ramnit | 5e2f3532cae55113db73c91413e3fcc1f66b2113930b1b78308b7780ae0a1e18

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_448810656c83a28d55e665f2746afa50.dll
Size

412KB
MD5

448810656c83a28d55e665f2746afa50
SHA1

bc90fc2b65483c3b663695d55c3feb41ad0519ce
SHA256

5e2f3532cae55113db73c91413e3fcc1f66b2113930b1b78308b7780ae0a1e18
SHA512

6712656e3303393574f0aed35b1ae87552d240ffab7f038c55176b722d9f21cb8e9a45067b537bf2c01485c4a56392f1aa5c404a62f43823f79a9d218b5c5d54
SSDEEP

6144:/F4j6ruFn5FPV6gfWV+fP8EMs2Lat9fnz8q69Ah5Y7uSNa:kXV9WV+x2uD692bR

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 5 IoCs

pid	Process
2468	rundll32mgr.exe
3060	rundll32mgrSrv.exe
2320	rundll32Srv.exe
2896	DesktopLayer.exe
2520	DesktopLayer.exe

Loads dropped DLL 13 IoCs

pid	Process
1124	rundll32.exe
1124	rundll32.exe
2468	rundll32mgr.exe
1124	rundll32.exe
2320	rundll32Srv.exe
3060	rundll32mgrSrv.exe
2468	rundll32mgr.exe
2468	rundll32mgr.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32Srv.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32mgrSrv.exe	rundll32mgr.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000d0000000122de-1.dat	upx
behavioral1/files/0x0008000000016b47-21.dat	upx
behavioral1/memory/2468-41-0x0000000000400000-0x000000000048F000-memory.dmp	upx
behavioral1/memory/2896-40-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2320-29-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3060-28-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1124-9-0x0000000000400000-0x000000000048F000-memory.dmp	upx
behavioral1/memory/2468-57-0x0000000000400000-0x000000000048F000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxB01D.tmp	rundll32mgrSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32mgrSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxB01D.tmp	rundll32Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32Srv.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2892	2468	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32Srv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgrSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe

Modifies Internet Explorer settings 1 TTPs 52 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{512D0691-C7EB-11EF-A0E6-E6A546A1E709} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{512F67F1-C7EB-11EF-A0E6-E6A546A1E709} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "441861764"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2896	DesktopLayer.exe
2896	DesktopLayer.exe
2896	DesktopLayer.exe
2896	DesktopLayer.exe
2520	DesktopLayer.exe
2520	DesktopLayer.exe
2520	DesktopLayer.exe
2520	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2824	iexplore.exe
2944	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2824	iexplore.exe
2824	iexplore.exe
2944	iexplore.exe
2944	iexplore.exe
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 1124	772	rundll32.exe	30
PID 772 wrote to memory of 1124	772	rundll32.exe	30
PID 772 wrote to memory of 1124	772	rundll32.exe	30
PID 772 wrote to memory of 1124	772	rundll32.exe	30
PID 772 wrote to memory of 1124	772	rundll32.exe	30
PID 772 wrote to memory of 1124	772	rundll32.exe	30
PID 772 wrote to memory of 1124	772	rundll32.exe	30
PID 1124 wrote to memory of 2468	1124	rundll32.exe	31
PID 1124 wrote to memory of 2468	1124	rundll32.exe	31
PID 1124 wrote to memory of 2468	1124	rundll32.exe	31
PID 1124 wrote to memory of 2468	1124	rundll32.exe	31
PID 2468 wrote to memory of 3060	2468	rundll32mgr.exe	32
PID 2468 wrote to memory of 3060	2468	rundll32mgr.exe	32
PID 2468 wrote to memory of 3060	2468	rundll32mgr.exe	32
PID 2468 wrote to memory of 3060	2468	rundll32mgr.exe	32
PID 1124 wrote to memory of 2320	1124	rundll32.exe	33
PID 1124 wrote to memory of 2320	1124	rundll32.exe	33
PID 1124 wrote to memory of 2320	1124	rundll32.exe	33
PID 1124 wrote to memory of 2320	1124	rundll32.exe	33
PID 2320 wrote to memory of 2520	2320	rundll32Srv.exe	34
PID 2320 wrote to memory of 2520	2320	rundll32Srv.exe	34
PID 2320 wrote to memory of 2520	2320	rundll32Srv.exe	34
PID 2320 wrote to memory of 2520	2320	rundll32Srv.exe	34
PID 3060 wrote to memory of 2896	3060	rundll32mgrSrv.exe	35
PID 3060 wrote to memory of 2896	3060	rundll32mgrSrv.exe	35
PID 3060 wrote to memory of 2896	3060	rundll32mgrSrv.exe	35
PID 3060 wrote to memory of 2896	3060	rundll32mgrSrv.exe	35
PID 2896 wrote to memory of 2824	2896	DesktopLayer.exe	36
PID 2896 wrote to memory of 2824	2896	DesktopLayer.exe	36
PID 2896 wrote to memory of 2824	2896	DesktopLayer.exe	36
PID 2896 wrote to memory of 2824	2896	DesktopLayer.exe	36
PID 2520 wrote to memory of 2944	2520	DesktopLayer.exe	37
PID 2520 wrote to memory of 2944	2520	DesktopLayer.exe	37
PID 2520 wrote to memory of 2944	2520	DesktopLayer.exe	37
PID 2520 wrote to memory of 2944	2520	DesktopLayer.exe	37
PID 2468 wrote to memory of 2892	2468	rundll32mgr.exe	38
PID 2468 wrote to memory of 2892	2468	rundll32mgr.exe	38
PID 2468 wrote to memory of 2892	2468	rundll32mgr.exe	38
PID 2468 wrote to memory of 2892	2468	rundll32mgr.exe	38
PID 2824 wrote to memory of 2084	2824	iexplore.exe	39
PID 2824 wrote to memory of 2084	2824	iexplore.exe	39
PID 2824 wrote to memory of 2084	2824	iexplore.exe	39
PID 2824 wrote to memory of 2084	2824	iexplore.exe	39
PID 2944 wrote to memory of 2848	2944	iexplore.exe	40
PID 2944 wrote to memory of 2848	2944	iexplore.exe	40
PID 2944 wrote to memory of 2848	2944	iexplore.exe	40
PID 2944 wrote to memory of 2848	2944	iexplore.exe	40

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_448810656c83a28d55e665f2746afa50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_448810656c83a28d55e665f2746afa50.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Windows\SysWOW64\rundll32mgrSrv.exe
      C:\Windows\SysWOW64\rundll32mgrSrv.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3060
    - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
        
        "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2896
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2824 CREDAT:275457 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2084
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 204
      4⤵
      Loads dropped DLL
      Program crash
      PID:2892
- - C:\Windows\SysWOW64\rundll32Srv.exe
    C:\Windows\SysWOW64\rundll32Srv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2520
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2944
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27ff77df4cdf0683bb78d16ad7b24412

SHA1
6f4bee8ee763347d81eadb896e1bb87403218a20

SHA256
38af8bc860d8f4b3e55f28450af918cf3fe96cdd05f169925ee8b9c29fd7841d

SHA512
ad7d056c6ca4634eeb135626f271e7911a6ae8c014939f88a4b42315280b713ef4ab88010367daad31cc96f51cd42d2e5df07ca42b3a479d3fdc237524b2e182

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5764d5727bbb4f3e7bac5d6e66923411

SHA1
17889e25e99586bd65e351553e03517ccfedc3a8

SHA256
fca807aea3334063c5411fbcff07ffdaa492760de7945fc76d1ba7108725609b

SHA512
0fa18677e763a3a950226857c9d585670c57acecfaaabaf208ab98d5c860af96d12db44d60c829a58081ea645603341bd9e90b3c759978d9d92d27f5909881e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c73895887f49222eca749712471fe061

SHA1
d6e4405640ffda03c8544657c57049bc5206b69a

SHA256
a48ce581add1678cb33993ae21baf1be7398008a2d1cc7ac655524ff54090535

SHA512
a70b71eb774df581ec573b22176318a9fea56f32c6dcfb70bbfbeb47172412f711e3aa72893244cdbf9e223b026f6f48ae35b8bd81f071874621dd8e256b8363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64ebd868aed1fa68df8e09ea1f30cc16

SHA1
44a73bbe423d260d07f6ec7b29d9758f927fd076

SHA256
0978522bf96ef37b5c474d9a2c1fc2df16b1cd15714c34a86e46b95b2e5d59b4

SHA512
9741a06a9ff2f3339771f1c981b799fd69a9b5689044c385b23f08484e083e4fc06312c3c858fd5a524bba7196d4ba59be3593932674e1c2990ba94a8e3465d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7554485fe1ad5e01441c4cc42c41441d

SHA1
fa3c5d9572e4f793bae8ee79e0743509395d68b3

SHA256
66839b0b9d3928fe2a52488705bba1f20f7b2424f7a6a8589d0ec190c3286590

SHA512
8badb58778a929692aa01eb62f4b2285fb1bd52a39c30f2ebd29d2201b78d2702ff4fa7ae8e6427bbec1c4b649dd34cc51cce4cde91ee413daf6495d4c0fe190

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88e7a329b315c6317cd474c9ea75671d

SHA1
dcc3c40776f87e4b7d49aa8a28b8da5c5d40633c

SHA256
a67e02f8f7d7f1e57c62d2fdda9f6d39260b36b486e37666831c2fdccec9f899

SHA512
536e08a261d56968bdfd9e29700c7f81eae8110bf24cc6d93aa5f15f6628ccaf7b399814939d9c5eb525c17291002d9d364aa54638f3c37eebdb8b6408b073f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d5303f016746cdc7b4e0114cf18596b

SHA1
bfbabc983a091bea8fe0681954f2f1d3ebe6bae8

SHA256
3d6b577493196f1be0053c688ad320fef59d037a7c1a13cd7ee877fd1dab73a0

SHA512
354bfb24ce1e8e567a2fa21199e67f0eab26468f0875f5f69730d5b7ba44a7a475d0b81a09770175bef60f0ed70d1a66a991e10440dd7a71dd5446432cd80cd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
234c62a97015a359b37e6b25c81b1a9c

SHA1
0a08e40e8a13283a96f58575ae215b1e7a6f3b27

SHA256
ecbe2636582231c0f19965c8e22a835f45e22f5a1bfe0019ff5748c579d6fdca

SHA512
058104f04bba8b1abca8324fb07b2c54f7032c80f04ddcb7b4dfe850fbc11b2aa481d65f73959da693b315134b9194f6ac310285dcc3b885bc779484c35e1138

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3add25244939028e4713117f9685718

SHA1
0603f7c1ed139308345d9c5650e606124b77d1bd

SHA256
5dc1e0bdc47fbd370a6a9164a37c359b28494b9a51f2947c8cf1b008b0b9873c

SHA512
80a0a1fdffa0e97567528e42e926f399d710087b43a8ae6d09e0a5deb11e795c5262339199b46795724e4d97723698d6c866ba40beec03e3c42c24c84e6ef7ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69f3e05519e11d4f7a226c107c4bf7e9

SHA1
ec4984a2abe026a58f2d0f88a83525fcd834bfe3

SHA256
b98d29e11ac3103ccf5ed150ece85c5c8b2479dfe73f96588637dcb3e97698d6

SHA512
ed2666ec4f594ac5d18684d3de4f2349bce8cd25d8b9098beeeee7ea0e17640031abd3ce419e0555b63902a0acc7508357539368256df5712f3b8b4487597d6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e230c45c32f5acbe53911b0d999fd99a

SHA1
a6313d0323c2cf342fe42b02bc34ac72d310f78c

SHA256
0029a81ea50d9d7a6410f89858fbe0b9f1eaa70bd65441001d01987177ec7438

SHA512
4dd78cb14be512f8dc62f2e7e18a9b575d45d8c2734859eb9d250b9a3ac3c8e3108acd48a946293db8fdb0b1cf41fd07026043b31e21d0f53852d08b3e55f3a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f8be3297d74bb48a2140576923f8685

SHA1
c1f2fa5046ad12c33d0bca09c7aaaa70b8532d77

SHA256
57c830174319c0e9d5805b911f92c961c4d0b2dcb7901e115607187e343e199d

SHA512
6b13fa928e54073854e4b96fe64e0700a13f97e33ba6d2d9c4e3f9f4ff9eaa538c9a424383cbce2167b5fe00c244b5624d6561a013ea844140f9df3ec3f5a8c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b3a0ed942a3243970f037430ebb68bc

SHA1
fa545dfd8d95e7d885ff593c70fc2e523da69cf3

SHA256
5fd3b2186ba26f64330aca205e4b9ff4be19262768f227fab8c02f00c731dce7

SHA512
f810dc51136c5fa3d50df5dead0b2681ad5af951b10fb2ac679f6f3e0b4d89f860dc3a17c889ccebcec600a804161a9c25569b3cc719710848e6344fcb9c2b6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cc5b8285121f34ef99b1f0df25a946b

SHA1
29308d124d3a8f072621291daf3ea86f3950a5f3

SHA256
670ecf2a32ccd450cde03593190aa8c4bb9f1fe1fb9225f37628d505db517323

SHA512
d1fefe178b41ab7fe702dd872dee4e7816ba2655a2b1b6a5a5900251624c3093d829ca7fd8b96f21913888a8141876c0f36c6a7bc4d397eaa8f4b1df1860e91d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73917e0508cfc47dd860ac622c69d419

SHA1
cef92bcddd3904f311510028f9ebeeeb924ef0a8

SHA256
33db9366b74df918e5119e961bfe3d2ad936b4b9ee9efb0da78ae9397ea26333

SHA512
5f2626798b625db17588c4cf4e099080afdae6a10318a617b721e7eadeae29281f6bbbb0159331e41e70ea5d7dc0e439f594c9df7d88db2274e6768cc573f309

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b999fada95a4289a8e6018a91797d0e8

SHA1
ce1a1281179799c03f8d91b35becc6b6c1df277e

SHA256
741ce5f880fa9c61db4630dd8676c9bb1b64729220f22b98a3842a6286e0a946

SHA512
15105c1a3c28ba984fccf74d1f4caa4ff2c18ef5671483275259003dc7e3a3cf68af14ee46c5eda9346d7b0339108afb49e0b6e479b8370aad5920ade7f052c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5947566c2ee2c8f95405d08243ae9c18

SHA1
a54342bd90ebb9a4d71d0364c5c67fd0c4c1938b

SHA256
b11896aee0e45464f5df8790acdf5d38ac8e38ed7a86ef1443564bf0e3fc35e7

SHA512
e92a82fceb8601840ad27df75cdc861c10e31c6f97093c6f4c1b0e8e537c202e8bfa3a21a772e10ff3078cc64186de18b3b8d2f32583b1d8c6a2a67a5c8922a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2231addd695f0d2c3f93bfe2221b78e5

SHA1
321a9f62e6fcaba9479c57066caa23368b0bee12

SHA256
1c95e094b2c1e13a75832d4dced9b21592ea0870582ef23752a1acd137a82383

SHA512
e99638481307df8ed146956ac31f377d41799215be115c4e5b887c50fb23365f9d947cca66daafa7b640a3c240a6a8e708f395c037c1a0e91fe39770ba6e3f78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df0a18d7502dc96c8ff857c2529fbc4a

SHA1
063aca54ddf86b8d5a2ede149b6d35a0bb6b0638

SHA256
f38f50383a43346ccacfbb4cd257463582c2c655f919780c767c16f193aec6c4

SHA512
2fb4fb2151dd42e5208d06a25f413701a7fcec34f23f51380ec6356606b0f4c9be2e83244dbcf901696e48b3443f92467af1c228377d9bac183fd852de731cfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21b537b9cd5c26fb272e320602661976

SHA1
4d15fcda8e9c3c63aab245bef4c16f2c96df3564

SHA256
66a77640acb52352b9218e354895b087f6956a5d670fde25629972354e6d3033

SHA512
4305e10304a7103430811fd428947c2a72bda6257b96eb92dc7ba22b43bff77f93d82546c0fc831cc2a11fecddfa21cc873bc106358862e7a73b4dac75f826a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{512D0691-C7EB-11EF-A0E6-E6A546A1E709}.dat

Filesize
4KB

MD5
23fb7f29467ec2613eae8c06b0fe1e96

SHA1
df45ce9c390b1af28a6a52ca4e021e3c03c597e0

SHA256
cade91f0c482d2998fd4d4c4f4b94abfa37a50292554c1e38fa46ee43e9d9463

SHA512
26ef4008174a411df5ff5307822a6a31309647aaa5b660459bf4b500364dcce67d6162f262b67fd2fe854b8ca374afda81bd50afd1067fe55f3223cd4dd47c9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{512F67F1-C7EB-11EF-A0E6-E6A546A1E709}.dat

Filesize
5KB

MD5
38d2356bb6696a6fa03a80e7736171ff

SHA1
7835b831d403a47248fd75781ad87a1f2122e2f8

SHA256
95a45828c381c636e10dd89f33db059a36b41eb33373fcad034646d277844e94

SHA512
76525d4c1f1b67637837199957cb426d3f087445375787a643281fd46e3ccee93922e94c28fdc4ac014731c5030c8b6ca67aac058c402b64cd1c36145cb1dbe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD27E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD34C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\SysWOW64\rundll32Srv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
240KB

MD5
81de7673d176e11ce6e4c3de1349af2a

SHA1
bc34967b16a4fa64996afbea7819272e20014bc9

SHA256
1203b8068e988001ed03100f551f5f11462e41222edfc8236a434dfeb833b7ab

SHA512
0e39ca2995cb68c00316a34f3167e822bb5982e938797a27c0516ef1f99d534949f7a1c011aceac21f5dd9ba473136ccd2021735bd329dcb2d7382fbc2532937

Download Submit
\Users\Admin\AppData\Local\Temp\~TMB03C.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TMB06C.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
memory/1124-2-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download
memory/1124-0-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download
memory/1124-9-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1124-11-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2320-30-0x00000000001C0000-0x00000000001CF000-memory.dmp

Filesize
60KB

Download
memory/2320-29-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2468-41-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2468-27-0x0000000000220000-0x000000000024E000-memory.dmp

Filesize
184KB

Download
memory/2468-57-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2520-45-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2896-38-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2896-40-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3060-28-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download