ramnit | b1555be9e0558eee155f1a81bff0e9d1c54254b599f8700df4671ca5bef96455

Analysis

max time kernel
94s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-11-2024 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1555be9e0558eee155f1a81bff0e9d1c54254b599f8700df4671ca5bef96455.dll
Size

2.3MB
MD5

af835619ce35431075c984beb8a14e1c
SHA1

3d75e872ff0b7b16f27cb2500148d6784a8043c1
SHA256

b1555be9e0558eee155f1a81bff0e9d1c54254b599f8700df4671ca5bef96455
SHA512

7968f3d41acdebf1b1cca7086ffa9c14c98bc41b404555736cd4aefaca2bfc8e300f12be184c47b4d3442c6a616ccb2b3091c0c94bfba38d7e5e0ed53084439c
SSDEEP

49152:jU3U+ZYmxjpv7x4GFM/+b8dTMNh9Wr73h7NXSWEqNJO5hYTVMCRisKEj:jiU2YmxjpDx4Zo8dYNh9q73h7NXYkRic

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
3216	rundll32mgr.exe
1028	WaterMark.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3216-8-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3216-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3216-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3216-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3216-6-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3216-7-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3216-9-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1028-27-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1028-29-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1028-28-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1028-37-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1028-41-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1028-42-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px9693.tmp	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
628	2840	WerFault.exe	83
100	5108	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 51 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E595208D-9F05-11EF-AEE2-DEEFF298442C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31142674"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3122662529"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3119693916"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31142674"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31142674"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3119537727"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437968289"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3119693916"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3119537727"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3122662529"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31142674"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E592BE6D-9F05-11EF-AEE2-DEEFF298442C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31142674"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31142674"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1028	WaterMark.exe
1028	WaterMark.exe
1028	WaterMark.exe
1028	WaterMark.exe
1028	WaterMark.exe
1028	WaterMark.exe
1028	WaterMark.exe
1028	WaterMark.exe
1028	WaterMark.exe
1028	WaterMark.exe
1028	WaterMark.exe
1028	WaterMark.exe
1028	WaterMark.exe
1028	WaterMark.exe
1028	WaterMark.exe
1028	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	WaterMark.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1152	iexplore.exe
4764	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1152	iexplore.exe
1152	iexplore.exe
4764	iexplore.exe
4764	iexplore.exe
4412	IEXPLORE.EXE
4412	IEXPLORE.EXE
5040	IEXPLORE.EXE
5040	IEXPLORE.EXE
4412	IEXPLORE.EXE
4412	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3216	rundll32mgr.exe
1028	WaterMark.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 2840	4520	rundll32.exe	83
PID 4520 wrote to memory of 2840	4520	rundll32.exe	83
PID 4520 wrote to memory of 2840	4520	rundll32.exe	83
PID 2840 wrote to memory of 3216	2840	rundll32.exe	84
PID 2840 wrote to memory of 3216	2840	rundll32.exe	84
PID 2840 wrote to memory of 3216	2840	rundll32.exe	84
PID 3216 wrote to memory of 1028	3216	rundll32mgr.exe	87
PID 3216 wrote to memory of 1028	3216	rundll32mgr.exe	87
PID 3216 wrote to memory of 1028	3216	rundll32mgr.exe	87
PID 1028 wrote to memory of 5108	1028	WaterMark.exe	88
PID 1028 wrote to memory of 5108	1028	WaterMark.exe	88
PID 1028 wrote to memory of 5108	1028	WaterMark.exe	88
PID 1028 wrote to memory of 5108	1028	WaterMark.exe	88
PID 1028 wrote to memory of 5108	1028	WaterMark.exe	88
PID 1028 wrote to memory of 5108	1028	WaterMark.exe	88
PID 1028 wrote to memory of 5108	1028	WaterMark.exe	88
PID 1028 wrote to memory of 5108	1028	WaterMark.exe	88
PID 1028 wrote to memory of 5108	1028	WaterMark.exe	88
PID 1028 wrote to memory of 1152	1028	WaterMark.exe	100
PID 1028 wrote to memory of 1152	1028	WaterMark.exe	100
PID 1028 wrote to memory of 4764	1028	WaterMark.exe	102
PID 1028 wrote to memory of 4764	1028	WaterMark.exe	102
PID 1152 wrote to memory of 4412	1152	iexplore.exe	104
PID 1152 wrote to memory of 4412	1152	iexplore.exe	104
PID 1152 wrote to memory of 4412	1152	iexplore.exe	104
PID 4764 wrote to memory of 5040	4764	iexplore.exe	105
PID 4764 wrote to memory of 5040	4764	iexplore.exe	105
PID 4764 wrote to memory of 5040	4764	iexplore.exe	105

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1555be9e0558eee155f1a81bff0e9d1c54254b599f8700df4671ca5bef96455.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1555be9e0558eee155f1a81bff0e9d1c54254b599f8700df4671ca5bef96455.dll,#1
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:1028
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:5108
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 204
        6⤵
        Program crash
        
        PID:100
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1152
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:17410 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4412
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4764
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4764 CREDAT:17410 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:5040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 624
    3⤵
    - Program crash
    PID:628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2840 -ip 2840
1⤵
PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5108 -ip 5108
1⤵
PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
042619486a0f512d0313c7b4fa6c9756

SHA1
9a3f09247b4b03933f23331b4f0207672c93e02a

SHA256
a231a95c194f54c33eef59babf53d979f0342fbc68bc52dbb524887fd378418d

SHA512
4b2b32d754d116b0609ca43b9ff54ad72c9e22ddbd617b5c94586a219c297c13823c0c2812937db6b2181382176bba46b2f3d37b4b29ae6f171e01ada216c257

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
81dd61cf1283cfaf64a04ccba0dd5e49

SHA1
3c96322145eb520e74d0eefa9b0d02234a4d8815

SHA256
8f2c1f78cd6ed83e22768789a4b313555ade7461ee44e465db9a25c2125d6eef

SHA512
bdef51b77378eda0ef18039a46790eac779386a635285971fb84ad904dacac6919db54ef6334f2a7a4cdc93d5f25347c2341bfad89bbdb3c1d66abc2c272f500

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E592BE6D-9F05-11EF-AEE2-DEEFF298442C}.dat

Filesize
5KB

MD5
efae127fb23dec9294ac6241f99c8202

SHA1
0c0cb676171e74d0f6263422d08d889656dc506c

SHA256
46a43d986173de981051f51af5f6e62199d3f243ae7cf7cc4a9fc643c12c7493

SHA512
21eed9f3b6698745e89a463a60465c73fdc4a728953a3c943e0b6ab20b146b80095718fa312fbfb63febb9f55a22669a884abb1eeed460e5e0630cc54183b5d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E595208D-9F05-11EF-AEE2-DEEFF298442C}.dat

Filesize
3KB

MD5
9b75a7d4a096c9932067424af47fa449

SHA1
8cf47f084486b4b72e5a8fa0d111ed64862d4ec6

SHA256
b101aa1ecf212456852184429a1ea2f95ffd836a627529c330a967e0b6c79f0e

SHA512
4f2e5281d231df8e38ec15cc1302fc2bb2af59e8a6b8d91bf0d4f23f33ca8e7ad9baaa8a7161a4739730e2f61767c49bfb9a2a595070b85e35db9fadbb5b0305

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver1930.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M6JHG9EK\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
173KB

MD5
f603c2d3a1c6b4f856feca3d64d7cc40

SHA1
dc51f92df6a4556aec378dd3d9d9f9a2c47daf54

SHA256
56bac5d625d087ae6fd94c5f86780c648c6f3b217015900e7566051e931e32d6

SHA512
00c7220823a8e6a13483d4cf3a257b5236b82f2dc8e783d0ed393fabef2b0f246c35616d3edd070bf54280ea42fa3036a13d59c98250a67552be70606b344b78

Download Submit
memory/1028-36-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/1028-37-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1028-42-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1028-41-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1028-27-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1028-30-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/1028-29-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1028-32-0x00000000777C2000-0x00000000777C3000-memory.dmp

Filesize
4KB

Download
memory/1028-28-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1028-38-0x00000000777C2000-0x00000000777C3000-memory.dmp

Filesize
4KB

Download
memory/2840-35-0x0000000008000000-0x0000000008266000-memory.dmp

Filesize
2.4MB

Download
memory/2840-3-0x0000000008000000-0x0000000008266000-memory.dmp

Filesize
2.4MB

Download
memory/3216-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3216-6-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3216-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3216-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3216-10-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/3216-9-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3216-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3216-8-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3216-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/5108-33-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Filesize
4KB

Download
memory/5108-34-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download