Analysis
-
max time kernel
145s -
max time network
161s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
19-10-2021 14:05
Static task
static1
Behavioral task
behavioral1
Sample
Rambox-0.7.9-win.exe
Resource
win11
Behavioral task
behavioral2
Sample
Rambox-0.7.9-win.exe
Resource
win10-en-20210920
General
-
Target
Rambox-0.7.9-win.exe
-
Size
112.3MB
-
MD5
d3b36737818f47270c788fae167446d2
-
SHA1
5a5e09c9365325ac640ada70e97d060d8984360c
-
SHA256
2aa345f263242d17215171ee9355dbe4f73096f29a76c23adfd272f6fe659649
-
SHA512
fe080ee14053a2e9cbb092b2bf9eace7e471ed357653ef776662d8d4f95da8cdc9cfa2ba872e5142ed47b4a49a48d4220cd6a126766f100789fe7e00e5f5eb48
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
Processes:
Rambox.exeRambox.exeRambox.exeRambox.exeRambox.exeRambox.exepid process 1552 Rambox.exe 3240 Rambox.exe 3548 Rambox.exe 532 Rambox.exe 1960 Rambox.exe 2092 Rambox.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Rambox.exeRambox.exeRambox.exeRambox.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation Rambox.exe Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation Rambox.exe Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation Rambox.exe Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation Rambox.exe -
Loads dropped DLL 20 IoCs
Processes:
Rambox-0.7.9-win.exeRambox.exeRambox.exeRambox.exeRambox.exeRambox.exeRambox.exepid process 2124 Rambox-0.7.9-win.exe 2124 Rambox-0.7.9-win.exe 2124 Rambox-0.7.9-win.exe 2124 Rambox-0.7.9-win.exe 2124 Rambox-0.7.9-win.exe 2124 Rambox-0.7.9-win.exe 2124 Rambox-0.7.9-win.exe 2124 Rambox-0.7.9-win.exe 2124 Rambox-0.7.9-win.exe 2124 Rambox-0.7.9-win.exe 2124 Rambox-0.7.9-win.exe 1552 Rambox.exe 3240 Rambox.exe 3548 Rambox.exe 532 Rambox.exe 3240 Rambox.exe 3240 Rambox.exe 3240 Rambox.exe 1960 Rambox.exe 2092 Rambox.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rambox = "\"C:\\Program Files\\Rambox\\Rambox.exe\"" reg.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
Rambox-0.7.9-win.exedescription ioc process File created C:\Program Files\Rambox\chrome_200_percent.pak Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\locales\es.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\ja.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\mr.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\uk.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\resources\app-update.yml Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\snapshot_blob.bin Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\sr.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\libGLESv2.dll Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\am.pak Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\locales\he.pak Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\snapshot_blob.bin Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\swiftshader\libEGL.dll Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\chrome_100_percent.pak Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\LICENSES.chromium.html Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\de.pak Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\locales\fa.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\he.pak Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\locales\ml.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\tr.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\resources\elevate.exe Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\el.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\fr.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\ko.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\ro.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\sl.pak Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\locales\zh-TW.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\vk_swiftshader_icd.json Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\locales\th.pak Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\d3dcompiler_47.dll Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\ffmpeg.dll Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\da.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\nl.pak Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\locales\uk.pak Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\resources.pak Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\locales\el.pak Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\locales\hr.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\vulkan-1.dll Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\fi.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\nb.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\resources\app.asar Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\v8_context_snapshot.bin Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\d3dcompiler_47.dll Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\Rambox.exe Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\resources\elevate.exe Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\locales\bg.pak Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\locales\cs.pak Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\locales\id.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\pt-PT.pak Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\libEGL.dll Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\LICENSE.electron.txt Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\locales\bn.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\hr.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\kn.pak Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\locales\nl.pak Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\locales\ru.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\LICENSES.chromium.html Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\locales\tr.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\ar.pak Rambox-0.7.9-win.exe File created C:\Program Files\Rambox\locales\de.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\en-US.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\es-419.pak Rambox-0.7.9-win.exe File opened for modification C:\Program Files\Rambox\locales\gu.pak Rambox-0.7.9-win.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 1 IoCs
-
Processes:
Rambox.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000040000000100000010000000324a4bbbc863699bbe749ac6dd1d4624030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 Rambox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 Rambox.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6362000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c60b000000010000001a0000004900530052004700200052006f006f0074002000580031000000090000000100000016000000301406082b0601050507030206082b0601050507030114000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e1d000000010000001000000073b6876195f5d18e048510422aef04e3030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e820000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Rambox.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 1900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81d000000010000001000000073b6876195f5d18e048510422aef04e314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e090000000100000016000000301406082b0601050507030206082b060105050703010b000000010000001a0000004900530052004700200052006f006f007400200058003100000062000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6320000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Rambox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A Rambox.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 Rambox.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d4624030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 Rambox.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e260f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 Rambox.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Rambox-0.7.9-win.exeRambox.exeRambox.exeRambox.exeRambox.exeRambox.exepid process 2124 Rambox-0.7.9-win.exe 2124 Rambox-0.7.9-win.exe 2124 Rambox-0.7.9-win.exe 2124 Rambox-0.7.9-win.exe 2124 Rambox-0.7.9-win.exe 2124 Rambox-0.7.9-win.exe 3548 Rambox.exe 3548 Rambox.exe 532 Rambox.exe 532 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1960 Rambox.exe 1960 Rambox.exe 2092 Rambox.exe 2092 Rambox.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Rambox-0.7.9-win.exedescription pid process Token: SeSecurityPrivilege 2124 Rambox-0.7.9-win.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
Rambox.exepid process 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
Rambox.exepid process 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe 1552 Rambox.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
Rambox.exedescription pid process target process PID 1552 wrote to memory of 1904 1552 Rambox.exe reg.exe PID 1552 wrote to memory of 1904 1552 Rambox.exe reg.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3240 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3548 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 3548 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 532 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 532 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 1960 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 1960 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 2092 1552 Rambox.exe Rambox.exe PID 1552 wrote to memory of 2092 1552 Rambox.exe Rambox.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rambox-0.7.9-win.exe"C:\Users\Admin\AppData\Local\Temp\Rambox-0.7.9-win.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
C:\Program Files\Rambox\Rambox.exe"C:\Program Files\Rambox\Rambox.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Rambox /t REG_SZ /d "\"C:\Program Files\Rambox\Rambox.exe\"" /f2⤵
- Adds Run key to start application
- Modifies registry key
PID:1904 -
C:\Program Files\Rambox\Rambox.exe"C:\Program Files\Rambox\Rambox.exe" --type=gpu-process --field-trial-handle=1556,9066427115540124798,14542500070151987357,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,CrossOriginOpenerPolicy,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1564 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3240 -
C:\Program Files\Rambox\Rambox.exe"C:\Program Files\Rambox\Rambox.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,9066427115540124798,14542500070151987357,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,CrossOriginOpenerPolicy,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1828 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:3548 -
C:\Program Files\Rambox\Rambox.exe"C:\Program Files\Rambox\Rambox.exe" --type=renderer --field-trial-handle=1556,9066427115540124798,14542500070151987357,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,CrossOriginOpenerPolicy,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-user-model-id=com.grupovrs.ramboxce --app-path="C:\Program Files\Rambox\resources\app.asar" --enable-plugins --node-integration --webview-tag --no-sandbox --no-zygote --enable-remote-module --background-color=#FFF --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:12⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:532 -
C:\Program Files\Rambox\Rambox.exe"C:\Program Files\Rambox\Rambox.exe" --type=renderer --field-trial-handle=1556,9066427115540124798,14542500070151987357,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,CrossOriginOpenerPolicy,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id=com.grupovrs.ramboxce --app-path="C:\Program Files\Rambox\resources\app.asar" --enable-plugins --no-sandbox --no-zygote --native-window-open --preload="C:\Program Files\Rambox\resources\app.asar\resources\js\rambox-service-api.js" --enable-remote-module --background-color=#fff --guest-instance-id=2 --enable-blink-features --disable-blink-features --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:12⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1960 -
C:\Program Files\Rambox\Rambox.exe"C:\Program Files\Rambox\Rambox.exe" --type=renderer --field-trial-handle=1556,9066427115540124798,14542500070151987357,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,CrossOriginOpenerPolicy,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id=com.grupovrs.ramboxce --app-path="C:\Program Files\Rambox\resources\app.asar" --enable-plugins --no-sandbox --no-zygote --native-window-open --preload="C:\Program Files\Rambox\resources\app.asar\resources\js\rambox-service-api.js" --enable-remote-module --background-color=#fff --guest-instance-id=2 --enable-blink-features --disable-blink-features --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:12⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2092
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Rambox\D3DCompiler_47.dllMD5
7641e39b7da4077084d2afe7c31032e0
SHA12256644f69435ff2fee76deb04d918083960d1eb
SHA25644422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
SHA5128010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
-
C:\Program Files\Rambox\Rambox.exeMD5
3c7933385b18471bb8916ad64d302af5
SHA1ee3d04c6e3cc415fe66349baf970ed5d574f4665
SHA256243018da9f22e10e4779a3e97133d33af83328d18d95e816c9ae4463247d0e14
SHA512279a7271f60beb1fe3a893bbb133850ec5c3445ae18d9c5ab16e0e9cafffa1a3b42bd126f055287836ed542a86b764d428417e437ac2b28c4186bf6f64cbad63
-
C:\Program Files\Rambox\Rambox.exeMD5
3c7933385b18471bb8916ad64d302af5
SHA1ee3d04c6e3cc415fe66349baf970ed5d574f4665
SHA256243018da9f22e10e4779a3e97133d33af83328d18d95e816c9ae4463247d0e14
SHA512279a7271f60beb1fe3a893bbb133850ec5c3445ae18d9c5ab16e0e9cafffa1a3b42bd126f055287836ed542a86b764d428417e437ac2b28c4186bf6f64cbad63
-
C:\Program Files\Rambox\Rambox.exeMD5
3c7933385b18471bb8916ad64d302af5
SHA1ee3d04c6e3cc415fe66349baf970ed5d574f4665
SHA256243018da9f22e10e4779a3e97133d33af83328d18d95e816c9ae4463247d0e14
SHA512279a7271f60beb1fe3a893bbb133850ec5c3445ae18d9c5ab16e0e9cafffa1a3b42bd126f055287836ed542a86b764d428417e437ac2b28c4186bf6f64cbad63
-
C:\Program Files\Rambox\Rambox.exeMD5
3c7933385b18471bb8916ad64d302af5
SHA1ee3d04c6e3cc415fe66349baf970ed5d574f4665
SHA256243018da9f22e10e4779a3e97133d33af83328d18d95e816c9ae4463247d0e14
SHA512279a7271f60beb1fe3a893bbb133850ec5c3445ae18d9c5ab16e0e9cafffa1a3b42bd126f055287836ed542a86b764d428417e437ac2b28c4186bf6f64cbad63
-
C:\Program Files\Rambox\Rambox.exeMD5
3c7933385b18471bb8916ad64d302af5
SHA1ee3d04c6e3cc415fe66349baf970ed5d574f4665
SHA256243018da9f22e10e4779a3e97133d33af83328d18d95e816c9ae4463247d0e14
SHA512279a7271f60beb1fe3a893bbb133850ec5c3445ae18d9c5ab16e0e9cafffa1a3b42bd126f055287836ed542a86b764d428417e437ac2b28c4186bf6f64cbad63
-
C:\Program Files\Rambox\Rambox.exeMD5
3c7933385b18471bb8916ad64d302af5
SHA1ee3d04c6e3cc415fe66349baf970ed5d574f4665
SHA256243018da9f22e10e4779a3e97133d33af83328d18d95e816c9ae4463247d0e14
SHA512279a7271f60beb1fe3a893bbb133850ec5c3445ae18d9c5ab16e0e9cafffa1a3b42bd126f055287836ed542a86b764d428417e437ac2b28c4186bf6f64cbad63
-
C:\Program Files\Rambox\Rambox.exeMD5
3c7933385b18471bb8916ad64d302af5
SHA1ee3d04c6e3cc415fe66349baf970ed5d574f4665
SHA256243018da9f22e10e4779a3e97133d33af83328d18d95e816c9ae4463247d0e14
SHA512279a7271f60beb1fe3a893bbb133850ec5c3445ae18d9c5ab16e0e9cafffa1a3b42bd126f055287836ed542a86b764d428417e437ac2b28c4186bf6f64cbad63
-
C:\Program Files\Rambox\chrome_100_percent.pakMD5
06baf0ad34e0231bd76651203dba8326
SHA1a5f99ecdcc06dec9d7f9ce0a8c66e46969117391
SHA2565ae14147992a92548bcad76867dd88cdfcdb69d951c8720920cce6fb135e3189
SHA512aff6616e56781ebb925a0ca146245ad3b2827250b32261c0c7c0d5b10b20a343a17fc3761c95d93104163e77b2eae3f1f9cbd3cb2b377f49b42bea39bdd09b91
-
C:\Program Files\Rambox\chrome_200_percent.pakMD5
57c27201e7cd33471da7ec205fe9973c
SHA1a8e7bce09c4cbdae2797611b2be8aeb5491036f9
SHA256dd8146b2ee289e4d54a4a0f1fd3b2f61b979c6a2baaba96a406d96c3f4fdb33b
SHA51257258aa169bec66abf0f45a3e026bb68751fb970b74bd0cb465607fa3b2a89967e832d92d8f675f0449bb6662fcb7786d05f0597124cc8e18bb99a47245779b4
-
C:\Program Files\Rambox\ffmpeg.dllMD5
4f3f7ba723c5e8b617407c7a57e568ba
SHA17aa11a45e1c1826ee58dabd2773256a6df5da262
SHA256b08d2a9076f65a83420cabcb42bb0ed8364683c77f8ff608e16acd0f8615b0c6
SHA5122a0b61d6223a6e7e105558ac52e128ed7bf0050f6ddd1fd80de6ce0ac89157b0c9d6de696349a8c95b7b3afe54fa555d34993a5b17eb68db51cdbb0443e84241
-
C:\Program Files\Rambox\icudtl.datMD5
ad2988770b8cb3281a28783ad833a201
SHA194b7586ee187d9b58405485f4c551b55615f11b5
SHA256df876c7af43ed93eec6aea4d2d55c805009c219653cdeb368f1d048f4922b108
SHA512f27e542a9c6c60fa28c5b7cc2818079341ef93aef3bbcadecad2dc11aff5b1592b19c7ebfa543ea42a3cbfec26a668641b255545fb0912056e25e852c2dedd01
-
C:\Program Files\Rambox\locales\en-US.pakMD5
bd8f7b719110342b7cefb16ddd05ec55
SHA182a79aeaa1dd4b1464b67053ba1766a4498c13e7
SHA256d1d3f892be16329c79f9a8ee8c5fa1c9fb46d17edfeb56a3d9407f9d7587a0de
SHA5127cd1493e59e87c70927e66769eb200f79a57e1eb1223af4eb4064088571893d3e32cbc4b5ece568fd308992aad65684aa280dc9834f2b5d327bdee514b046e5e
-
C:\Program Files\Rambox\resources.pakMD5
d13873f6fb051266deb3599b14535806
SHA1143782c0ce5a5773ae0aae7a22377c8a6d18a5b2
SHA2567b953443e3cd54a0a4775528b52fbfe5ebecbc2c71731600ed0999d227969506
SHA5121ab38fcb70d1958c74da2493459532b52a04b884009509a1ac8dd39f6e9e670658a52f4d19ef57f1bc71dccfdd6ceedbc18034bbcad0b500d75a97c74aac6939
-
C:\Program Files\Rambox\resources\app.asarMD5
d517d3cca304a39bf86197d94ef35954
SHA1c371c5800707fd39f9964b3b1eb4af0b4f28c2d2
SHA256a70b371b38206d1d19feffd674b23dc202aed98b5d05fae6a8f400606b1f8359
SHA5120d49a83aeac93d3541a53abcc1d0e81b712d745a5f65057e2645230b8a2e7e18ef01c482f55efe7f7f34a9a029d15d318e181bfc428c3cbbc1c000080041a641
-
C:\Program Files\Rambox\swiftshader\libegl.dllMD5
0bca9efb4be44d8987760e3b1ff76032
SHA17b99640f857e4c0108a593fa05a4b03d35dd5dc6
SHA2566d6b066929f7621800a61b53d4cafc6f7962b88b601bb9e8859416efaf3b0a1f
SHA5122b1dc34e88ed0e91cc229bf2da383ebe18aae2e89f69a56ed494b836d6752e415f14ac27e49aa40784dafaa481065a8a35202645a15f5cbefc31725082417d10
-
C:\Program Files\Rambox\swiftshader\libglesv2.dllMD5
dbd413214ce785796914d79dbe0b3ee7
SHA13a2d86aa4562a05d601aed131e797c003365c03f
SHA256bec01a8fe41898656204d5397de04089d0cee5a3fb9f0bcbc1753af8a6a526a8
SHA512acf5d65616d280e133f9ec8d84dcc07f012e5305e6b8b368a3db113b7aeb113bdfbaf1cd8813c368699d5964a6983fba3e96a12c05d92c90f1df43a68c93fe4e
-
C:\Program Files\Rambox\v8_context_snapshot.binMD5
c2208c06c8ff81bca3c092cc42b8df1b
SHA1f7b9faa9ba0e72d062f68642a02cc8f3fed49910
SHA2564a67de195878d290f49b503b83e415917b8bbcbd9936b07a5d33b48e9bc6e0a3
SHA5126c3c370dd086a976c44d4059a315bd3bcbb50961aa34734e65a40d861cffca9090d47cec74575afe23952e394e4845bda2d8798eebe01fb54a7a6288bce238f5
-
\Program Files\Rambox\d3dcompiler_47.dllMD5
7641e39b7da4077084d2afe7c31032e0
SHA12256644f69435ff2fee76deb04d918083960d1eb
SHA25644422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
SHA5128010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
-
\Program Files\Rambox\ffmpeg.dllMD5
4f3f7ba723c5e8b617407c7a57e568ba
SHA17aa11a45e1c1826ee58dabd2773256a6df5da262
SHA256b08d2a9076f65a83420cabcb42bb0ed8364683c77f8ff608e16acd0f8615b0c6
SHA5122a0b61d6223a6e7e105558ac52e128ed7bf0050f6ddd1fd80de6ce0ac89157b0c9d6de696349a8c95b7b3afe54fa555d34993a5b17eb68db51cdbb0443e84241
-
\Program Files\Rambox\ffmpeg.dllMD5
4f3f7ba723c5e8b617407c7a57e568ba
SHA17aa11a45e1c1826ee58dabd2773256a6df5da262
SHA256b08d2a9076f65a83420cabcb42bb0ed8364683c77f8ff608e16acd0f8615b0c6
SHA5122a0b61d6223a6e7e105558ac52e128ed7bf0050f6ddd1fd80de6ce0ac89157b0c9d6de696349a8c95b7b3afe54fa555d34993a5b17eb68db51cdbb0443e84241
-
\Program Files\Rambox\ffmpeg.dllMD5
4f3f7ba723c5e8b617407c7a57e568ba
SHA17aa11a45e1c1826ee58dabd2773256a6df5da262
SHA256b08d2a9076f65a83420cabcb42bb0ed8364683c77f8ff608e16acd0f8615b0c6
SHA5122a0b61d6223a6e7e105558ac52e128ed7bf0050f6ddd1fd80de6ce0ac89157b0c9d6de696349a8c95b7b3afe54fa555d34993a5b17eb68db51cdbb0443e84241
-
\Program Files\Rambox\ffmpeg.dllMD5
4f3f7ba723c5e8b617407c7a57e568ba
SHA17aa11a45e1c1826ee58dabd2773256a6df5da262
SHA256b08d2a9076f65a83420cabcb42bb0ed8364683c77f8ff608e16acd0f8615b0c6
SHA5122a0b61d6223a6e7e105558ac52e128ed7bf0050f6ddd1fd80de6ce0ac89157b0c9d6de696349a8c95b7b3afe54fa555d34993a5b17eb68db51cdbb0443e84241
-
\Program Files\Rambox\ffmpeg.dllMD5
4f3f7ba723c5e8b617407c7a57e568ba
SHA17aa11a45e1c1826ee58dabd2773256a6df5da262
SHA256b08d2a9076f65a83420cabcb42bb0ed8364683c77f8ff608e16acd0f8615b0c6
SHA5122a0b61d6223a6e7e105558ac52e128ed7bf0050f6ddd1fd80de6ce0ac89157b0c9d6de696349a8c95b7b3afe54fa555d34993a5b17eb68db51cdbb0443e84241
-
\Program Files\Rambox\ffmpeg.dllMD5
4f3f7ba723c5e8b617407c7a57e568ba
SHA17aa11a45e1c1826ee58dabd2773256a6df5da262
SHA256b08d2a9076f65a83420cabcb42bb0ed8364683c77f8ff608e16acd0f8615b0c6
SHA5122a0b61d6223a6e7e105558ac52e128ed7bf0050f6ddd1fd80de6ce0ac89157b0c9d6de696349a8c95b7b3afe54fa555d34993a5b17eb68db51cdbb0443e84241
-
\Program Files\Rambox\swiftshader\libEGL.dllMD5
0bca9efb4be44d8987760e3b1ff76032
SHA17b99640f857e4c0108a593fa05a4b03d35dd5dc6
SHA2566d6b066929f7621800a61b53d4cafc6f7962b88b601bb9e8859416efaf3b0a1f
SHA5122b1dc34e88ed0e91cc229bf2da383ebe18aae2e89f69a56ed494b836d6752e415f14ac27e49aa40784dafaa481065a8a35202645a15f5cbefc31725082417d10
-
\Program Files\Rambox\swiftshader\libGLESv2.dllMD5
dbd413214ce785796914d79dbe0b3ee7
SHA13a2d86aa4562a05d601aed131e797c003365c03f
SHA256bec01a8fe41898656204d5397de04089d0cee5a3fb9f0bcbc1753af8a6a526a8
SHA512acf5d65616d280e133f9ec8d84dcc07f012e5305e6b8b368a3db113b7aeb113bdfbaf1cd8813c368699d5964a6983fba3e96a12c05d92c90f1df43a68c93fe4e
-
\Users\Admin\AppData\Local\Temp\nshD6BA.tmp\StdUtils.dllMD5
c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
\Users\Admin\AppData\Local\Temp\nshD6BA.tmp\System.dllMD5
0d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
\Users\Admin\AppData\Local\Temp\nshD6BA.tmp\UAC.dllMD5
adb29e6b186daa765dc750128649b63d
SHA1160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA2562f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
-
\Users\Admin\AppData\Local\Temp\nshD6BA.tmp\WinShell.dllMD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
\Users\Admin\AppData\Local\Temp\nshD6BA.tmp\WinShell.dllMD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
\Users\Admin\AppData\Local\Temp\nshD6BA.tmp\WinShell.dllMD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
\Users\Admin\AppData\Local\Temp\nshD6BA.tmp\WinShell.dllMD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
\Users\Admin\AppData\Local\Temp\nshD6BA.tmp\nsDialogs.dllMD5
466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1eb607467009074278e4bd50c7eab400e95ae48f7
SHA2561e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
SHA5127508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
-
\Users\Admin\AppData\Local\Temp\nshD6BA.tmp\nsProcess.dllMD5
f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
\Users\Admin\AppData\Local\Temp\nshD6BA.tmp\nsProcess.dllMD5
f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
\Users\Admin\AppData\Local\Temp\nshD6BA.tmp\nsis7z.dllMD5
80e44ce4895304c6a3a831310fbf8cd0
SHA136bd49ae21c460be5753a904b4501f1abca53508
SHA256b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
-
memory/532-163-0x000001A99B610000-0x000001A99B612000-memory.dmpFilesize
8KB
-
memory/532-169-0x000001A99B610000-0x000001A99B612000-memory.dmpFilesize
8KB
-
memory/532-160-0x000001A99B610000-0x000001A99B612000-memory.dmpFilesize
8KB
-
memory/532-159-0x000001A99B610000-0x000001A99B612000-memory.dmpFilesize
8KB
-
memory/532-155-0x0000000000000000-mapping.dmp
-
memory/1552-135-0x0000016000040000-0x0000016000041000-memory.dmpFilesize
4KB
-
memory/1552-129-0x00000162F1A50000-0x00000162F1A52000-memory.dmpFilesize
8KB
-
memory/1552-128-0x00000162F1A50000-0x00000162F1A52000-memory.dmpFilesize
8KB
-
memory/1552-134-0x00000162F1A50000-0x00000162F1A52000-memory.dmpFilesize
8KB
-
memory/1904-137-0x0000000000000000-mapping.dmp
-
memory/1960-175-0x0000027F88560000-0x0000027F88562000-memory.dmpFilesize
8KB
-
memory/1960-170-0x0000000000000000-mapping.dmp
-
memory/1960-176-0x0000027F88560000-0x0000027F88562000-memory.dmpFilesize
8KB
-
memory/1960-172-0x0000027F88560000-0x0000027F88562000-memory.dmpFilesize
8KB
-
memory/1960-173-0x0000027F88560000-0x0000027F88562000-memory.dmpFilesize
8KB
-
memory/2092-185-0x0000021552CD0000-0x0000021552CD2000-memory.dmpFilesize
8KB
-
memory/2092-177-0x0000000000000000-mapping.dmp
-
memory/2092-186-0x0000021552CD0000-0x0000021552CD2000-memory.dmpFilesize
8KB
-
memory/2092-184-0x0000021552CD0000-0x0000021552CD2000-memory.dmpFilesize
8KB
-
memory/2092-183-0x0000021552CD0000-0x0000021552CD2000-memory.dmpFilesize
8KB
-
memory/2092-187-0x0000021552CD0000-0x0000021552CD2000-memory.dmpFilesize
8KB
-
memory/2092-182-0x0000021552CD0000-0x0000021552CD2000-memory.dmpFilesize
8KB
-
memory/2092-180-0x0000021552CD0000-0x0000021552CD2000-memory.dmpFilesize
8KB
-
memory/2092-179-0x0000021552CD0000-0x0000021552CD2000-memory.dmpFilesize
8KB
-
memory/3240-154-0x00000190614E0000-0x00000190614E2000-memory.dmpFilesize
8KB
-
memory/3240-146-0x00000190614E0000-0x00000190614E2000-memory.dmpFilesize
8KB
-
memory/3240-145-0x00007FFE17790000-0x00007FFE17791000-memory.dmpFilesize
4KB
-
memory/3240-147-0x00000190614E0000-0x00000190614E2000-memory.dmpFilesize
8KB
-
memory/3240-143-0x0000000000000000-mapping.dmp
-
memory/3240-142-0x000001906155E000-0x000001906155F000-memory.dmpFilesize
4KB
-
memory/3240-157-0x00000190614E0000-0x00000190614E2000-memory.dmpFilesize
8KB
-
memory/3548-151-0x000002726AD50000-0x000002726AD52000-memory.dmpFilesize
8KB
-
memory/3548-148-0x0000000000000000-mapping.dmp
-
memory/3548-153-0x000002726AD50000-0x000002726AD52000-memory.dmpFilesize
8KB