ramnit | 541368fcf837986198334b38c5d174ccb5d03031e260b46cdd0e20da72f52005

Analysis

max time kernel
94s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2025 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe
Size

1.1MB
MD5

79e372721128ea9890326b2d838ae9e9
SHA1

d3437a35f130a8b9a9cf821873c547f448558e6b
SHA256

541368fcf837986198334b38c5d174ccb5d03031e260b46cdd0e20da72f52005
SHA512

8d2f952ba3015fef52032c7c6eff1d3583d50ab306b06cad126d7bcdc449ef435f1bcb70a9356f7000180118f3ef31c0aa6785a6f886dda89f8059c98065590e
SSDEEP

6144:e+xDVG0Bpy+HfeUFrWgg0T9/bmH/0WTJYXV1sfhFJQYkOv:Fa0BNFFVbaH/Bi1sfXJQYjv

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 5 IoCs

pid	Process
548	JaffaCakes118_79e372721128ea9890326b2d838ae9e9mgr.exe
3880	WaterMark.exe
3768	WaterMark.exe
5004	WaterMarkmgr.exe
1756	WaterMark.exe

Loads dropped DLL 6 IoCs

pid	Process
4872	JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe
548	JaffaCakes118_79e372721128ea9890326b2d838ae9e9mgr.exe
3768	WaterMark.exe
3880	WaterMark.exe
5004	WaterMarkmgr.exe
1756	WaterMark.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wmdrtc32.dll	JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe
File opened for modification	C:\Windows\SysWOW64\wmdrtc32.dl_	JaffaCakes118_79e372721128ea9890326b2d838ae9e9mgr.exe
File created	C:\Windows\SysWOW64\wmdrtc32.dll	WaterMark.exe
File created	C:\Windows\SysWOW64\wmdrtc32.dll	WaterMark.exe
File opened for modification	C:\Windows\SysWOW64\wmdrtc32.dl_	WaterMarkmgr.exe
File opened for modification	C:\Windows\SysWOW64\wmdrtc32.dl_	WaterMark.exe
File created	C:\Windows\SysWOW64\wmdrtc32.dll	WaterMark.exe
File created	C:\Windows\SysWOW64\wmdrtc32.dl_	JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe
File created	C:\Windows\SysWOW64\wmdrtc32.dll	JaffaCakes118_79e372721128ea9890326b2d838ae9e9mgr.exe
File opened for modification	C:\Windows\SysWOW64\wmdrtc32.dl_	WaterMark.exe
File opened for modification	C:\Windows\SysWOW64\wmdrtc32.dl_	WaterMark.exe
File created	C:\Windows\SysWOW64\wmdrtc32.dll	WaterMarkmgr.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4872-29-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3768-118-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3880-117-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1756-115-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1756-110-0x0000000000400000-0x0000000000519000-memory.dmp	upx
behavioral2/memory/5004-95-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3768-88-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/5004-86-0x0000000000400000-0x0000000000492000-memory.dmp	upx
behavioral2/memory/3768-65-0x0000000000400000-0x0000000000519000-memory.dmp	upx
behavioral2/memory/3880-64-0x0000000000400000-0x0000000000519000-memory.dmp	upx
behavioral2/memory/548-58-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4872-55-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4872-28-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4872-23-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4872-22-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4872-21-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4872-20-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1756-123-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3768-130-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxBE9D.tmp	JaffaCakes118_79e372721128ea9890326b2d838ae9e9mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxBE9D.tmp	JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxBF1A.tmp	WaterMarkmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	WaterMarkmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	JaffaCakes118_79e372721128ea9890326b2d838ae9e9mgr.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMarkmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_79e372721128ea9890326b2d838ae9e9mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31153835"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442761627"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "374173006"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4199F96D-CA9E-11EF-A7EA-E6FB6C85BB83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "369016826"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "369329308"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{419A207D-CA9E-11EF-A7EA-E6FB6C85BB83} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{419A6E9D-CA9E-11EF-A7EA-E6FB6C85BB83} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "369016826"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{419EBEF6-CA9E-11EF-A7EA-E6FB6C85BB83} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "374173006"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31153835"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31153835"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31153835"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{419C5C9C-CA9E-11EF-A7EA-E6FB6C85BB83} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31153835"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31153835"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31153835"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "369016826"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31153835"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "369016826"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "374173006"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3768	WaterMark.exe
3768	WaterMark.exe
3768	WaterMark.exe
3768	WaterMark.exe
3880	WaterMark.exe
3880	WaterMark.exe
3880	WaterMark.exe
3880	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
3880	WaterMark.exe
3768	WaterMark.exe
3768	WaterMark.exe
3880	WaterMark.exe
3768	WaterMark.exe
3768	WaterMark.exe
3880	WaterMark.exe
3880	WaterMark.exe
3768	WaterMark.exe
3768	WaterMark.exe
3880	WaterMark.exe
3880	WaterMark.exe
3768	WaterMark.exe
3768	WaterMark.exe
3880	WaterMark.exe
3880	WaterMark.exe
3768	WaterMark.exe
3768	WaterMark.exe
3880	WaterMark.exe
3768	WaterMark.exe
3880	WaterMark.exe
3768	WaterMark.exe
3880	WaterMark.exe
3880	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3768	WaterMark.exe
Token: SeDebugPrivilege	3880	WaterMark.exe
Token: SeDebugPrivilege	1756	WaterMark.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1580	iexplore.exe
1624	iexplore.exe
4864	iexplore.exe
1940	iexplore.exe
4756	iexplore.exe
3576	iexplore.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
4872	JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe
4864	iexplore.exe
4864	iexplore.exe
4756	iexplore.exe
4756	iexplore.exe
1580	iexplore.exe
1580	iexplore.exe
1624	iexplore.exe
1624	iexplore.exe
3576	iexplore.exe
3576	iexplore.exe
1940	iexplore.exe
1940	iexplore.exe
764	IEXPLORE.EXE
764	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
1572	IEXPLORE.EXE
1572	IEXPLORE.EXE
2460	IEXPLORE.EXE
2460	IEXPLORE.EXE
5100	IEXPLORE.EXE
5100	IEXPLORE.EXE
1400	IEXPLORE.EXE
1400	IEXPLORE.EXE
1572	IEXPLORE.EXE
1572	IEXPLORE.EXE

Suspicious use of UnmapMainImage 6 IoCs

pid	Process
4872	JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe
548	JaffaCakes118_79e372721128ea9890326b2d838ae9e9mgr.exe
3768	WaterMark.exe
3880	WaterMark.exe
5004	WaterMarkmgr.exe
1756	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 548	4872	JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe	84
PID 4872 wrote to memory of 548	4872	JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe	84
PID 4872 wrote to memory of 548	4872	JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe	84
PID 4872 wrote to memory of 3880	4872	JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe	85
PID 4872 wrote to memory of 3880	4872	JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe	85
PID 4872 wrote to memory of 3880	4872	JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe	85
PID 548 wrote to memory of 3768	548	JaffaCakes118_79e372721128ea9890326b2d838ae9e9mgr.exe	86
PID 548 wrote to memory of 3768	548	JaffaCakes118_79e372721128ea9890326b2d838ae9e9mgr.exe	86
PID 548 wrote to memory of 3768	548	JaffaCakes118_79e372721128ea9890326b2d838ae9e9mgr.exe	86
PID 3880 wrote to memory of 5004	3880	WaterMark.exe	87
PID 3880 wrote to memory of 5004	3880	WaterMark.exe	87
PID 3880 wrote to memory of 5004	3880	WaterMark.exe	87
PID 5004 wrote to memory of 1756	5004	WaterMarkmgr.exe	88
PID 5004 wrote to memory of 1756	5004	WaterMarkmgr.exe	88
PID 5004 wrote to memory of 1756	5004	WaterMarkmgr.exe	88
PID 3768 wrote to memory of 2804	3768	WaterMark.exe	89
PID 3768 wrote to memory of 2804	3768	WaterMark.exe	89
PID 3768 wrote to memory of 2804	3768	WaterMark.exe	89
PID 3768 wrote to memory of 2804	3768	WaterMark.exe	89
PID 3768 wrote to memory of 2804	3768	WaterMark.exe	89
PID 3768 wrote to memory of 2804	3768	WaterMark.exe	89
PID 3768 wrote to memory of 2804	3768	WaterMark.exe	89
PID 3768 wrote to memory of 2804	3768	WaterMark.exe	89
PID 3768 wrote to memory of 2804	3768	WaterMark.exe	89
PID 3880 wrote to memory of 4492	3880	WaterMark.exe	90
PID 3880 wrote to memory of 4492	3880	WaterMark.exe	90
PID 3880 wrote to memory of 4492	3880	WaterMark.exe	90
PID 3880 wrote to memory of 4492	3880	WaterMark.exe	90
PID 3880 wrote to memory of 4492	3880	WaterMark.exe	90
PID 3880 wrote to memory of 4492	3880	WaterMark.exe	90
PID 3880 wrote to memory of 4492	3880	WaterMark.exe	90
PID 3880 wrote to memory of 4492	3880	WaterMark.exe	90
PID 3880 wrote to memory of 4492	3880	WaterMark.exe	90
PID 1756 wrote to memory of 2792	1756	WaterMark.exe	91
PID 1756 wrote to memory of 2792	1756	WaterMark.exe	91
PID 1756 wrote to memory of 2792	1756	WaterMark.exe	91
PID 1756 wrote to memory of 2792	1756	WaterMark.exe	91
PID 1756 wrote to memory of 2792	1756	WaterMark.exe	91
PID 1756 wrote to memory of 2792	1756	WaterMark.exe	91
PID 1756 wrote to memory of 2792	1756	WaterMark.exe	91
PID 1756 wrote to memory of 2792	1756	WaterMark.exe	91
PID 1756 wrote to memory of 2792	1756	WaterMark.exe	91
PID 3880 wrote to memory of 4756	3880	WaterMark.exe	93
PID 3880 wrote to memory of 4756	3880	WaterMark.exe	93
PID 3768 wrote to memory of 1580	3768	WaterMark.exe	92
PID 3768 wrote to memory of 1580	3768	WaterMark.exe	92
PID 3768 wrote to memory of 3576	3768	WaterMark.exe	94
PID 3768 wrote to memory of 3576	3768	WaterMark.exe	94
PID 3880 wrote to memory of 1940	3880	WaterMark.exe	95
PID 3880 wrote to memory of 1940	3880	WaterMark.exe	95
PID 1756 wrote to memory of 1624	1756	WaterMark.exe	96
PID 1756 wrote to memory of 1624	1756	WaterMark.exe	96
PID 1756 wrote to memory of 4864	1756	WaterMark.exe	97
PID 1756 wrote to memory of 4864	1756	WaterMark.exe	97
PID 4864 wrote to memory of 1572	4864	iexplore.exe	99
PID 4864 wrote to memory of 1572	4864	iexplore.exe	99
PID 4864 wrote to memory of 1572	4864	iexplore.exe	99
PID 4756 wrote to memory of 5100	4756	iexplore.exe	100
PID 4756 wrote to memory of 5100	4756	iexplore.exe	100
PID 4756 wrote to memory of 5100	4756	iexplore.exe	100
PID 1580 wrote to memory of 764	1580	iexplore.exe	101
PID 1580 wrote to memory of 764	1580	iexplore.exe	101
PID 1580 wrote to memory of 764	1580	iexplore.exe	101
PID 1624 wrote to memory of 2096	1624	iexplore.exe	102

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79e372721128ea9890326b2d838ae9e9.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79e372721128ea9890326b2d838ae9e9mgr.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79e372721128ea9890326b2d838ae9e9mgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Program Files (x86)\Microsoft\WaterMark.exe
    "C:\Program Files (x86)\Microsoft\WaterMark.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      PID:2804
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1580
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1580 CREDAT:17410 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:764
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3576
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3576 CREDAT:17410 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1400
- C:\Program Files (x86)\Microsoft\WaterMark.exe
  "C:\Program Files (x86)\Microsoft\WaterMark.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe
    "C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:1756
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:2792
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1624
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1624 CREDAT:17410 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2096
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4864
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4864 CREDAT:17410 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1572
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4492
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4756 CREDAT:17410 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:5100
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1940
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:17410 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
1.1MB

MD5
79e372721128ea9890326b2d838ae9e9

SHA1
d3437a35f130a8b9a9cf821873c547f448558e6b

SHA256
541368fcf837986198334b38c5d174ccb5d03031e260b46cdd0e20da72f52005

SHA512
8d2f952ba3015fef52032c7c6eff1d3583d50ab306b06cad126d7bcdc449ef435f1bcb70a9356f7000180118f3ef31c0aa6785a6f886dda89f8059c98065590e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
a242c16707ddb2e8d8cdc25c90105a56

SHA1
9b89a87ca70fd62da5d616640802babc7edf8f6e

SHA256
cc4f0c341edb160871fc365d7d6c69d4ad8aba356a3ed1c4b7edbe938a318d73

SHA512
40664796a563b766485552f7f4c5084c185ada5bc25556d155041443ad6257a396692fcb667d0ab69e3f666aa2940d7f28e39eaded9762240a24ed40d7ec0291

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
714ecf6ab3d1af6d86307ce87c573151

SHA1
827d5b8df3f67ad4177cff242aa279a3c959d9a1

SHA256
cb3d9ab69d5ed5e1eec0b52fa482d21a50cea356a49800a22214131b8c976e33

SHA512
f43d77c55f3760d9d63f8ed7561986fd09e43d471fb40def8b6e5bbacc7ed564e3188fe34de59f13ac1bedbfe2ba5af95834910be7742c106561312ece3aefa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
2950f11b3acd8120cbca43e16f96f82e

SHA1
2dc109f2b7c5198bffe5eaac19520b910b29265d

SHA256
cc745a81ab7d73393b548df1307dbca2b20eb3389cdd32c283d40ee540e5d23e

SHA512
86d0e0aaf9bf4d9326342886c334b12bfc4d5c920cb905eca40bb58fa307965f3f7382b3b6757ca2651f7ed2c03983b7f061ddbe5e20e45dbbd56873bf286b9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{419A207D-CA9E-11EF-A7EA-E6FB6C85BB83}.dat

Filesize
3KB

MD5
a1f6c27788cb1f5aa8a4b9beb0233f6d

SHA1
564d32edaa3ce245480a0b3386e0c50503febab4

SHA256
869296e7fee75baa227aebd8a4ae143cc59b983dcc94d2f701a87c625282b40b

SHA512
e811694ce4fad2faf8d6e6806eebdecae9b24bc27169652c4880a98a40ae9dc9b283c4f106a4c4bb47d414906bdee3cfee32535eba3c6f53f3462e9b1469f7fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{419A478D-CA9E-11EF-A7EA-E6FB6C85BB83}.dat

Filesize
5KB

MD5
3d63660b6877ee76b38d4c535142f9dc

SHA1
068391b8c65f68322539ecdda3da5208c169ab6c

SHA256
78c644fe28a44f3bda923012654bfcdd7980b13b9b7447495608c0524c065c53

SHA512
5ca37517eb3e2ccc9dd6a0e386ded00639f2b80e6210fed399022b0cef9ffdaedfd2fda189f90f0fb2434d1772a46583e87acc7c9f60fb586bb33b5373b2e4d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{419A478D-CA9E-11EF-A7EA-E6FB6C85BB83}.dat

Filesize
5KB

MD5
e0c562bf318fb6dfe785a84ff8d2b617

SHA1
01720b215320b149723af6c040e746544036cd77

SHA256
d3f051082d7fd449331cbe8b071227e8512e2ca31d84e7516148edff98166619

SHA512
943f641debf9865ca585b266f7d1bfa2d1f75ce64918f98493d5d38f811d32a500327a791ef2a760e55f18354e7b83bc303c9f932b1f5677679fa7a13f697eb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{419A6E9D-CA9E-11EF-A7EA-E6FB6C85BB83}.dat

Filesize
4KB

MD5
32c7b58cf6d6664859e6dd86b1debb90

SHA1
c1690981799b7afb09f145ea858080cef47ee895

SHA256
4dc865fee6181cb16d8c12cdcc6d9541f36b04e6ad5b78648adfd553c562b3c8

SHA512
9bc38d9ef0612cccf475b910ed374e0ea3a5f016a205eed158d1dc66e0fd13986c559b28b1dd688a40d2eb2ae5afd27f6b5b6d58eb10f457e4eb0185594692d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{419C5C9C-CA9E-11EF-A7EA-E6FB6C85BB83}.dat

Filesize
5KB

MD5
7e78a4f415ae68b230be79664651542b

SHA1
3c044c32bd7d417a59f7978cefac11d709c04842

SHA256
202e0b9b000a98bbda94b870be3b363cfdc3108c271ead74c908375814431890

SHA512
0a3b2e63541c7960504f535d548c4038e02821a6e016db04bf244513312683eee6df1776e342092657da14bf32eea362f8373c3133698427f0c568b5cbba12ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{419EBEF6-CA9E-11EF-A7EA-E6FB6C85BB83}.dat

Filesize
5KB

MD5
d9932d262bd2f1eed2eec4a03a52a9a1

SHA1
43029bf7b078d0871bcf68ae965f69e24d75a08a

SHA256
c4f68cb9a3611abeaec3c769739240ac0c309d92b49de126b570aabdbcdd2010

SHA512
1d593a1531a302b4695f7da4bd89db20d322be516ca62bec17ab0f719ed5a05eaa66860e9e93c10552af6b8e4a4ea005f149015ed448fac19572f91ab52e6b5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver418A.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKYZDMA5\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79e372721128ea9890326b2d838ae9e9mgr.exe

Filesize
537KB

MD5
1f8f57392cee0684921340dab90865ad

SHA1
77f0061a8c8e43141bea57a556c8cf78a99ac25b

SHA256
efe6562c918f955f7044a4a424afbcd35280a883e1503e55f0ca50f25235cdc6

SHA512
9cc59df7db9a7ae3fa960d7cc8f05a36a3ea800a9f8659884055e46e27057ded2c283ed6b33bc0e26b21fd4dcbf6b9ccf5680dd91ca4b96829eace5021dab75e

Download Submit
C:\Windows\SysWOW64\wmdrtc32.dl_

Filesize
25KB

MD5
fed957eb1ba973775cf98404c51ddb91

SHA1
f8855c34695dd7414e57a2156adea98909dcf598

SHA256
33e71d67ed8322d05542d4587fbc91a0aa309c45f41d1a35d493336751fdc644

SHA512
79da603974b773e03d1c8e7b5acf131f379e54adee81d632ce46a5cb466e0736e01215abee61cba98fd6f23d7048bab9970861716757a19ea9976ad769f3fb0b

Download Submit
C:\Windows\SysWOW64\wmdrtc32.dll

Filesize
40KB

MD5
03ebc053c8eec6b4f4afbbb5dc64b169

SHA1
9ed172dbce1a6a1dd20e08a9720afba210eee79c

SHA256
ad25714f5c7eb2e27742b5e0886e865fc8884e8b65cb863d2aeba0c6dbff2d02

SHA512
40eab99574ea6614341b869239b014a74cdc24da0c4be69681eaab18de72bbef14ad4cf36215e39eff4978b8ed074762ce25bb85a042219ac5db5cb46390e9ff

Download Submit
memory/548-58-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/548-8-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/548-40-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/548-54-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1756-107-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1756-110-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/1756-115-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1756-123-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2804-109-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/2804-108-0x0000000000B80000-0x0000000000B81000-memory.dmp

Filesize
4KB

Download
memory/3768-80-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/3768-66-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/3768-89-0x0000000077082000-0x0000000077083000-memory.dmp

Filesize
4KB

Download
memory/3768-118-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3768-119-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/3768-65-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/3768-130-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3768-88-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3768-121-0x0000000077082000-0x0000000077083000-memory.dmp

Filesize
4KB

Download
memory/3880-67-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/3880-117-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3880-64-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/4872-28-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4872-23-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4872-85-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/4872-18-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/4872-29-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4872-20-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4872-56-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/4872-21-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4872-0-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/4872-22-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4872-4-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/4872-55-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/5004-95-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/5004-87-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/5004-86-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download