ramnit | e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07beb

Analysis

max time kernel
101s
max time network
140s
platform
windows7_x64
resource
win7v20210410
submitted
08-05-2021 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07beb.exe
Size

288KB
MD5

5008a60721c16ef5fdc19321de567d34
SHA1

ce60264e4bcc9ada4bea700d632fc1c7b1666645
SHA256

e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07beb
SHA512

55890b01237eeef99ef99274074e06b97e26dece01164c3dfde74f8f5eb5dea02b249427cfb4e1c32ea9e510e81c67838950a4f894cd4fd9592cd0df765caeac

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 6 IoCs

Processes:

e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exee5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exeDesktopLayer.exee5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exeDesktopLayerSrv.exeDesktopLayerSrvSrv.exe

pid	process
2024	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe
2036	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe
2000	DesktopLayer.exe
1996	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe
1796	DesktopLayerSrv.exe
880	DesktopLayerSrvSrv.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe	upx
\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe	upx
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe	upx
\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe	upx
behavioral1/memory/2024-102-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2036-104-0x0000000000400000-0x000000000043D000-memory.dmp	upx
C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe	upx
behavioral1/memory/1996-106-0x0000000000400000-0x000000000042E000-memory.dmp	upx
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	upx

Loads dropped DLL 6 IoCs

Processes:

pid	process
484	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07beb.exe
2024	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe
2024	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe
2036	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe
2000	DesktopLayer.exe
1796	DesktopLayerSrv.exe

Drops file in Program Files directory 13 IoCs

Processes:

DesktopLayerSrvSrv.exee5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exee5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exeDesktopLayerSrv.exeDesktopLayer.exee5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	DesktopLayerSrvSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px1EF6.tmp	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px1F82.tmp	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px20CA.tmp	DesktopLayerSrvSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px209B.tmp	DesktopLayerSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	DesktopLayerSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	DesktopLayer.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px1FE0.tmp	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe	DesktopLayerSrv.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59449751-B029-11EB-AB32-6E76A0352788} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{593B11D1-B029-11EB-AB32-6E76A0352788} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59638931-B029-11EB-AB32-6E76A0352788} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{594BBB71-B029-11EB-AB32-6E76A0352788} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exee5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exeDesktopLayer.exeDesktopLayerSrv.exeDesktopLayerSrvSrv.exe

pid	process
2036	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe
2036	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe
1996	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe
2036	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe
1996	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe
2036	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe
2000	DesktopLayer.exe
1996	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe
1996	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe
2000	DesktopLayer.exe
2000	DesktopLayer.exe
2000	DesktopLayer.exe
1796	DesktopLayerSrv.exe
1796	DesktopLayerSrv.exe
880	DesktopLayerSrvSrv.exe
1796	DesktopLayerSrv.exe
1796	DesktopLayerSrv.exe
880	DesktopLayerSrvSrv.exe
880	DesktopLayerSrvSrv.exe
880	DesktopLayerSrvSrv.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid process

1756 iexplore.exe
1284 iexplore.exe
1776 iexplore.exe
1352 iexplore.exe
1552 iexplore.exe

pid	process
1756	iexplore.exe
1284	iexplore.exe
1776	iexplore.exe
1352	iexplore.exe
1552	iexplore.exe

Suspicious use of SetWindowsHookEx 22 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
1284	iexplore.exe
1284	iexplore.exe
1552	iexplore.exe
1552	iexplore.exe
1352	iexplore.exe
1352	iexplore.exe
1776	iexplore.exe
1776	iexplore.exe
1756	iexplore.exe
1756	iexplore.exe
2012	IEXPLORE.EXE
2012	IEXPLORE.EXE
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE
1228	IEXPLORE.EXE
1228	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07beb.exee5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exee5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exeDesktopLayer.exee5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exeDesktopLayerSrv.exeDesktopLayerSrvSrv.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 484 wrote to memory of 2024	484	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07beb.exe	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe
PID 484 wrote to memory of 2024	484	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07beb.exe	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe
PID 484 wrote to memory of 2024	484	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07beb.exe	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe
PID 484 wrote to memory of 2024	484	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07beb.exe	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe
PID 2024 wrote to memory of 2036	2024	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe
PID 2024 wrote to memory of 2036	2024	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe
PID 2024 wrote to memory of 2036	2024	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe
PID 2024 wrote to memory of 2036	2024	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe
PID 2024 wrote to memory of 2000	2024	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe	DesktopLayer.exe
PID 2024 wrote to memory of 2000	2024	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe	DesktopLayer.exe
PID 2024 wrote to memory of 2000	2024	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe	DesktopLayer.exe
PID 2024 wrote to memory of 2000	2024	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe	DesktopLayer.exe
PID 2036 wrote to memory of 1996	2036	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe
PID 2036 wrote to memory of 1996	2036	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe
PID 2036 wrote to memory of 1996	2036	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe
PID 2036 wrote to memory of 1996	2036	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe
PID 2036 wrote to memory of 1776	2036	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe	iexplore.exe
PID 2036 wrote to memory of 1776	2036	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe	iexplore.exe
PID 2036 wrote to memory of 1776	2036	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe	iexplore.exe
PID 2036 wrote to memory of 1776	2036	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe	iexplore.exe
PID 2000 wrote to memory of 1796	2000	DesktopLayer.exe	DesktopLayerSrv.exe
PID 2000 wrote to memory of 1796	2000	DesktopLayer.exe	DesktopLayerSrv.exe
PID 2000 wrote to memory of 1796	2000	DesktopLayer.exe	DesktopLayerSrv.exe
PID 2000 wrote to memory of 1796	2000	DesktopLayer.exe	DesktopLayerSrv.exe
PID 1996 wrote to memory of 1756	1996	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe	iexplore.exe
PID 1996 wrote to memory of 1756	1996	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe	iexplore.exe
PID 1996 wrote to memory of 1756	1996	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe	iexplore.exe
PID 1996 wrote to memory of 1756	1996	e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe	iexplore.exe
PID 2000 wrote to memory of 1352	2000	DesktopLayer.exe	iexplore.exe
PID 2000 wrote to memory of 1352	2000	DesktopLayer.exe	iexplore.exe
PID 2000 wrote to memory of 1352	2000	DesktopLayer.exe	iexplore.exe
PID 2000 wrote to memory of 1352	2000	DesktopLayer.exe	iexplore.exe
PID 1796 wrote to memory of 880	1796	DesktopLayerSrv.exe	DesktopLayerSrvSrv.exe
PID 1796 wrote to memory of 880	1796	DesktopLayerSrv.exe	DesktopLayerSrvSrv.exe
PID 1796 wrote to memory of 880	1796	DesktopLayerSrv.exe	DesktopLayerSrvSrv.exe
PID 1796 wrote to memory of 880	1796	DesktopLayerSrv.exe	DesktopLayerSrvSrv.exe
PID 1796 wrote to memory of 1552	1796	DesktopLayerSrv.exe	iexplore.exe
PID 1796 wrote to memory of 1552	1796	DesktopLayerSrv.exe	iexplore.exe
PID 1796 wrote to memory of 1552	1796	DesktopLayerSrv.exe	iexplore.exe
PID 1796 wrote to memory of 1552	1796	DesktopLayerSrv.exe	iexplore.exe
PID 880 wrote to memory of 1284	880	DesktopLayerSrvSrv.exe	iexplore.exe
PID 880 wrote to memory of 1284	880	DesktopLayerSrvSrv.exe	iexplore.exe
PID 880 wrote to memory of 1284	880	DesktopLayerSrvSrv.exe	iexplore.exe
PID 880 wrote to memory of 1284	880	DesktopLayerSrvSrv.exe	iexplore.exe
PID 1552 wrote to memory of 2020	1552	iexplore.exe	IEXPLORE.EXE
PID 1552 wrote to memory of 2020	1552	iexplore.exe	IEXPLORE.EXE
PID 1552 wrote to memory of 2020	1552	iexplore.exe	IEXPLORE.EXE
PID 1552 wrote to memory of 2020	1552	iexplore.exe	IEXPLORE.EXE
PID 1284 wrote to memory of 2032	1284	iexplore.exe	IEXPLORE.EXE
PID 1284 wrote to memory of 2032	1284	iexplore.exe	IEXPLORE.EXE
PID 1284 wrote to memory of 2032	1284	iexplore.exe	IEXPLORE.EXE
PID 1284 wrote to memory of 2032	1284	iexplore.exe	IEXPLORE.EXE
PID 1756 wrote to memory of 2012	1756	iexplore.exe	IEXPLORE.EXE
PID 1756 wrote to memory of 2012	1756	iexplore.exe	IEXPLORE.EXE
PID 1756 wrote to memory of 2012	1756	iexplore.exe	IEXPLORE.EXE
PID 1756 wrote to memory of 2012	1756	iexplore.exe	IEXPLORE.EXE
PID 1776 wrote to memory of 1992	1776	iexplore.exe	IEXPLORE.EXE
PID 1776 wrote to memory of 1992	1776	iexplore.exe	IEXPLORE.EXE
PID 1776 wrote to memory of 1992	1776	iexplore.exe	IEXPLORE.EXE
PID 1776 wrote to memory of 1992	1776	iexplore.exe	IEXPLORE.EXE
PID 1352 wrote to memory of 1228	1352	iexplore.exe	IEXPLORE.EXE
PID 1352 wrote to memory of 1228	1352	iexplore.exe	IEXPLORE.EXE
PID 1352 wrote to memory of 1228	1352	iexplore.exe	IEXPLORE.EXE
PID 1352 wrote to memory of 1228	1352	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07beb.exe
"C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07beb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:484

C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe
C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2024

C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe
C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036

C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe
C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1996

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1756 CREDAT:275457 /prefetch:2
6⤵
- Suspicious use of SetWindowsHookEx
PID:2012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1776 CREDAT:275457 /prefetch:2
5⤵
- Suspicious use of SetWindowsHookEx
PID:1992

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2000

C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe
"C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1796

C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe
"C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe"
5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:880

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1284 CREDAT:275457 /prefetch:2
7⤵
- Suspicious use of SetWindowsHookEx
PID:2032

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1552 CREDAT:275457 /prefetch:2
6⤵
- Suspicious use of SetWindowsHookEx
PID:2020

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1352 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
395a1a546b4424e3f11cd3ea26066ff9

SHA1
2f18bf153ed75cd9f33f356d1b9b02219c3a1279

SHA256
5dd67a6408d0421a214abba36a7642591cce652f8eac6f71f6d357c154025e6a

SHA512
2a5a398a56f895bffb245b830fd9b3003d887c2a71c6f1e022fd25bcec303cacd691dc744c0121f1d93f1f6e9887da386b3fab096ec0090a607d2d1aa72710a7

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
395a1a546b4424e3f11cd3ea26066ff9

SHA1
2f18bf153ed75cd9f33f356d1b9b02219c3a1279

SHA256
5dd67a6408d0421a214abba36a7642591cce652f8eac6f71f6d357c154025e6a

SHA512
2a5a398a56f895bffb245b830fd9b3003d887c2a71c6f1e022fd25bcec303cacd691dc744c0121f1d93f1f6e9887da386b3fab096ec0090a607d2d1aa72710a7

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe
MD5
f018e9eb66dc53d840ee98c5926f1e2e

SHA1
8e736010173688f982e5713fa8b70c978f17ba42

SHA256
8e9e93a7ae39aa3c6e17a11d567cf52e6190b726d76e6f60b57e9db99ee58bb6

SHA512
30b1fb67767eb5b15bd9d45091d9f184811d4934faeed47b672315d8c8d05b9dc031a6a02addb4b71de1c6b286cc62ef61db2f55dfe4df4bd3c584f256ca49a2

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe
MD5
f018e9eb66dc53d840ee98c5926f1e2e

SHA1
8e736010173688f982e5713fa8b70c978f17ba42

SHA256
8e9e93a7ae39aa3c6e17a11d567cf52e6190b726d76e6f60b57e9db99ee58bb6

SHA512
30b1fb67767eb5b15bd9d45091d9f184811d4934faeed47b672315d8c8d05b9dc031a6a02addb4b71de1c6b286cc62ef61db2f55dfe4df4bd3c584f256ca49a2

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{593B11D1-B029-11EB-AB32-6E76A0352788}.dat
MD5
02aa01a3fdf380f438c8ef418cf69960

SHA1
e6eff660e563bbe32a63f9d29df7a842951936d8

SHA256
0be543c6fdb5db5a9ae2864b623f931043f03197219da1b8c5f67efc1d062a5b

SHA512
fd809bf6c465491ac1a27af5a375074314f02dc6c0c5ad7759ee6edab85356da76fb14e858ac312742098b09fc202985f4d9b892a308d2163bc960da1adba7e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{593B11D1-B029-11EB-AB32-6E76A0352788}.dat
MD5
9705f63abaace538223de60f5354507b

SHA1
b5a4ed1487730ca0ec00a70ff84256bd9be2d19e

SHA256
1241ff1671874871b379f11551a6062a5eb9bfaa03af1b989223b2a4fe8cbfcd

SHA512
0f192b32da27282d055d439dbecdd28028a11cfe5e28ad9fea0340f92f44e7b4b8c0c8c20a06a0dacf288101633780dafa7d189d72efaf8985e73d7ca72b59c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{59449751-B029-11EB-AB32-6E76A0352788}.dat
MD5
35dfb1b87d88a8ee76e61a2f907db1c6

SHA1
f8ad8f20f8b3cca8feca5012977a9978d7d273b1

SHA256
170c3bad8db12b183964cb84db8de86285957cff3b157e4684d23b4304eb7b2e

SHA512
59cfb3b2f2992f07c762806939ff3e88c607ccf23cdca5ec56879e448ec34aacb19913b1d938645362a2a0e19140bac83c3ec854d403e6618514209b58d8f55e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{59449751-B029-11EB-AB32-6E76A0352788}.dat
MD5
fa16d10fe1db36d96d9171b54752ed9d

SHA1
436952c882cd27b65f50c3b1053e766f53afedfc

SHA256
4de31b59c43ecc9c76668f4766b46462e3d911abd1918a3457205d1c051dc7e4

SHA512
e79843c6d52b07a8e046d97ef6bd01a5a3f75d8fd5c573fb7e6c4ba5c1e234fa8470ecb90d41d236f04f70dc2aeb0ea509d168dadfaf428c88e688c456fa72e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{594BBB71-B029-11EB-AB32-6E76A0352788}.dat
MD5
a27a8e03e9b8ef2f7829f188acd3f2f0

SHA1
cb8e444481e8269d0ecf3c0a7d3dbc918bebe482

SHA256
e8de9b6affa25bbdafa4ade6cecb551b256faecd07d83d5f41a039412714dde4

SHA512
4e38ecc8de422ca7a5b6f5296461c0fecb8ef3fd7ed4659e360a7e4430dd5550da6ab7294d170ad4992a28c091b01b9d962b0ff116847b8ab30f2b295bc12e54

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe
MD5
395a1a546b4424e3f11cd3ea26066ff9

SHA1
2f18bf153ed75cd9f33f356d1b9b02219c3a1279

SHA256
5dd67a6408d0421a214abba36a7642591cce652f8eac6f71f6d357c154025e6a

SHA512
2a5a398a56f895bffb245b830fd9b3003d887c2a71c6f1e022fd25bcec303cacd691dc744c0121f1d93f1f6e9887da386b3fab096ec0090a607d2d1aa72710a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe
MD5
395a1a546b4424e3f11cd3ea26066ff9

SHA1
2f18bf153ed75cd9f33f356d1b9b02219c3a1279

SHA256
5dd67a6408d0421a214abba36a7642591cce652f8eac6f71f6d357c154025e6a

SHA512
2a5a398a56f895bffb245b830fd9b3003d887c2a71c6f1e022fd25bcec303cacd691dc744c0121f1d93f1f6e9887da386b3fab096ec0090a607d2d1aa72710a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe
MD5
f018e9eb66dc53d840ee98c5926f1e2e

SHA1
8e736010173688f982e5713fa8b70c978f17ba42

SHA256
8e9e93a7ae39aa3c6e17a11d567cf52e6190b726d76e6f60b57e9db99ee58bb6

SHA512
30b1fb67767eb5b15bd9d45091d9f184811d4934faeed47b672315d8c8d05b9dc031a6a02addb4b71de1c6b286cc62ef61db2f55dfe4df4bd3c584f256ca49a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe
MD5
f018e9eb66dc53d840ee98c5926f1e2e

SHA1
8e736010173688f982e5713fa8b70c978f17ba42

SHA256
8e9e93a7ae39aa3c6e17a11d567cf52e6190b726d76e6f60b57e9db99ee58bb6

SHA512
30b1fb67767eb5b15bd9d45091d9f184811d4934faeed47b672315d8c8d05b9dc031a6a02addb4b71de1c6b286cc62ef61db2f55dfe4df4bd3c584f256ca49a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\JWKYAH27.txt
MD5
b8019b1471c516824345238b331355db

SHA1
1829e457b0c7b4603a4511237d247141de0bc19f

SHA256
dc17b4634904a643caa51e49b095c7969f8cfb01e29e369d35d475b3a3f7b411

SHA512
bdcc735840d86b6a55f68839406cffd45e14f431b1a17ba2909d67991d52eefa0d66ab0303a2c587d4b9479006f445c2ec6a6db3362fcd46051a0c2c2defbe4f

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
395a1a546b4424e3f11cd3ea26066ff9

SHA1
2f18bf153ed75cd9f33f356d1b9b02219c3a1279

SHA256
5dd67a6408d0421a214abba36a7642591cce652f8eac6f71f6d357c154025e6a

SHA512
2a5a398a56f895bffb245b830fd9b3003d887c2a71c6f1e022fd25bcec303cacd691dc744c0121f1d93f1f6e9887da386b3fab096ec0090a607d2d1aa72710a7

Download Submit
\Program Files (x86)\Microsoft\DesktopLayerSrv.exe
MD5
f018e9eb66dc53d840ee98c5926f1e2e

SHA1
8e736010173688f982e5713fa8b70c978f17ba42

SHA256
8e9e93a7ae39aa3c6e17a11d567cf52e6190b726d76e6f60b57e9db99ee58bb6

SHA512
30b1fb67767eb5b15bd9d45091d9f184811d4934faeed47b672315d8c8d05b9dc031a6a02addb4b71de1c6b286cc62ef61db2f55dfe4df4bd3c584f256ca49a2

Download Submit
\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrv.exe
MD5
395a1a546b4424e3f11cd3ea26066ff9

SHA1
2f18bf153ed75cd9f33f356d1b9b02219c3a1279

SHA256
5dd67a6408d0421a214abba36a7642591cce652f8eac6f71f6d357c154025e6a

SHA512
2a5a398a56f895bffb245b830fd9b3003d887c2a71c6f1e022fd25bcec303cacd691dc744c0121f1d93f1f6e9887da386b3fab096ec0090a607d2d1aa72710a7

Download Submit
\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrv.exe
MD5
f018e9eb66dc53d840ee98c5926f1e2e

SHA1
8e736010173688f982e5713fa8b70c978f17ba42

SHA256
8e9e93a7ae39aa3c6e17a11d567cf52e6190b726d76e6f60b57e9db99ee58bb6

SHA512
30b1fb67767eb5b15bd9d45091d9f184811d4934faeed47b672315d8c8d05b9dc031a6a02addb4b71de1c6b286cc62ef61db2f55dfe4df4bd3c584f256ca49a2

Download Submit
\Users\Admin\AppData\Local\Temp\e5094b9e567150427a779a3e2803f4ff544c92be031da5d68685f275b7e07bebSrvSrvSrv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/880-91-0x0000000000000000-mapping.dmp

Download
memory/1228-115-0x0000000000000000-mapping.dmp

Download
memory/1284-99-0x0000000000000000-mapping.dmp

Download
memory/1352-89-0x0000000000000000-mapping.dmp

Download
memory/1552-96-0x0000000000000000-mapping.dmp

Download
memory/1552-100-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

Filesize
8KB

Download
memory/1756-84-0x0000000000000000-mapping.dmp

Download
memory/1776-80-0x0000000000000000-mapping.dmp

Download
memory/1796-83-0x0000000000000000-mapping.dmp

Download
memory/1796-109-0x0000000000230000-0x000000000025E000-memory.dmp

Filesize
184KB

Download
memory/1992-114-0x0000000000000000-mapping.dmp

Download
memory/1996-105-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/1996-106-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1996-72-0x0000000000000000-mapping.dmp

Download
memory/2000-70-0x0000000000000000-mapping.dmp

Download
memory/2000-107-0x00000000001C0000-0x00000000001FD000-memory.dmp

Filesize
244KB

Download
memory/2000-86-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2012-118-0x00000000002E0000-0x00000000002E2000-memory.dmp

Filesize
8KB

Download
memory/2012-113-0x0000000000000000-mapping.dmp

Download
memory/2020-111-0x0000000000000000-mapping.dmp

Download
memory/2024-101-0x00000000001C0000-0x00000000001FD000-memory.dmp

Filesize
244KB

Download
memory/2024-102-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2024-63-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/2024-61-0x0000000000000000-mapping.dmp

Download
memory/2032-112-0x0000000000000000-mapping.dmp

Download
memory/2036-77-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2036-103-0x0000000000230000-0x000000000025E000-memory.dmp

Filesize
184KB

Download
memory/2036-65-0x0000000000000000-mapping.dmp

Download
memory/2036-104-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download