ramnit | b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1

Analysis

max time kernel
114s
max time network
157s
platform
windows7_x64
resource
win7-20220414-en
submitted
01-07-2022 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Size

1.8MB
MD5

4e9801421636a010d18358383c574794
SHA1

96fa3eb6ed1e7cd228ec7282f3289758cd2730c4
SHA256

b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1
SHA512

c0b885b710ea3b5c36ed837a602e72b806961d186d015e6824ed0e9f04db4b28db8e927ecf4672a9fb2ea1e666806877403d23c9016eb0af920c498ff0060b9b

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

ACProtect 1.3x - 1.4x DLL software 4 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Windows\SysWOW64\CAOSOFT_WEB_PRINT_lodop.ocx	acprotect
\Windows\SysWOW64\NPCAOSOFT_WEB_PRINT_lodop.dll	acprotect
\Windows\SysWOW64\CAOSOFT_WEB_PRINT_lodop.ocx	acprotect
\Windows\SysWOW64\CAOSOFT_WEB_PRINT_lodop.ocx	acprotect

Executes dropped EXE 2 IoCs

Processes:

b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exeDesktopLayer.exe

pid process

1904 b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
1944 DesktopLayer.exe

pid	process
1904	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
1944	DesktopLayer.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe	upx
\Users\Admin\AppData\Local\Temp\b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe	upx
\Users\Admin\AppData\Local\Temp\b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe	upx
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral1/memory/1904-66-0x0000000000400000-0x000000000042E000-memory.dmp	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral1/memory/1944-71-0x0000000000400000-0x000000000042E000-memory.dmp	upx
\Windows\SysWOW64\CAOSOFT_WEB_PRINT_lodop.ocx	upx
\Windows\SysWOW64\NPCAOSOFT_WEB_PRINT_lodop.dll	upx
\Windows\SysWOW64\CAOSOFT_WEB_PRINT_lodop.ocx	upx
\Windows\SysWOW64\CAOSOFT_WEB_PRINT_lodop.ocx	upx

Loads dropped DLL 10 IoCs

Processes:

b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exeb5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exeDesktopLayer.exe

pid	process
1620	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
1904	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
1904	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
1904	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
1944	DesktopLayer.exe
1944	DesktopLayer.exe
1620	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
1620	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
1620	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
1620	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe

Drops file in System32 directory 2 IoCs

Processes:

b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe

description	ioc	process
File created	C:\Windows\SysWOW64\CAOSOFT_WEB_PRINT_lodop.ocx	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
File created	C:\Windows\SysWOW64\NPCAOSOFT_WEB_PRINT_lodop.dll	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe

Drops file in Program Files directory 3 IoCs

Processes:

b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px3F71.tmp	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363423179"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01B7F911-F90A-11EC-87FE-52E0D673F3E2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Modifies registry class 64 IoCs

Processes:

b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\FLAGS\ = "2"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib\Version = "6.0"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{51ACF2AC-0574-4805-9483-B8ACB28ADBE0}\ProxyStubClsid32	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\InprocServer32\ = "C:\\Windows\\SysWow64\\CAOSOFT_WEB_PRINT_lodop.ocx"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ProgID\ = "Lodop.LodopX"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\TypeLib	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\Version = "6.0"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{51ACF2AC-0574-4805-9483-B8ACB28ADBE0}\ = "IActiveFormXEvents"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{51ACF2AC-0574-4805-9483-B8ACB28ADBE0}\TypeLib\Version = "6.0"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Lodop.LodopX\Clsid	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb\	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\ = "Lodop Web Print Library"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{51ACF2AC-0574-4805-9483-B8ACB28ADBE0}\TypeLib	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb\0	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ = "ILodopX"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ = "ILodopXEvents"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Lodop.LodopX\Clsid\ = "{2105C259-1E0C-4534-8141-A753534CB4CA}"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ProgID	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\MiscStatus	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\InprocServer32	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\0\win32\ = "C:\\Windows\\SysWow64\\CAOSOFT_WEB_PRINT_lodop.ocx"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AEF077AF-C40F-4AE3-9ED9-35A5728A85EC}\ProxyStubClsid32	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEF077AF-C40F-4AE3-9ED9-35A5728A85EC}\ = "IActiveFormX"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEF077AF-C40F-4AE3-9ED9-35A5728A85EC}\ProxyStubClsid32	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEF077AF-C40F-4AE3-9ED9-35A5728A85EC}\TypeLib	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{51ACF2AC-0574-4805-9483-B8ACB28ADBE0}	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ToolboxBitmap32	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Control\	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Version\ = "6.0"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ProxyStubClsid32	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\Version = "6.0"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib\Version = "6.0"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AEF077AF-C40F-4AE3-9ED9-35A5728A85EC}\TypeLib	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Lodop.LodopX	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ = "ILodopXEvents"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{51ACF2AC-0574-4805-9483-B8ACB28ADBE0}\ProxyStubClsid32	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\0	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ = "ILodopX"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AEF077AF-C40F-4AE3-9ED9-35A5728A85EC}	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AEF077AF-C40F-4AE3-9ED9-35A5728A85EC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEF077AF-C40F-4AE3-9ED9-35A5728A85EC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{51ACF2AC-0574-4805-9483-B8ACB28ADBE0}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEF077AF-C40F-4AE3-9ED9-35A5728A85EC}\TypeLib\Version = "6.0"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{51ACF2AC-0574-4805-9483-B8ACB28ADBE0}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{51ACF2AC-0574-4805-9483-B8ACB28ADBE0}\TypeLib\Version = "6.0"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Version	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\CAOSOFT_WEB_PRINT_lodop.ocx,1"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ = "Lodop(for Web Print)"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb\0\ = "Properties,0,2"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}"	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

DesktopLayer.exe

pid process

1944 DesktopLayer.exe
1944 DesktopLayer.exe
1944 DesktopLayer.exe
1944 DesktopLayer.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1204 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1204 iexplore.exe
1204 iexplore.exe
904 IEXPLORE.EXE
904 IEXPLORE.EXE
904 IEXPLORE.EXE
904 IEXPLORE.EXE

pid	process
1944	DesktopLayer.exe
1944	DesktopLayer.exe
1944	DesktopLayer.exe
1944	DesktopLayer.exe

pid	process
1204	iexplore.exe

pid	process
1204	iexplore.exe
1204	iexplore.exe
904	IEXPLORE.EXE
904	IEXPLORE.EXE
904	IEXPLORE.EXE
904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exeb5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exeDesktopLayer.exeiexplore.exe

description	pid	process	target process
PID 1620 wrote to memory of 1904	1620	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
PID 1620 wrote to memory of 1904	1620	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
PID 1620 wrote to memory of 1904	1620	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
PID 1620 wrote to memory of 1904	1620	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
PID 1620 wrote to memory of 1904	1620	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
PID 1620 wrote to memory of 1904	1620	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
PID 1620 wrote to memory of 1904	1620	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
PID 1904 wrote to memory of 1944	1904	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe	DesktopLayer.exe
PID 1904 wrote to memory of 1944	1904	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe	DesktopLayer.exe
PID 1904 wrote to memory of 1944	1904	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe	DesktopLayer.exe
PID 1904 wrote to memory of 1944	1904	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe	DesktopLayer.exe
PID 1904 wrote to memory of 1944	1904	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe	DesktopLayer.exe
PID 1904 wrote to memory of 1944	1904	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe	DesktopLayer.exe
PID 1904 wrote to memory of 1944	1904	b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe	DesktopLayer.exe
PID 1944 wrote to memory of 1204	1944	DesktopLayer.exe	iexplore.exe
PID 1944 wrote to memory of 1204	1944	DesktopLayer.exe	iexplore.exe
PID 1944 wrote to memory of 1204	1944	DesktopLayer.exe	iexplore.exe
PID 1944 wrote to memory of 1204	1944	DesktopLayer.exe	iexplore.exe
PID 1204 wrote to memory of 904	1204	iexplore.exe	IEXPLORE.EXE
PID 1204 wrote to memory of 904	1204	iexplore.exe	IEXPLORE.EXE
PID 1204 wrote to memory of 904	1204	iexplore.exe	IEXPLORE.EXE
PID 1204 wrote to memory of 904	1204	iexplore.exe	IEXPLORE.EXE
PID 1204 wrote to memory of 904	1204	iexplore.exe	IEXPLORE.EXE
PID 1204 wrote to memory of 904	1204	iexplore.exe	IEXPLORE.EXE
PID 1204 wrote to memory of 904	1204	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe
"C:\Users\Admin\AppData\Local\Temp\b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1620

C:\Users\Admin\AppData\Local\Temp\b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
C:\Users\Admin\AppData\Local\Temp\b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1904

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1944

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1204 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:904

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\R1T59ZS4.txt
Filesize
608B

MD5
6a3f1be1bfa4333a2c793db03cae21f8

SHA1
6e675f781163d04b2ce443ea51d2269e14ba3a85

SHA256
ea28f9525745d2b18bc5350c8b41bdafa9e9e7aa0f92e9e628c3c0930e419e67

SHA512
af3051c7771b7eb153b7cc95a81d1be5abe8d60bca48031eceb985ecd4f2c3563e05c8114b4343f95d62f3797a8222b9ebd5d57ae63965db0c4fb5a467325114

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Users\Admin\AppData\Local\Temp\b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Users\Admin\AppData\Local\Temp\b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Users\Admin\AppData\Local\Temp\b5f364139b2f684f2fb870163fdf3a54d21068a18806d90b3bcfe2c13feeccf1Srv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Windows\SysWOW64\CAOSOFT_WEB_PRINT_lodop.ocx
Filesize
1002KB

MD5
6f9c67f13fc9bcd531af35fc13aeae36

SHA1
9870b928cab880622a9a32320d29bb96b78e056e

SHA256
e7f980c96dec9eb3945266ee88325cc713e72b2d2713da441812019ab36e936c

SHA512
7e8c3a120edbf42b95a9b7a6583af03dded1f151bb6cb79b23ea72b4dfd42f3429cc728c222698590c302df4faff96a40e3e8feaf50ce94146ff19ef06857278

Download Submit
\Windows\SysWOW64\CAOSOFT_WEB_PRINT_lodop.ocx
Filesize
1002KB

MD5
6f9c67f13fc9bcd531af35fc13aeae36

SHA1
9870b928cab880622a9a32320d29bb96b78e056e

SHA256
e7f980c96dec9eb3945266ee88325cc713e72b2d2713da441812019ab36e936c

SHA512
7e8c3a120edbf42b95a9b7a6583af03dded1f151bb6cb79b23ea72b4dfd42f3429cc728c222698590c302df4faff96a40e3e8feaf50ce94146ff19ef06857278

Download Submit
\Windows\SysWOW64\CAOSOFT_WEB_PRINT_lodop.ocx
Filesize
1002KB

MD5
6f9c67f13fc9bcd531af35fc13aeae36

SHA1
9870b928cab880622a9a32320d29bb96b78e056e

SHA256
e7f980c96dec9eb3945266ee88325cc713e72b2d2713da441812019ab36e936c

SHA512
7e8c3a120edbf42b95a9b7a6583af03dded1f151bb6cb79b23ea72b4dfd42f3429cc728c222698590c302df4faff96a40e3e8feaf50ce94146ff19ef06857278

Download Submit
\Windows\SysWOW64\NPCAOSOFT_WEB_PRINT_lodop.dll
Filesize
334KB

MD5
b632ff1fcd5bae997a3e8350b5cba441

SHA1
925eff4f64abc9fdc2baff2a743d72a905b0d84e

SHA256
306783fb00bbe0c64e3f5d63bc1c5dbec0d609707d39514b7231cbc26532f73b

SHA512
be75f400baabacd234c50a1402de612be262219b4906074c8140bd49f080a404deec3863d42d982de008a23b480e326e18becd329ba73e37b74e51ce34156e3f

Download Submit
memory/1620-72-0x0000000000EF0000-0x00000000010CE000-memory.dmp

Filesize
1.9MB

Download
memory/1620-81-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/1620-73-0x0000000000260000-0x000000000028E000-memory.dmp

Filesize
184KB

Download
memory/1620-55-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/1620-83-0x0000000002EA0000-0x00000000031A1000-memory.dmp

Filesize
3.0MB

Download
memory/1620-54-0x0000000075951000-0x0000000075953000-memory.dmp

Filesize
8KB

Download
memory/1620-82-0x0000000003390000-0x0000000003496000-memory.dmp

Filesize
1.0MB

Download
memory/1620-78-0x0000000002EA0000-0x00000000031A1000-memory.dmp

Filesize
3.0MB

Download
memory/1620-79-0x0000000003390000-0x0000000003496000-memory.dmp

Filesize
1.0MB

Download
memory/1620-80-0x0000000002EA0000-0x00000000031A1000-memory.dmp

Filesize
3.0MB

Download
memory/1904-57-0x0000000000000000-mapping.dmp

Download
memory/1904-66-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1944-71-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1944-64-0x0000000000000000-mapping.dmp

Download