ramnit | 41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f

Analysis

max time kernel
4294196s
max time network
139s
platform
windows7_x64
resource
win7-20220223-en
submitted
08-03-2022 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe
Size

313KB
MD5

e53fccd8979a713d50247bd9b715a8c8
SHA1

6d5c963ffd74b59b425ad2434db49e514073c353
SHA256

41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f
SHA512

e6894a2f75ac004462875e0831b02d2dd77ae1d2d12404c61ca72f53b66ede7d10fbb9e9c28b80e0b47a40454b1225eed0eaeb589d75ea86259f978b60dff048

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 3 IoCs

Processes:

41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exeDesktopLayer.exe41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe

pid	process
1060	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
1688	DesktopLayer.exe
584	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	upx
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral1/memory/1060-61-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1688-65-0x0000000000400000-0x0000000000442000-memory.dmp	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	upx
behavioral1/memory/584-73-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Loads dropped DLL 3 IoCs

Processes:

41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe

pid	process
1052	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe
1060	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
1104	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe

Drops file in System32 directory 62 IoCs

Processes:

iexplore.exeIEXPLORE.EXEie4uinit.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\imagestore\lc36869\imagestore.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\PCEHACD2.txt	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Favorites\desktop.ini	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E09AEAE3-9F17-11EC-8908-EAF2A4BFED9A}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\LH5AN2L7.txt	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\BWQNPYB2.txt	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\622AMRUB.txt	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\63X0LG8V.txt	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\63X0LG8V.txt	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Favorites	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\imagestore\lc36869\imagestore.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\PCEHACD2.txt	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\Favorites\Links\Suggested Sites.url	iexplore.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\suggestions[1].en-US	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\DNTException\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\BWQNPYB2.txt	iexplore.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\favicon[1].ico	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\favicon[2].ico	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\Favorites\Links\Suggested Sites.url:favicon	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatCache\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\favicon[2].ico	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\0JG5PCZY.txt	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk	ie4uinit.exe
File created	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\FRYMUQXB.txt	iexplore.exe
File created	C:\Windows\System32\config\systemprofile\Favorites\Links\Suggested Sites.url\:favicon:$DATA	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E09AEAE1-9F17-11EC-8908-EAF2A4BFED9A}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ieonline.microsoft[1]	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E09AEAE1-9F17-11EC-8908-EAF2A4BFED9A}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low	iexplore.exe
File opened for modification	C:\Windows\System32\config\systemprofile\Favorites\Links\desktop.ini	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\Favorites\Links\Suggested Sites.url	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\W4O8WWUT.txt	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\0JG5PCZY.txt	iexplore.exe
File opened for modification	C:\Windows\System32\config\systemprofile\Favorites\Links	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\622AMRUB.txt	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\FRYMUQXB.txt	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\LH5AN2L7.txt	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\W4O8WWUT.txt	iexplore.exe

Drops file in Program Files directory 5 IoCs

Processes:

41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px35C0.tmp	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px339E.tmp	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "353533522"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E061C9E1-9F17-11EC-8908-EAF2A4BFED9A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E09AEAE1-9F17-11EC-8908-EAF2A4BFED9A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0027000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81 = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000055fc87639bb28d429a2af20f94eeec260000000002000000000010660000000100002000000011fdb116914fe168d1aff4d6955ff87269496801ec6df71589546c4451cea605000000000e8000000002000020000000390498508664a815c64753bc4f10b62633e8107ba4bce1d114b78c798debe841100000000d414ff902762c46e00b60508526bd5a40000000a024bc5c404b2bda946b8b06436010d7dfed2b60a475f5a941ffef7d8153d9255862e83b9505b7bdb6d1f14547b8a24fb1b9a6a1c99e65768b4c23a7636cf29f	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Passport	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\Flags = "512"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\RepService	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Suggested Sites\MigrationTime = 201e00a42433d801	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-03-cc-01-9d-73\WpadDecision = "0"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}\Enum	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\Flags = "1024"	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Setup\UrlHistoryMigrationTime = 6050e8a32433d801	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\ImageStoreRandomFolder = "lc36869"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore\Count = "1"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Setup	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\MAO Settings\DiscardLoadTimes = 6045d5a32433d801	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Time = e60703000200080013002a001a00f001	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\Flags = "1024"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046}	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021493-0000-0000-C000-000000000046}	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\Software\Microsoft	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\VerCache = 0086a9a807ccca010086a9a807ccca01000000009093660000000e00e803991200000e000000991209040000	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\LinksBar	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\LinksBar\LinksFolderMigrate = 404207a42433d801	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046}\Enum	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6A2FD3C8-56D5-4E45-A963-46F0F6002C67}	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Feeds	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exeDesktopLayer.exe41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe

pid	process
1052	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe
1688	DesktopLayer.exe
1688	DesktopLayer.exe
1688	DesktopLayer.exe
1688	DesktopLayer.exe
584	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
584	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
584	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
584	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

1520 iexplore.exe

pid	process
1520	iexplore.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe

description	pid	process
Token: SeDebugPrivilege	1052	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe
Token: SeDebugPrivilege	1104	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

1520 iexplore.exe
1828 iexplore.exe

pid	process
1520	iexplore.exe
1828	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
1828	iexplore.exe
1828	iexplore.exe
1520	iexplore.exe
1520	iexplore.exe
1320	IEXPLORE.EXE
1320	IEXPLORE.EXE
820	IEXPLORE.EXE
820	IEXPLORE.EXE
820	IEXPLORE.EXE
820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exeDesktopLayer.exe41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 1052 wrote to memory of 1060	1052	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
PID 1052 wrote to memory of 1060	1052	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
PID 1052 wrote to memory of 1060	1052	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
PID 1052 wrote to memory of 1060	1052	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
PID 1060 wrote to memory of 1688	1060	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	DesktopLayer.exe
PID 1060 wrote to memory of 1688	1060	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	DesktopLayer.exe
PID 1060 wrote to memory of 1688	1060	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	DesktopLayer.exe
PID 1060 wrote to memory of 1688	1060	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	DesktopLayer.exe
PID 1688 wrote to memory of 1520	1688	DesktopLayer.exe	iexplore.exe
PID 1688 wrote to memory of 1520	1688	DesktopLayer.exe	iexplore.exe
PID 1688 wrote to memory of 1520	1688	DesktopLayer.exe	iexplore.exe
PID 1688 wrote to memory of 1520	1688	DesktopLayer.exe	iexplore.exe
PID 1104 wrote to memory of 584	1104	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
PID 1104 wrote to memory of 584	1104	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
PID 1104 wrote to memory of 584	1104	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
PID 1104 wrote to memory of 584	1104	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
PID 584 wrote to memory of 1828	584	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	iexplore.exe
PID 584 wrote to memory of 1828	584	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	iexplore.exe
PID 584 wrote to memory of 1828	584	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	iexplore.exe
PID 584 wrote to memory of 1828	584	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	iexplore.exe
PID 1828 wrote to memory of 972	1828	iexplore.exe	ie4uinit.exe
PID 1828 wrote to memory of 972	1828	iexplore.exe	ie4uinit.exe
PID 1828 wrote to memory of 972	1828	iexplore.exe	ie4uinit.exe
PID 1828 wrote to memory of 1320	1828	iexplore.exe	IEXPLORE.EXE
PID 1828 wrote to memory of 1320	1828	iexplore.exe	IEXPLORE.EXE
PID 1828 wrote to memory of 1320	1828	iexplore.exe	IEXPLORE.EXE
PID 1828 wrote to memory of 1320	1828	iexplore.exe	IEXPLORE.EXE
PID 1520 wrote to memory of 820	1520	iexplore.exe	IEXPLORE.EXE
PID 1520 wrote to memory of 820	1520	iexplore.exe	IEXPLORE.EXE
PID 1520 wrote to memory of 820	1520	iexplore.exe	IEXPLORE.EXE
PID 1520 wrote to memory of 820	1520	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe
"C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052

C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1060

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1520 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:820

C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe
"C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe" /GetKeys WirelessKeyView0F763321
2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104

C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:584

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\System32\ie4uinit.exe
"C:\Windows\System32\ie4uinit.exe" -ShowQLIcon
5⤵
- Drops file in System32 directory
PID:972

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1828 CREDAT:275457 /prefetch:2
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1320

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
5b97603af0fc8f1dd40fc69bd6ca89cf

SHA1
18d63dbde43a5bc700ae55b9a013c596021ccd13

SHA256
33d3f697332b0fc4e09540cb9dc622ac0675fb8b2733554d4c0199307774ab52

SHA512
2064f951456fe29693f2653c88d44c2e6644af1087abc0d0d87ee5b81aae4c68cb7b459672741fe2cf635feda7994695741ca066493d80b90c470289bacd8acd

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
5b97603af0fc8f1dd40fc69bd6ca89cf

SHA1
18d63dbde43a5bc700ae55b9a013c596021ccd13

SHA256
33d3f697332b0fc4e09540cb9dc622ac0675fb8b2733554d4c0199307774ab52

SHA512
2064f951456fe29693f2653c88d44c2e6644af1087abc0d0d87ee5b81aae4c68cb7b459672741fe2cf635feda7994695741ca066493d80b90c470289bacd8acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
MD5
5b97603af0fc8f1dd40fc69bd6ca89cf

SHA1
18d63dbde43a5bc700ae55b9a013c596021ccd13

SHA256
33d3f697332b0fc4e09540cb9dc622ac0675fb8b2733554d4c0199307774ab52

SHA512
2064f951456fe29693f2653c88d44c2e6644af1087abc0d0d87ee5b81aae4c68cb7b459672741fe2cf635feda7994695741ca066493d80b90c470289bacd8acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
MD5
5b97603af0fc8f1dd40fc69bd6ca89cf

SHA1
18d63dbde43a5bc700ae55b9a013c596021ccd13

SHA256
33d3f697332b0fc4e09540cb9dc622ac0675fb8b2733554d4c0199307774ab52

SHA512
2064f951456fe29693f2653c88d44c2e6644af1087abc0d0d87ee5b81aae4c68cb7b459672741fe2cf635feda7994695741ca066493d80b90c470289bacd8acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
MD5
5b97603af0fc8f1dd40fc69bd6ca89cf

SHA1
18d63dbde43a5bc700ae55b9a013c596021ccd13

SHA256
33d3f697332b0fc4e09540cb9dc622ac0675fb8b2733554d4c0199307774ab52

SHA512
2064f951456fe29693f2653c88d44c2e6644af1087abc0d0d87ee5b81aae4c68cb7b459672741fe2cf635feda7994695741ca066493d80b90c470289bacd8acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
MD5
5b97603af0fc8f1dd40fc69bd6ca89cf

SHA1
18d63dbde43a5bc700ae55b9a013c596021ccd13

SHA256
33d3f697332b0fc4e09540cb9dc622ac0675fb8b2733554d4c0199307774ab52

SHA512
2064f951456fe29693f2653c88d44c2e6644af1087abc0d0d87ee5b81aae4c68cb7b459672741fe2cf635feda7994695741ca066493d80b90c470289bacd8acd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\IDKV8IYE.txt
MD5
c544798cb5aa83628348a0fc02e7fcac

SHA1
f9157cb289e4318ecb4b41e3443606627c58e5ef

SHA256
aa0bb0506df57cec858fdb91a3bb49b8c96c27fb91511ff4f2a958279c120fe0

SHA512
18591d7230d8d46de7ce186370d77199ebad5f271948696d17542b274759d75060c3ac9469b95ae86b498d0fdc1ba380689d88497d36b4300f5d09172ae5e7ca

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
5b97603af0fc8f1dd40fc69bd6ca89cf

SHA1
18d63dbde43a5bc700ae55b9a013c596021ccd13

SHA256
33d3f697332b0fc4e09540cb9dc622ac0675fb8b2733554d4c0199307774ab52

SHA512
2064f951456fe29693f2653c88d44c2e6644af1087abc0d0d87ee5b81aae4c68cb7b459672741fe2cf635feda7994695741ca066493d80b90c470289bacd8acd

Download Submit
\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
MD5
5b97603af0fc8f1dd40fc69bd6ca89cf

SHA1
18d63dbde43a5bc700ae55b9a013c596021ccd13

SHA256
33d3f697332b0fc4e09540cb9dc622ac0675fb8b2733554d4c0199307774ab52

SHA512
2064f951456fe29693f2653c88d44c2e6644af1087abc0d0d87ee5b81aae4c68cb7b459672741fe2cf635feda7994695741ca066493d80b90c470289bacd8acd

Download Submit
\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
MD5
5b97603af0fc8f1dd40fc69bd6ca89cf

SHA1
18d63dbde43a5bc700ae55b9a013c596021ccd13

SHA256
33d3f697332b0fc4e09540cb9dc622ac0675fb8b2733554d4c0199307774ab52

SHA512
2064f951456fe29693f2653c88d44c2e6644af1087abc0d0d87ee5b81aae4c68cb7b459672741fe2cf635feda7994695741ca066493d80b90c470289bacd8acd

Download Submit
memory/584-72-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/584-73-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/584-74-0x0000000076F10000-0x0000000077090000-memory.dmp

Filesize
1.5MB

Download
memory/1052-54-0x0000000074E61000-0x0000000074E63000-memory.dmp

Filesize
8KB

Download
memory/1060-61-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1688-64-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1688-65-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1688-67-0x0000000076F10000-0x0000000077090000-memory.dmp

Filesize
1.5MB

Download