ramnit | a15208b831ae32566f259844d82abc3a500b2a2c002b9b2e74e749c0db4d78b1

Analysis

max time kernel
135s
max time network
129s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
28-12-2024 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
Size

475KB
MD5

97b6e4b6822ea362918b206709dbc1f0
SHA1

13893c0843868e1955c9257740d2d5630046fd71
SHA256

a15208b831ae32566f259844d82abc3a500b2a2c002b9b2e74e749c0db4d78b1
SHA512

d8f2fbe1a62486b22146307214425bd6a34790101d54e17fd4b6ae96e746cd9730d1435e1513b143c1aa64073bdd952c88b09601da20d5a81573223284a930b2
SSDEEP

12288:DQt0D52k1e7rtT1n+mMJOE9vWN0VTTbM/M:qW1e9TRN8OEc0H

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 1 IoCs

pid	Process
1648	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe

Loads dropped DLL 2 IoCs

pid	Process
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2308-4-0x0000000000220000-0x0000000000284000-memory.dmp	upx
behavioral1/files/0x00080000000120fe-2.dat	upx
behavioral1/memory/1648-15-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1648-13-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1648-10-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1648-21-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1648-22-0x0000000000400000-0x0000000000464000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
File opened for modification	C:\Windows\svchost.exe	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 52 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80AD42E1-C52F-11EF-A5E9-FE7389BE724D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80A88021-C52F-11EF-A5E9-FE7389BE724D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "441561197"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1648	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe
1648	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe
1648	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe
1648	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe
1648	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe
1648	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe
1648	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe
1648	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe

Suspicious behavior: MapViewOfSection 26 IoCs

pid	Process
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe
Token: SeDebugPrivilege	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2796	iexplore.exe
2820	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2796	iexplore.exe
2796	iexplore.exe
2820	iexplore.exe
2820	iexplore.exe
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1648	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	30
PID 2308 wrote to memory of 1648	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	30
PID 2308 wrote to memory of 1648	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	30
PID 2308 wrote to memory of 1648	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	30
PID 1648 wrote to memory of 2796	1648	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe	31
PID 1648 wrote to memory of 2796	1648	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe	31
PID 1648 wrote to memory of 2796	1648	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe	31
PID 1648 wrote to memory of 2796	1648	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe	31
PID 1648 wrote to memory of 2820	1648	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe	32
PID 1648 wrote to memory of 2820	1648	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe	32
PID 1648 wrote to memory of 2820	1648	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe	32
PID 1648 wrote to memory of 2820	1648	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe	32
PID 2308 wrote to memory of 380	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	3
PID 2308 wrote to memory of 380	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	3
PID 2308 wrote to memory of 380	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	3
PID 2308 wrote to memory of 380	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	3
PID 2308 wrote to memory of 380	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	3
PID 2308 wrote to memory of 380	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	3
PID 2308 wrote to memory of 380	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	3
PID 2308 wrote to memory of 396	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	4
PID 2308 wrote to memory of 396	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	4
PID 2308 wrote to memory of 396	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	4
PID 2308 wrote to memory of 396	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	4
PID 2308 wrote to memory of 396	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	4
PID 2308 wrote to memory of 396	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	4
PID 2308 wrote to memory of 396	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	4
PID 2308 wrote to memory of 432	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	5
PID 2308 wrote to memory of 432	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	5
PID 2308 wrote to memory of 432	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	5
PID 2308 wrote to memory of 432	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	5
PID 2308 wrote to memory of 432	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	5
PID 2308 wrote to memory of 432	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	5
PID 2308 wrote to memory of 432	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	5
PID 2308 wrote to memory of 476	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	6
PID 2308 wrote to memory of 476	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	6
PID 2308 wrote to memory of 476	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	6
PID 2308 wrote to memory of 476	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	6
PID 2308 wrote to memory of 476	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	6
PID 2308 wrote to memory of 476	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	6
PID 2308 wrote to memory of 476	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	6
PID 2308 wrote to memory of 492	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	7
PID 2308 wrote to memory of 492	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	7
PID 2308 wrote to memory of 492	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	7
PID 2308 wrote to memory of 492	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	7
PID 2308 wrote to memory of 492	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	7
PID 2308 wrote to memory of 492	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	7
PID 2308 wrote to memory of 492	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	7
PID 2308 wrote to memory of 500	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	8
PID 2308 wrote to memory of 500	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	8
PID 2308 wrote to memory of 500	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	8
PID 2308 wrote to memory of 500	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	8
PID 2308 wrote to memory of 500	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	8
PID 2308 wrote to memory of 500	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	8
PID 2308 wrote to memory of 500	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	8
PID 2308 wrote to memory of 596	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	9
PID 2308 wrote to memory of 596	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	9
PID 2308 wrote to memory of 596	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	9
PID 2308 wrote to memory of 596	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	9
PID 2308 wrote to memory of 596	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	9
PID 2308 wrote to memory of 596	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	9
PID 2308 wrote to memory of 596	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	9
PID 2308 wrote to memory of 672	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	10
PID 2308 wrote to memory of 672	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	10
PID 2308 wrote to memory of 672	2308	2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe	10

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:380
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:596
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1716
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:324
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:672
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:748
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:820
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1164
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:864
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:972
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:272
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:340
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1044
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1116
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1524
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2472
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2504
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnit.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe
    C:\Users\Admin\AppData\Local\Temp\2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2796
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2796 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2852
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2820
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4070c6f5df848ed9656d4ad41aad2e96

SHA1
da4fef32dc64bf0205f2894c9e66e30bcea29148

SHA256
47ce8fb016d35be873f95ffeb5388e660ae12f333e6ef159eba28d4e7b205653

SHA512
abbb17141039eef555ad3d5ca6061da2564820b830bf6a584261a67ba609b503e85242273acee081ec7b7f8499192ffd88a68016453b95ca64d839fbe15f3678

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10b7827c15d8d04baa3f19b422fa3fd3

SHA1
10095a102643cc7d2494cda2859de27734ac817c

SHA256
e8723843100e9a71a16bc2cccf7ce21c66b9246ad8f5857291534f83e5aa2cf4

SHA512
e2023d589c858db5c3f519bdd55a6e9de268a95ed93a6cac3dbfab03fedc29bf12f9aa2ec6d67beb3848b4159a3d427f7e21355b8ca07465d66c670ff976fbf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db89f1cb0bae92239c53ab9a6f990b61

SHA1
1014812158269b909a5aaf9c7600082f9234a326

SHA256
758ace07b908131b590d545841b3077f53f6d9d065d84af5bac8c8cfc1791982

SHA512
c1363f0ebb02dd7fbdd61a3beb4a005cd0cda20dc3e4227a1c2bba9b40f9dc6ae7f8f86459aab43da1dd83bbcab47b5bf0b21f52ea833d3966001ecb97cce3e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0700c8c7e852d110161611201c7b780

SHA1
ff1c5dca98e77abbd2e1c3aa866f8be7fcbd3cc3

SHA256
a9cbdb546dd186df8ed9b8e285e762762ce872af96f126a3dccd59c4f5f4c7a2

SHA512
2d6bd85a1640e2bcabe2d5792bb8ca9dfdcb533a04ec3ec283f332cd16de3871445f6bcabcf476f3d4a32745455425093029ea8a3202c589ee3ee1a0d6ece683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
688d2f888c7abb76c565fd1d49e985a5

SHA1
2e5e5be00ca5445c1aa1eb601ed6fe2e995d76e1

SHA256
4b1a0ed70bae0fe4838ee8e00a45ca5519907caf1d8110e2e38cc10028c0ccc5

SHA512
f7f7f5653e78539e1f930f342dc9451255a9cc62a5e36cf4d301f4e09a1948620b0dde8f26eaf9e64b8bd15bf5ed7a6cda9991d038c22e7df4ac129cc5ae496d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22f006fab08dbde74dee1ab25b4b5edd

SHA1
d1369e653ea8c87f8a73f751d48044978b682bc5

SHA256
09a33be46b60ff6f4a1b24286850f83dcc400a2dc7494e8377e868d32ac16753

SHA512
bb78ec2b3c2a47641c179794e53e56e51374c718a029aaac0f899ed95735957c2f6519a4180e8e323785d95c5a0db14fd93a6a4752c7650e5ff0cff8b2ba824f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfbd1b85c0f059d0f77072f18f83615b

SHA1
0f2d7abe3ab3ee11c3f40798817dc40169592265

SHA256
38c85bdb4b8206a07bcf092e6ecb8f14f73a19f569ebaea8456823bfc6f5799a

SHA512
7a005b876d4d99595dfd89410379b4faa0912a1a9cb35413274e2bc4d50f4b23c129caf645b98d6e884fdbf129db2f7d1a9e82863b22a0c277df9a77e700d5d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ada7684fa01197932b640416d49b7a5c

SHA1
b3711f7700864fadaeec9b6762b20bb35f070154

SHA256
1bf398a00c7ee1c0d5d693a5a0c046601047523a10debfc42fcf99fcea8ad276

SHA512
ddd435d88db49bd917036c78167ee638834013a7ee73114f25d919767a14a90485e2450a8cbbb011ef7df180d8bea464a8dd7fb63701f8e98dfe9d35e2c1935c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f8a1606a6b5e32731cd005d859d3c8f

SHA1
71a9cc0801f6308dce01792550df8ccf383dcbb6

SHA256
88e1dd1e64698cd0ae7d0a6f1bc4ae9d3bf7ccd0d58ee8d5dc1097863d33c9f6

SHA512
6bd97269b5103b33613e6b30512b2a79d1c00fa9882c1cc6463ef154e79945aa1721c7ba4099343437f815948cefe3eebd708c8093a2ac67c292f1807fc4d210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d6a7e4ab11e032650e506b3e0757950

SHA1
795f9f344637910e0018708524c8d4fc99d28f87

SHA256
c2442b73d226b8d648b5fa27fa72a3844e6c0c8b2d65e09de3a7cdb97c85e4f0

SHA512
8496636223aae5e5e750938f9824852ad014288ef1ed9d03d6fd7675065164c69b5732bf085b92a07b4babef12adb64ec61b55e3bb5b7c6a39a970e187d735db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
febdff1ef431036cd9be7e6409aeba61

SHA1
76a321db022154dcb17bfd6ac5a61b3e3d186cf7

SHA256
b55e1d0f7bd75c9363ffc195db176697333672ba5d72108a9233c5e43f2c63e5

SHA512
29d207f40e638b4e2b30dfa9a48a5ed2a02de5efe2de1e2188d7caa3128654ca0e56899a79ce101d53aea1ad15d233da43d343d92cbd8d25a7fa7bfa4f184ca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd54666f6096abb9fc023d1ed0bb7f82

SHA1
f54d5a08afa0fa860a587a39f646fa9fc48d5e24

SHA256
92a033797cb7340c6cc3ee4efd5f87e3a1e132af509981f9ff84430a5589e05b

SHA512
042837ba2e093fe8b0133922bf090904538ef7169ad1420879b4f7cbc84c730248b3767e7cb2ef46d19b758a37c592c166548216aefb1f9a3d671ea249f5aed1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c32ed6799950b1a9f6e7a47a04a7f8da

SHA1
588d6d9be97026ff33ec7c501434b2133f43199b

SHA256
b34381deea5d63b9f57929b3a1b622e97f9de2cc0509fced968b8d5ec6bc7893

SHA512
d16936b5e0a0d6ba44e47e451de4f4142a70910aa52a275c46d95252288b6d846052e40a3bcbacdebb645691a77965fc63195724ab46bf14c19138c736e59973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
515ee056aadf7c0ba4b51ed82ea59cc5

SHA1
9440adf08dcc01672325b79376a85709bfe9d0a8

SHA256
b9de8ff2fa33948b1d07f7b02f46b8351497f969c67e58e369f6b1263cabf714

SHA512
6e09a52b66ba86153e5402cfc0023873c77b0c4b689adc2af30b76e2b777c44d57d5be17d4620547e84c22e33e2442a6541ce909456708d56c6eb47ffc4d4f7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce22aafd04ee279f2b560f04a55b6dfd

SHA1
7fd3df36a9033ce93018859d57a6b0653c3d5297

SHA256
fdd002c0b7eb9bf221eea72c8a87e99e24b8cec4f1c030112a06198f9e3dc89d

SHA512
dd5fb6b18f249c2a620d4dbab0666c37ded3e6eb588b06878d53255bc2950bcb6a97e96abe142db61ea360f97dc8b0a0831073933366bf1592ae4680f86df143

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e233d6f09661b1978c584d82107506c6

SHA1
4f9f4458e61e3e22d0da24d5bbba66ff165b3226

SHA256
fa832561567f97fe4957a30482f529bfc045cbd8eaa523839cb9c6aa3df3e032

SHA512
79797a21f7ad56892bdfb0ae331414f5e02d07a86b86d295ac6a52c65101c9bb5244486c79fe65083252a698825272810d5b4cb5773215338f9b97324f4e7c5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25468b839c7c6704cb5210645442a110

SHA1
1d944f47696cc8a92085f5810c27188f8b6b0500

SHA256
1dbbd9512e332c5ceba21260fc9b9750d8a0d8ba408a53437849d05cffb8faf6

SHA512
c28311e6fa7161fc59565575d7ba84a8825c1cb1deb5c6140c79eb3bf014a8f8b7589874f1b040a62e4e871428e73322dedd41ce1d803a504990776bc99aa517

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85189cf2c9538c585850301d8e57234e

SHA1
869d1ce6fd2a341fb750ca703249059826f96d82

SHA256
8893c03bf467e7234dd078690e8006e94d2d59daf1d391eabde5dee2cd6594ce

SHA512
4f4076bfc1ef8fdd479d1b92d592aba719561781334a53c57fe62c737224ebcc8e5952aac98f8a5a4608ebc8f391e05d205acf0f48a2c9683036a6bbe1124742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c9ec716600fad7d563d56c070adad68

SHA1
7f5760dc66198e6d8844f35578f612db89b087f8

SHA256
8e51ed8e23861a06c3145e606bfc21e3a2b00e35069dbb3aa0e3ebaaa2b154b5

SHA512
88b747828ecf656ea4df14a2b2b495b499353f3fcb561c32ca46dc3d3c9e4ceff4dedf14a4b8de188a0b451a901fcd5688400f2a3d58e909f5d277305d98160c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49a59e1526996f7b7928558fe8398a91

SHA1
18b31744cf38a289a601a067b554d741d35d710f

SHA256
c9908123484fa6fa6e86bd3014dec61069a2319478cee1dcfe9d70ca3301013b

SHA512
50bc0d76ca8ee271f5f37ce34a5bd13c3df38052724c7ef5bc5c67c571b92810d34d4388337c61ff127fe408f6a052798b22628be66573b48d1a45007ce7c7e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9d5dae2f6326efdd3abd2ffbf0f2546

SHA1
a4dd04aed1530778ac6afc7871f5fc99d4f70f55

SHA256
a5b7b26a536e90df52a5a31794a54929a40d5aca44c929c3c0ded53592c06b0e

SHA512
b1a41e7221ca58f6ebdb6bb9f40997dd3a3a66ade195d9280bca027bd8211cb2dedeecc297661f8d1150af91233f17134ae60d37da087c39b32d0e37034b5f88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{80A88021-C52F-11EF-A5E9-FE7389BE724D}.dat

Filesize
3KB

MD5
866566c5a9a709704a63f6d8fc4cadc0

SHA1
4e80148a4608809c1cf95deaa0e8cb491c8bac8f

SHA256
627419114ea75772c821310fdf3c6faf8e65afe4d2b836ac100f29afe91118d0

SHA512
5a2dde44f250ff3f179d1391ef2442f9ac732ca87886818ef598f06ec0216edae6f09814c2d653c9d7a7a58874185e9299b42c2b2808e0f4ac9f6639deab27ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{80AD42E1-C52F-11EF-A5E9-FE7389BE724D}.dat

Filesize
5KB

MD5
16a1e07248d465b1937b3a6a2e4244a4

SHA1
24c51ac469204971ac24f67783ffc2d6ae2939c1

SHA256
e7c9c3cb2c0ffe2a71d448dd40a8b0d24c7191cf20b200f409e8fed1ba837f16

SHA512
ea766c67457709276300f49a0f9ca41c9d5d11e0bb7633a5f2c41760f82b909fd26b9f141ed48d3f157aa3e28d7cf4211ffe6c0769b986ee037f47f9853538ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBE23.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBE94.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\2024-12-28_97b6e4b6822ea362918b206709dbc1f0_mafia_ramnitmgr.exe

Filesize
159KB

MD5
8703c6aeb2e62da71e50db9698d91e35

SHA1
cafceda794c5b1976b46a5d39949137aba8dc9e6

SHA256
c3a332de99e2b195bbb3e5927f8ee4217f968bc373f8c499db45db0b3388d47d

SHA512
48e45868929fcacfa06c5078de2e54d32cfab80e5dd00036b37f3d55b33269f0ee82f46b68e7a6adc2ec9aecad8672393a77602c1b995133876c2c4e6d15229a

Download Submit
memory/1648-21-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1648-15-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1648-11-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1648-13-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1648-12-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1648-10-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1648-22-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1648-14-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2308-0-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2308-4-0x0000000000220000-0x0000000000284000-memory.dmp

Filesize
400KB

Download
memory/2308-16-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download