ramnit | 002508a4cec942c5b80483a46cabb6845ec961abb67e3b9eaface89996aa5457

Analysis

max time kernel
92s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6.exe
Size

125KB
MD5

1f8413b28bb7ec298923ca139d633fc6
SHA1

99614e9320312cf0b6039bf3f9c4feda8a1194c1
SHA256

002508a4cec942c5b80483a46cabb6845ec961abb67e3b9eaface89996aa5457
SHA512

3d6b75b4fe45ffcdc634734590b5832dab71e577926570b4c84fc2dff21cfb1c4733c746e3a33379e3f37c9dc9f58a217371a257afde22ab25705d877cc2dc54
SSDEEP

3072:Y6lXWN336MdMfLirVQW0/nyyplK7/QoRawi10afCtBGRJFabWWT:JXgqqULirVT01w/QN1pCUJF85

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
900	JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6mgr.exe
1784	WaterMark.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/900-7-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/900-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/900-16-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/900-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/900-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/900-9-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/900-10-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/900-8-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1784-30-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1784-37-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1784-41-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1784-43-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px780E.tmp	JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6mgr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3296	1864	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6.exe

Modifies Internet Explorer settings 1 TTPs 45 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "679512759"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31157815"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "681856586"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "444471055"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31157815"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31157815"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{541BC46C-DA2A-11EF-9361-DA61A5E71E4E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "679669127"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{541E2712-DA2A-11EF-9361-DA61A5E71E4E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31157815"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "681856586"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1784	WaterMark.exe
1784	WaterMark.exe
1784	WaterMark.exe
1784	WaterMark.exe
1784	WaterMark.exe
1784	WaterMark.exe
1784	WaterMark.exe
1784	WaterMark.exe
1784	WaterMark.exe
1784	WaterMark.exe
1784	WaterMark.exe
1784	WaterMark.exe
1784	WaterMark.exe
1784	WaterMark.exe
1784	WaterMark.exe
1784	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1784	WaterMark.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2172	iexplore.exe
1916	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
1916	iexplore.exe
1916	iexplore.exe
5052	IEXPLORE.EXE
5052	IEXPLORE.EXE
392	IEXPLORE.EXE
392	IEXPLORE.EXE
5052	IEXPLORE.EXE
5052	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
900	JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6mgr.exe
1784	WaterMark.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 900	5096	JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6.exe	82
PID 5096 wrote to memory of 900	5096	JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6.exe	82
PID 5096 wrote to memory of 900	5096	JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6.exe	82
PID 900 wrote to memory of 1784	900	JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6mgr.exe	83
PID 900 wrote to memory of 1784	900	JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6mgr.exe	83
PID 900 wrote to memory of 1784	900	JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6mgr.exe	83
PID 1784 wrote to memory of 1864	1784	WaterMark.exe	84
PID 1784 wrote to memory of 1864	1784	WaterMark.exe	84
PID 1784 wrote to memory of 1864	1784	WaterMark.exe	84
PID 1784 wrote to memory of 1864	1784	WaterMark.exe	84
PID 1784 wrote to memory of 1864	1784	WaterMark.exe	84
PID 1784 wrote to memory of 1864	1784	WaterMark.exe	84
PID 1784 wrote to memory of 1864	1784	WaterMark.exe	84
PID 1784 wrote to memory of 1864	1784	WaterMark.exe	84
PID 1784 wrote to memory of 1864	1784	WaterMark.exe	84
PID 1784 wrote to memory of 2172	1784	WaterMark.exe	90
PID 1784 wrote to memory of 2172	1784	WaterMark.exe	90
PID 1784 wrote to memory of 1916	1784	WaterMark.exe	91
PID 1784 wrote to memory of 1916	1784	WaterMark.exe	91
PID 2172 wrote to memory of 392	2172	iexplore.exe	92
PID 2172 wrote to memory of 392	2172	iexplore.exe	92
PID 2172 wrote to memory of 392	2172	iexplore.exe	92
PID 1916 wrote to memory of 5052	1916	iexplore.exe	93
PID 1916 wrote to memory of 5052	1916	iexplore.exe	93
PID 1916 wrote to memory of 5052	1916	iexplore.exe	93

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6mgr.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6mgr.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Program Files (x86)\Microsoft\WaterMark.exe
    "C:\Program Files (x86)\Microsoft\WaterMark.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      PID:1864
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 208
        5⤵
        Program crash
        
        PID:3296
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2172
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:17410 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:392
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1916
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:17410 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1864 -ip 1864
1⤵
PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
dc142ff8759ecb81417ba231bbcf25d0

SHA1
201681d524cde8af5c11b5111f5fa697521c5739

SHA256
d6e2a573b1e137d8b823b82cfeaadeb30df36a0fa7a268a1278465b28fdc7bb6

SHA512
b36456cf3ef37e4bbe0e4acf8b25cc85a39f8517d1b80b3191b1be7ddc6d58c74247b2d9dedb0b67ac4f8a2f3d92773e90aee326cfe612f8573ba6ad6b73e833

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
8517ca78bcbdb471039ecae271f87450

SHA1
222497eacbaa91224e0233022aeb7c6011fdc675

SHA256
91d0b53780d9554e2fc6bf05c44a86f0c628ced62ca9848ecfb19bdc7ee39f35

SHA512
d72f081a262f8b77a62d2bde05a8a936457bf9ded9a6c2adf2dc7c23a3c931d61826e790973bc489088f9442fa637198aa75722ddef32b1d5e89866aa4c8d8c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
89c5fe9cd62d714dc6a1de9481b3d9a5

SHA1
303f402669654cc642a26a7b83dc8ed466d72a53

SHA256
13eb6f047b68f2bc80876c1c562a43ea7262134cf0b60c60895cbf2b75d6c140

SHA512
9af84cea4c0f56079154e71159cedd90fba0703cee8e93110cdfe97af7812da328953161a5eac42cd85d837f2fb6695e7cb99acc164751d8c3084e002f465eca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{541BC46C-DA2A-11EF-9361-DA61A5E71E4E}.dat

Filesize
3KB

MD5
4f80313611ea83b51262790a12ecbd5c

SHA1
126e3433a1d363fa0d7658aaafcbcfa0d21e91a2

SHA256
edc79886f983a2af58953435f70caeca0ad85426ba3d2126f1eb113c25d2c9ed

SHA512
d8565e595ad27ced04522e46230142d1c61656fa3eddcae668fe59d7e7a686cfef7b105c0052df2458afe4f003765744634d998eb9eaa0b82169f7b6a29a1faa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{541E2712-DA2A-11EF-9361-DA61A5E71E4E}.dat

Filesize
5KB

MD5
452625e943ae26290045cce8ad2289f9

SHA1
e906538393dc15216f0c575faaf15f11fe0de5e1

SHA256
140d55a0acface1be2a9d66bc880689f54fb6457e69b3d3e2a89d4e34c2a7fe0

SHA512
4296fdbf983148d94d73175086150470790dacfd9bc6fcf1649b0a11a6f1ece277f09e0a7e19828f90a1b7094be2bb211c15a059fa7409e69abd58ed203f3a7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BHOTC3C\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1f8413b28bb7ec298923ca139d633fc6mgr.exe

Filesize
60KB

MD5
94f2f6ffbba8e7644668b51b39983916

SHA1
63357bbdf90101969117983dbc0d4ed0e713c4d7

SHA256
ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

SHA512
d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

Download Submit
memory/900-9-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/900-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/900-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/900-8-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/900-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/900-6-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/900-25-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/900-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/900-5-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/900-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/900-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/900-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1784-36-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/1784-38-0x0000000077A82000-0x0000000077A83000-memory.dmp

Filesize
4KB

Download
memory/1784-37-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1784-41-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1784-43-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1784-31-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/1784-32-0x0000000077A82000-0x0000000077A83000-memory.dmp

Filesize
4KB

Download
memory/1784-30-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1784-26-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/1864-34-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/1864-35-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/5096-0-0x0000000000440000-0x0000000000463000-memory.dmp

Filesize
140KB

Download
memory/5096-42-0x0000000000440000-0x0000000000463000-memory.dmp

Filesize
140KB

Download