98555e13fded55d3100a41a92a5beb57c68fbdacb199a3e66407944e37880b28d42d79e7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
145295fb7e92a2154fd00063cc417c53

SHA1
5b08b501bbbd1e6e491347db61b7015bc0a674eb

SHA256
662b153107c6e9226fc61d51961a5709864adb05f78f2452da238f4b62dc7103

SHA512
c60b93ccbbdc74b54dab70086bff54d422c4b2370378e572444466d535626fdecdc2b5238f5b9456f79aac405f6fa7f65e9fec893662041c8e33df1803990ab6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
c1caa5253036bdbe3e97ae1a10e0f54d

SHA1
2831d1cd9ed0a50a0d2086c541650c63e07994c2

SHA256
881b468b93c8f2bcfde17d28d3129c352dc16cb0d9622c91f8738a0821228912

SHA512
018aa2f27c3c5a63b3ae31d0073c0e1acdde87256b6270270015c190ac05e11269e3782f0aef8b1d8757ba60edb954d59c099d4d8d7a6806414d0a55c04f15a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
2ac18e916737a42727f9872a708c4fa9

SHA1
6aaa06164042928ce22101a8131706f052f4c319

SHA256
b7df473240c20bd911f49489e99e5fff2892fbf548024738716aa1e509362ce3

SHA512
d5cd4df4bf57bf023c391eab3b5f90992f97a5d279ff48aa0b5206a351bed2520403b2eafed203b4c7277ce731c96bbd4088d0b631c652bf6b520cccfab29aa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
dedc3da57f511f8ad1c39323732608a5

SHA1
48b3e68be00cbbcf1f2d01cbbbb3115e73885263

SHA256
67f515b41885eaaf08a0628123b110083ddf72d0fa7930a43be57c6bfb61d4d5

SHA512
952f44ed2b450c42d7b1149bde271bf44bebe95fe861cafc37f6a659851c8371385fce863a3cc84906fae9f6d5b06b9fe8d478229c23496795a157f2f238adff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7AD846F8-D72F-11EF-AF2A-5227CD58F2D9}.dat

Filesize
3KB

MD5
c8d83ce928eb9e1a5b9ffb3aee40b206

SHA1
aeb532a1401a672e29ace0cd6ae82eb0807a8195

SHA256
eb47bfdf3f3eba4e13f9a2d9135611dbe95e5c4af91d9b6ae68f364eb6eaeadc

SHA512
dddc3725ddb9704c8fa185a59c49e98c0d5dd7273ae707dbbbb11d31006813f84f0253a3cfe8bc7e2d825ce11b4a4e017b67d686598d7fb5e7b33e044772e932

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7ADD0ADC-D72F-11EF-AF2A-5227CD58F2D9}.dat

Filesize
5KB

MD5
b22464754853b70839e3548d2038df37

SHA1
06b599fefcfec8db2dcd67436fcb65f574b56cd8

SHA256
6a2efa4640225be23234cd8e33caa8fc10165ff0391e4d64151154236fba4d73

SHA512
17915ccb78072d2874aeba453aec19633a8e700ee49c7ff62540a49aef049e3e22c22287f554f7a68209cc13af7613286471b65b949d146d747036862f75d59c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DQ67RYHS\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
memory/812-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/812-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/812-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/812-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/812-4-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/812-8-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/812-7-0x00000000030B0000-0x00000000030B1000-memory.dmp

Filesize
4KB

Download
memory/812-6-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/812-3-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/812-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/812-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1124-35-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1124-34-0x0000000076F02000-0x0000000076F03000-memory.dmp

Filesize
4KB

Download
memory/1124-33-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1124-38-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1124-32-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/1124-27-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/1124-28-0x0000000076F02000-0x0000000076F03000-memory.dmp

Filesize
4KB

Download
memory/1124-26-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1828-30-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1828-31-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download