ramnit | bc25375612eda4ca1cdae0e0a48594a2d8f0c9ec307971da3dd26d520a658664

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe
Size

468KB
MD5

186018245413fe2e77c4747b07e8dae2
SHA1

f8aaf00d59d47da7d8aea28d3ce26a47cadb5d8b
SHA256

bc25375612eda4ca1cdae0e0a48594a2d8f0c9ec307971da3dd26d520a658664
SHA512

c6bfd43f6478ffa424ca79c405f3ba503b7f9599531578ed1309b46d0782c5059266016770105bbbee26b2257e5c1c5b1a7f45ff15bccd431b609c4a269c1aa3
SSDEEP

12288:Y9Bnaprb8UPG8vQkGlALvJOl/7bnjImwYAOxjpG:Y9JahVPXQtm8l/XjIFY4

Score

10^/10

ramnit banker persistence spyware stealer trojan worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe
Executes dropped EXE 2 IoCs

Processes:

186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exeyiaygfkxwcxtluwo.exe

pid process

4880 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe
4320 yiaygfkxwcxtluwo.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe

pid	process
4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe
4320	yiaygfkxwcxtluwo.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\RealPlayer_update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe restart"	186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2332 1780 WerFault.exe svchost.exe
2936 2244 WerFault.exe svchost.exe

pid	pid_target	process	target process
2332	1780	WerFault.exe	svchost.exe
2936	2244	WerFault.exe	svchost.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2618482953"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2418326310"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2418326310"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115518"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115518"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2420045133"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115518"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2420045133"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115518"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115518"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BBC25850-34F1-11EF-8383-56B9F69516EA} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426304806"	IEXPLORE.EXE

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

660

pid	process
660

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exeyiaygfkxwcxtluwo.exe

description	pid	process
Token: SeSecurityPrivilege	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe
Token: SeDebugPrivilege	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe
Token: SeSecurityPrivilege	4320	yiaygfkxwcxtluwo.exe
Token: SeLoadDriverPrivilege	4320	yiaygfkxwcxtluwo.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

IEXPLORE.EXE

pid process

3480 IEXPLORE.EXE
3480 IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
3480	IEXPLORE.EXE
3480	IEXPLORE.EXE
3792	IEXPLORE.EXE
3792	IEXPLORE.EXE
3792	IEXPLORE.EXE
3792	IEXPLORE.EXE
3480	IEXPLORE.EXE
3480	IEXPLORE.EXE
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exeiexplore.exeIEXPLORE.EXEiexplore.exe

description	pid	process	target process
PID 5080 wrote to memory of 4880	5080	186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe
PID 5080 wrote to memory of 4880	5080	186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe
PID 5080 wrote to memory of 4880	5080	186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe
PID 4880 wrote to memory of 1780	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	svchost.exe
PID 4880 wrote to memory of 1780	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	svchost.exe
PID 4880 wrote to memory of 1780	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	svchost.exe
PID 4880 wrote to memory of 1780	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	svchost.exe
PID 4880 wrote to memory of 1780	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	svchost.exe
PID 4880 wrote to memory of 1780	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	svchost.exe
PID 4880 wrote to memory of 1780	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	svchost.exe
PID 4880 wrote to memory of 1780	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	svchost.exe
PID 4880 wrote to memory of 1780	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	svchost.exe
PID 4880 wrote to memory of 2584	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	iexplore.exe
PID 4880 wrote to memory of 2584	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	iexplore.exe
PID 4880 wrote to memory of 2584	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	iexplore.exe
PID 2584 wrote to memory of 3480	2584	iexplore.exe	IEXPLORE.EXE
PID 2584 wrote to memory of 3480	2584	iexplore.exe	IEXPLORE.EXE
PID 3480 wrote to memory of 3792	3480	IEXPLORE.EXE	IEXPLORE.EXE
PID 3480 wrote to memory of 3792	3480	IEXPLORE.EXE	IEXPLORE.EXE
PID 3480 wrote to memory of 3792	3480	IEXPLORE.EXE	IEXPLORE.EXE
PID 4880 wrote to memory of 2244	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	svchost.exe
PID 4880 wrote to memory of 2244	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	svchost.exe
PID 4880 wrote to memory of 2244	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	svchost.exe
PID 4880 wrote to memory of 2244	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	svchost.exe
PID 4880 wrote to memory of 2244	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	svchost.exe
PID 4880 wrote to memory of 2244	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	svchost.exe
PID 4880 wrote to memory of 2244	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	svchost.exe
PID 4880 wrote to memory of 2244	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	svchost.exe
PID 4880 wrote to memory of 2244	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	svchost.exe
PID 4880 wrote to memory of 1704	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	iexplore.exe
PID 4880 wrote to memory of 1704	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	iexplore.exe
PID 4880 wrote to memory of 1704	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	iexplore.exe
PID 1704 wrote to memory of 4304	1704	iexplore.exe	IEXPLORE.EXE
PID 1704 wrote to memory of 4304	1704	iexplore.exe	IEXPLORE.EXE
PID 3480 wrote to memory of 1784	3480	IEXPLORE.EXE	IEXPLORE.EXE
PID 3480 wrote to memory of 1784	3480	IEXPLORE.EXE	IEXPLORE.EXE
PID 3480 wrote to memory of 1784	3480	IEXPLORE.EXE	IEXPLORE.EXE
PID 4880 wrote to memory of 4320	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	yiaygfkxwcxtluwo.exe
PID 4880 wrote to memory of 4320	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	yiaygfkxwcxtluwo.exe
PID 4880 wrote to memory of 4320	4880	186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe	yiaygfkxwcxtluwo.exe

C:\Users\Admin\AppData\Local\Temp\186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5080

C:\Users\Admin\AppData\Local\Temp\186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe
C:\Users\Admin\AppData\Local\Temp\186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 204
4⤵
- Program crash
PID:2332

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2584

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3480 CREDAT:17410 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3792

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3480 CREDAT:17416 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1784

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 208
4⤵
- Program crash
PID:2936

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"
4⤵
- Modifies Internet Explorer settings
PID:4304

C:\Users\Admin\AppData\Local\Temp\yiaygfkxwcxtluwo.exe
"C:\Users\Admin\AppData\Local\Temp\yiaygfkxwcxtluwo.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1780 -ip 1780
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2244 -ip 2244
1⤵
PID:1928

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verDE69.tmp
Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe
Filesize
110KB

MD5
a06539e080f0796c507ea485effbc8b0

SHA1
c31d586000b50ec398b1e1dcfecbc31382449db4

SHA256
f5204dc271e72770b75fff3703d4c3f48011807a21816a8b2f82efe69ab28626

SHA512
30c4250ccdf2a5df73688285253f9f476da9f9d6517539e6db951c8cd3de9819b2fa040093fc36d24aaf0a5e23c78abfce1cb693c21bcfb3ab9e4fd0385e1b59

Download Submit
memory/1780-13-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/1780-12-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/4320-46-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4320-45-0x0000000000400000-0x0000000000437D4C-memory.dmp

Filesize
223KB

Download
memory/4320-41-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4320-42-0x0000000000400000-0x0000000000437D4C-memory.dmp

Filesize
223KB

Download
memory/4320-40-0x0000000000400000-0x0000000000437D4C-memory.dmp

Filesize
223KB

Download
memory/4880-6-0x0000000000400000-0x0000000000437D4C-memory.dmp

Filesize
223KB

Download
memory/4880-16-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4880-19-0x0000000000400000-0x0000000000437D4C-memory.dmp

Filesize
223KB

Download
memory/4880-22-0x00000000774F2000-0x00000000774F3000-memory.dmp

Filesize
4KB

Download
memory/4880-21-0x0000000000400000-0x0000000000437D4C-memory.dmp

Filesize
223KB

Download
memory/4880-15-0x0000000000400000-0x0000000000437D4C-memory.dmp

Filesize
223KB

Download
memory/4880-39-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4880-11-0x0000000000400000-0x0000000000437D4C-memory.dmp

Filesize
223KB

Download
memory/4880-14-0x00000000774F2000-0x00000000774F3000-memory.dmp

Filesize
4KB

Download
memory/4880-7-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4880-9-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/5080-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5080-4-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download