ramnit | e5487e53861853c008db6f0d7a0c802fd177bb40aa14d0fecde9a1342d3e1cf7

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000.exe
Size

1007KB
MD5

49f54eb1429c3671f84f2a267cb6b000
SHA1

1e4eecf19f0ffa7c4578fb1386a31ea02a364a70
SHA256

e5487e53861853c008db6f0d7a0c802fd177bb40aa14d0fecde9a1342d3e1cf7
SHA512

78b85eb6b0bdae44f072d33b13d505df93371aa44068e162a389775413f1769cdf1c624b070db0113db2e589a6af6b7d062b8838219fc551acffc4871d12ee15
SSDEEP

24576:3fZVNEpgxyfQhcQZC3NZCzCyPlpSgaTSTf6c:3fZ/EpA9cZ3ClpSg0STf

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
2924	JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000Srv.exe
2404	DesktopLayer.exe

Loads dropped DLL 2 IoCs

pid	Process
2800	JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000.exe
2924	JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000Srv.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000e000000012275-5.dat	upx
behavioral1/memory/2924-7-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2924-11-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2924-10-0x0000000000230000-0x000000000023F000-memory.dmp	upx
behavioral1/memory/2404-21-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2404-22-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\pxE8F8.tmp	JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000Srv.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000Srv.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D54664B1-C806-11EF-A8EF-7A9F8CACAEA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "441873582"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2404	DesktopLayer.exe
2404	DesktopLayer.exe
2404	DesktopLayer.exe
2404	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2732	iexplore.exe
2732	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2924	2800	JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000.exe	31
PID 2800 wrote to memory of 2924	2800	JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000.exe	31
PID 2800 wrote to memory of 2924	2800	JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000.exe	31
PID 2800 wrote to memory of 2924	2800	JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000.exe	31
PID 2924 wrote to memory of 2404	2924	JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000Srv.exe	32
PID 2924 wrote to memory of 2404	2924	JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000Srv.exe	32
PID 2924 wrote to memory of 2404	2924	JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000Srv.exe	32
PID 2924 wrote to memory of 2404	2924	JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000Srv.exe	32
PID 2404 wrote to memory of 2732	2404	DesktopLayer.exe	33
PID 2404 wrote to memory of 2732	2404	DesktopLayer.exe	33
PID 2404 wrote to memory of 2732	2404	DesktopLayer.exe	33
PID 2404 wrote to memory of 2732	2404	DesktopLayer.exe	33
PID 2732 wrote to memory of 2560	2732	iexplore.exe	34
PID 2732 wrote to memory of 2560	2732	iexplore.exe	34
PID 2732 wrote to memory of 2560	2732	iexplore.exe	34
PID 2732 wrote to memory of 2560	2732	iexplore.exe	34

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000Srv.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000Srv.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4251c6e18a0e310575e5b70f31eef4c7

SHA1
d76ab2d7c2777a85eb21c1162bcae2abd4ceea4f

SHA256
72780050a4f6d8a5bd1b8e14bcc1d718788db945a05ec2ade39678e7151e5c3b

SHA512
6f1733f200fa9eef575e08cc2c74cc5f84ae91aadb2b2f7067c777cd30aefcb5050aeefc17100637f5b1d804eb659d83835607663fb73f6bc50d689eaab4ca33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
307f60981d0de371b5a3533a17d47ebd

SHA1
e01448a7a5ac6cb04e50cb13239656a419341e0d

SHA256
6710c9b28d1acfbc857013957cfc2d0c0813e2c918ae31bd6f8c02bc301ab60d

SHA512
db8e0ed63e74625275edf0bef393fc8a8046d45d0ba1b28bd2c1e94b3b1b62d177941844306b19177a2744c44228b8a8963d32fd5ab6eafd9b18c07368e1a18f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4de5700bf306e53baa1db392ca5cbb6

SHA1
1313412003ea7a67b4fb9a7d4d3740f3ac5d6f0a

SHA256
adbbfc21ba8101a660587281a4bc5a131669bd7f6f38ccda4b3dc88263c11190

SHA512
06f55504a8eb196d240eef897d7c164ff68c63927e473d457e6d42fbea6528c212b3b20f131ed53871bf76ac06b25dc81bacc64897e48d16146af735a764f53b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
917140d0c4b5f4bac41a27868377c398

SHA1
770043332b881fdb314bd6b27e288c46532f29d7

SHA256
5973f79bdc0758e52d68dbc822969dfd5a7d872d13a3add68247617c622bdf84

SHA512
5815efb7406cd0355fc56c947de076507667d2c752d59278f29f4800676e1bebb05a16975e3a418bd5a94c716c78a83645b0046862fd48c25ae0c6012470b310

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8636105810388990c7acf60590898105

SHA1
d9c30a89d6ba7d122ca9b9242e73778be9d87cd6

SHA256
228e9055995bdf8b2b861f9f98ac54025bbcb47c6c796690038edfc69aef368e

SHA512
9169634271dfe11eb5949eeafe912cdd0dc96d91d51f1f38eb6334703529073c517c1c48566fcdc25622fa689f155e07d37e0a7b02ddad0c44479422f8b1c95b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
392c400d7f305a21f4725522cf8ce626

SHA1
78b66cf671cd03649e02d0253262959a14690627

SHA256
f2f5dd9dfc7b425689deace0e946e3b3735d40f37d810aabbe899357b83c0b76

SHA512
471f465ff683c56f87dfafed3cc38c1d4278cf4400a05aed83ebd6027b9a6ba9a126b25128dd6707a254cba643ceefef0cc766271a9741c4b042c08d1c2ccda8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71c399811a26632241e2efeee3102483

SHA1
1712fa45a3d20c86cb98a299aead109699aa413e

SHA256
83f09b2e6e2b93b7ec9d1d553d133da72086e83ba1a73dc84d02b46b19e8a355

SHA512
ae99655b5bf8ca58a97984778ea207e57d8f3d6be860eb63f4e71843ddfe2d5839d39c763fe42df33303ae9ccfdc9702ad32086ee668960a808a1cfbf4d12fd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffca61d5913b794ff8f8d8184b395257

SHA1
11be27f0ff1319299c65073c4dbaa7860fb0add5

SHA256
2bcfcc136b097079492ad860aed594eb792528aacee5b52902a0cd30734db236

SHA512
56187571106badefb5ca01ff3edb2fc9f7bb0f64812621028eb71bbda44d30f7a7ee259782eeaa8c4bceee061be0280d42439b91d210ed228eb878eacde64be5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
075d81969a186746a6d529d48dbec2e4

SHA1
892d35d64fac0e750cc3252ead142d5c7961a264

SHA256
2dae2f9350c4caaaec8b3ffb981aab8b76566cacdd5f66e97c58f87fbe0de7a6

SHA512
5c1aacca649c7ba97d508d78126b19e22aafd5273a235b9d6fc0d41cb2316951c55c58df868117588c257021a20ff4f4166155fadc8ef05cd32cddfe597016b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05951b64fe561d8693fada180826b962

SHA1
2f0974912150a9fb558ac62b51e7d1765efc5e3e

SHA256
48da02d9b4deee458db5e0a85e7797d380a23ac88ee74079ec04d30cbfc85b50

SHA512
a3662c7749acc95c79c7030897f8339157d2fb52df35260da77cab009f0ac79807097e3957be0954cf8f64c4c51942f0f236bf603c9dc67f160f3e6a979add2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8aa47ea2165009ee109e9c2f6f94e91

SHA1
a1e2b753f33353ce4a6e4ef168db74923748e673

SHA256
81bc31cb2baab1301a8d47daa2ed2b7bfb3eb89ba98ce183c66b47ef9205aec1

SHA512
e88afd0fce7f8ee14345da25dba6579e98872b2d272c1a0ebb271b32058e9499cc30d4ad8e0bbd3718bb98d72b85fb9e8ec1bce277957d4f4305926949bd9687

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9abed5bfbbbe6f2ab9be383ac60e970

SHA1
f41f05dcd8f4c96a37464de24d8f2aeba80cdf32

SHA256
ce2cb6086947d0c9b07a2c89c7e53b067df2ceb1606e4a2caa3fe4d680256a1c

SHA512
c0deaf2bcf734191ebac18be2d9f9d246f715549e59fac1c1c4dda2154630e9bd601deab2c1a04ce8dc4d3f9de974956d9275743309b0057d79056543f07782c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a820dfbf0babe51619babc6e61c40e20

SHA1
6c3b0d3228aa96c5e3a902dba987a539ea9cb561

SHA256
593c943686983ae3607ea996ecde597f5e372ad9329ba3775fe94bb06cfd9721

SHA512
6bf0b7ebce6e8e2823060ad3c1209230cf439d2e946ece7df920966fdca3a146c9c96a40e85f7ee86ad7891d377b51f66418b7c9cbab609a2b75c3b90005220b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
776c7e04f99fe9a23e842c7ee7b3dc26

SHA1
b167fe1ef3e27f95103abc4867aabc335d926398

SHA256
c574faad285545f7fceddb3c4276303547a84861a585be9638d70600f36fe417

SHA512
31a9c31f517f4fb27c4b0c4e92f83b9c3bdaeb88d53a669d6150486570e6744ebe231368ffa60204ef4acbb7fb31d32ba0b0036934be441bb09dbcc0a82a37d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db17240f1b9f9550c7ac6281186ff64b

SHA1
ecc05c91f0aec3bfa4c6a0f7bde33e3470590b33

SHA256
a75e3cf019f8fb32cf21933fc19ef046d0a3ebff99021ab2b3b9b4b64598a0af

SHA512
906b529d5272f92066017f31aca2d4931691467b2d0b428f6229fbaeb4f42be35bd200e30dfc5ba0d3842fc943a980a59cf2632e18872a8bbb66b17ed05cb52a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a917a68ac9dcf113fc6e6487daab5bbb

SHA1
f2fc95f5d9fa7ffb63ece737112f11d310ea8bd1

SHA256
765401dbb87e627bbf801179b47cdfc7117ef257ba43d9564ac3392080af60ff

SHA512
ccfa0d68f83c904515b5656f294eeac4fe5235aefea28954b3d5c1c23fc63d983731ff03b9779772ea57abe606e80232b07dbac7a8710be356e3308f4a134b27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efa98437329a92512bccc050c8ce7b83

SHA1
f4d62b129f12f038b4561397be9a0dfd948dd520

SHA256
7ee17056100e00aee1810037c98c00e66b1451ffc8d10808c274df6a34838a06

SHA512
df1ea0546d29f938b2d85600d8eb465a215d69f82697c239fa2421a2ed8c6627202fe4b365cc33fd722e6b6841f8b562943a43ad9f390996167b9c3028961c67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c6dd5a355cd368c14c9b2a9674e92ee

SHA1
c3b7efb258d91eac19753fbbd6a2ea906faf76d8

SHA256
ed1ed0cc6954666865be787562ffbb5095fca8228ff9a1dcfe849ae5a8f5201c

SHA512
b69c8de2512afadac0e0d25ea386a14005a1cf46be56c1e78640ced391d342b6801b3eefa3cee8bb77aa54304a81cc46a014503f78cb99bb780ff109dcbfbd0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c983ada43f3a8942a0ec701494f0707a

SHA1
bc393ee91b0890e59390703ef1d1949fbea78965

SHA256
c823030636d516755e6f8e55f4314bcd9f2784003b6e6241a6fcde46fa2db134

SHA512
f3ed73f9419396a81e1d0aca71d7ccfaef39637299be6f8bb252eda0b4821d2eefd499b88a3894f09fc013c1b6f7cbf459757ae81a6ff57fa763920035c53671

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFEFB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_49f54eb1429c3671f84f2a267cb6b000Srv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFF6B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2404-19-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2404-21-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2404-22-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2800-8-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download
memory/2800-1-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download
memory/2800-6-0x0000000000510000-0x000000000053E000-memory.dmp

Filesize
184KB

Download
memory/2924-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2924-11-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2924-10-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download