ramnit | 7c6dbf173631073895a2664383561c04e3e7344e0dd2a1e82ffd3267cafb967e

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-01-2025 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_19f447bf03a5055f379751ec9d47735f.exe
Size

408KB
MD5

19f447bf03a5055f379751ec9d47735f
SHA1

dd5c17cd3ed77005e76d4572415ee8af88da86c3
SHA256

7c6dbf173631073895a2664383561c04e3e7344e0dd2a1e82ffd3267cafb967e
SHA512

70e4429c2188b9917042af395cdddc409c9a4b587aa20f96f47362168a65a98ce8fa60091ab70f5eb4c396812445ef0ab1647f8a00aa48f27b63142c450c2d7f
SSDEEP

6144:8lSDpABxavrQLKLl5enErwbBxVED8bR3javMVoyoHXI1pX:8EDpOIrQLKben5bBxaeRzxgI1d

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 4 IoCs

pid	Process
316	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe
2164	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrvmgr.exe
2284	DesktopLayer.exe
1912	DesktopLayermgr.exe

Loads dropped DLL 10 IoCs

pid	Process
3008	JaffaCakes118_19f447bf03a5055f379751ec9d47735f.exe
316	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe
316	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe
316	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe
2284	DesktopLayer.exe
2284	DesktopLayer.exe
1912	DesktopLayermgr.exe
2164	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrvmgr.exe
1912	DesktopLayermgr.exe
2164	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrvmgr.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001211a-2.dat	upx
behavioral1/memory/2284-25-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/316-23-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/316-7-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/1912-53-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2164-39-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2284-38-0x0000000000400000-0x0000000000447000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\pxA035.tmp	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayermgr.exe	DesktopLayer.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_19f447bf03a5055f379751ec9d47735f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrvmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AFEF12D1-D9B7-11EF-923A-F2DF7204BD4F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443818710"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2284	DesktopLayer.exe
2284	DesktopLayer.exe
2284	DesktopLayer.exe
2284	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3008	JaffaCakes118_19f447bf03a5055f379751ec9d47735f.exe
3008	JaffaCakes118_19f447bf03a5055f379751ec9d47735f.exe
2416	iexplore.exe
2416	iexplore.exe
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 316	3008	JaffaCakes118_19f447bf03a5055f379751ec9d47735f.exe	28
PID 3008 wrote to memory of 316	3008	JaffaCakes118_19f447bf03a5055f379751ec9d47735f.exe	28
PID 3008 wrote to memory of 316	3008	JaffaCakes118_19f447bf03a5055f379751ec9d47735f.exe	28
PID 3008 wrote to memory of 316	3008	JaffaCakes118_19f447bf03a5055f379751ec9d47735f.exe	28
PID 316 wrote to memory of 2164	316	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe	29
PID 316 wrote to memory of 2164	316	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe	29
PID 316 wrote to memory of 2164	316	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe	29
PID 316 wrote to memory of 2164	316	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe	29
PID 316 wrote to memory of 2284	316	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe	30
PID 316 wrote to memory of 2284	316	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe	30
PID 316 wrote to memory of 2284	316	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe	30
PID 316 wrote to memory of 2284	316	JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe	30
PID 2284 wrote to memory of 1912	2284	DesktopLayer.exe	31
PID 2284 wrote to memory of 1912	2284	DesktopLayer.exe	31
PID 2284 wrote to memory of 1912	2284	DesktopLayer.exe	31
PID 2284 wrote to memory of 1912	2284	DesktopLayer.exe	31
PID 2284 wrote to memory of 2416	2284	DesktopLayer.exe	32
PID 2284 wrote to memory of 2416	2284	DesktopLayer.exe	32
PID 2284 wrote to memory of 2416	2284	DesktopLayer.exe	32
PID 2284 wrote to memory of 2416	2284	DesktopLayer.exe	32
PID 2416 wrote to memory of 2624	2416	iexplore.exe	33
PID 2416 wrote to memory of 2624	2416	iexplore.exe	33
PID 2416 wrote to memory of 2624	2416	iexplore.exe	33
PID 2416 wrote to memory of 2624	2416	iexplore.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19f447bf03a5055f379751ec9d47735f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19f447bf03a5055f379751ec9d47735f.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:316
- - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrvmgr.exe
    C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrvmgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2164
- - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Program Files (x86)\Microsoft\DesktopLayermgr.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayermgr.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1912
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2416
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4de67002a8575024cf1ac3281dbdee1a

SHA1
a2933024f45ef56c40537649d104d5dc3bc90f81

SHA256
d3eee210d75c6ed1c1c55784d7eaa938eb4273a736b77739eba2c67762cbdca3

SHA512
c9e17319114fbbe5d3c2df46e3b518b6b5249fbd4eedfb3e65234cd7890df04ce75256a2d6438a7a45c66aa9ad82c98934060624d10ed53d91ae2c5c8c693f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7f14ecfd54dfa8144e5bf31828fdc5b

SHA1
d49f83ad760ae25f2a4ee5b87c3ce4e362c92a2c

SHA256
7869b1d89d43dc0778e7341f06518ea910ec72e69a2b5e67595cce9fb0e53b63

SHA512
9e84e1df290e6481ff3633a65d77c18b473268656c9cd3d78e316623b0a41143bee3bcbc275a834906df551c3e8ebb8e1ea4b7ba7d148e60fb1cb5421b36368b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
171a3937ea18faa2fd9f081b65173ca8

SHA1
676bc17b70ceda965c5e9bab23e9c95ef569cc03

SHA256
787fb1dc9e5ad4d435a21c31a53b93cc8478ca346d985ddc09a13248e08b176b

SHA512
f10789d51c373b9e4975d391d352749a59426aedc9c42242d71a34120435f8eaaaf919c45f2d5406477a1283c1807d6846a171cc0810b620f3a8bef657e8841e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
831c91372f09d5c53e5ac1d0e73df5f4

SHA1
e5288099ae9010173654b38de1cac0053871ed09

SHA256
66c18b0faa3d90fc4e13cd1fbdf9205c7a89b6b0ded3957cd8e44778fc3a674e

SHA512
0499dbe34579e826ed93cfd997c77e590e9c7efc6a0d0faa1c38fc6c5f317ccad46c207cf7fd1dcc8812feff06fa34ec19775e464dc8f4cff58c22f836dd8203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c1620ecc591b08f58e21446b65130a6

SHA1
86d3598b513919dc64fe3d8321b67d53421567cb

SHA256
2267110fe1e2ec6c81e0a77069b5fde9faccc329e1e132d848f90b1d2831fddb

SHA512
913d52fdbdddafed9ebdaf04fa17281a024a0f6ba9f7c323c9fd4cdd033fc569b8bfcc980ee2f211ecc538a57a76ca6de79d7a9c21c5378c39e441be0b2cb0f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e490bfa38ea10b75f0cbb48eed080024

SHA1
3c368162ff6dd0c2e3c85ec8231927328aa23390

SHA256
839990bacc373085af3f4d1623bbfe35cfcc65dd95d6574fccf1143e94c56e21

SHA512
d00e9aff68d59767ed5d656a94870838be445944309af35bd3fd4b00e68440b7581cced17ef66bc59b1cfb68b9ce52555f4f928616a2b1daa71887307362bc8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59a74f233e6b60b902a368999847e516

SHA1
6e1676fd11ce6882d64b6fb3143069e0b5002672

SHA256
36d4b7eeca8d7ea1b4e64c6bd395db168e7f375e5721fb1e4c4fd9514b92e3c8

SHA512
ad617944195512793d1165ca1ed8c2f70ae9784426338260d2940ff75b8db012d3b4ff271b426d74a42469c9202a044658addfb516cbb8761dee71c279afbb2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d37957a0dc74069c0b676bc4b65de74f

SHA1
2a3113defc4fb914b00f13dcc9485ed683be11aa

SHA256
30bc2132294527fa0b8e8415856ea7ae651d54716f333c2203644db63c2cd6ec

SHA512
ac83ea0276d207c090a4da37156292973905034974da0b82ca9c473e3b29db830ba87373a19e3563ab1575c8504721cca5c018bf3bc30ca00a326d957edbfd71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8ba5dd151924bb8e8a7a9205289a1c7

SHA1
ffce51c3ecee0d31e6566f3b3f1fa86e3a1ecb2e

SHA256
f25e6a61354bb83408c14aa5346c107454fba7abf9fb6b2524ff2194e7e4d8cf

SHA512
955bc544a7346ff500663c8eafd7044f5d9a59950f49d92dfc65781706fce73b8613a8f54c8be3c6281bd5ba11c45c72c5cc4aa1d931d38c1e3378aa8befe8d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1994d3f1a7ececf2862077531632f6cc

SHA1
7dea9b928a2840a68a611df32040c5f0660dd8ec

SHA256
6a9f26418714841b5c078f22d134a94cbfc88481eb0439ce4af33ea08815c5a6

SHA512
c445841efc111cba5ac9875068f2aff0c15e3073483a50bdee1939b48b73bf26d9fe2a2e84bc4cd61d186216c0d2fcb08179b8e16a602d51d9d06c89bf6c908c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa39dbab506a0f170f369396e9b65e8e

SHA1
0b38e085aee7407a1d4947666e9f1f198341f911

SHA256
dfb8dd946d63ebefe9cf5dfd762bc43038b1349c0dcab628ae5dcfe6d88d8b18

SHA512
9d9aa253397c88df6bbdf40d4a048a8ec50bf213838c0da663b88f24617e7b604f4ab885eb1044d2b3b18d7f0797931365eb1f41fd6aa4a7829f2112570d8fc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f289a8cf49dd66bf738dfd0bb6031efd

SHA1
5285fc9934c668f47353ebab82c1addc36d3ee42

SHA256
5a14d9675afa123ec05709fd3e3ba1446a4f6f03471203eb14890ea1645b8ce3

SHA512
82d08c18e4493e42775849cc24630776e6ec79d639958bb94f21bc8378e91b402623c2a22d8fb0452164f7559078df009d8bff73e40f45d38b976b264b593305

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e313f0aa3735fae2c061e6b1883e543c

SHA1
c10c877b432fdedf77ec8a8d724eba46da2fb4bb

SHA256
665908d52d1781053228322159d6c2f2e0df42c45f9555f0002a9046590b1d2c

SHA512
cf750f9db6b2d4ab45c3a6090b5bb484bd703a2286aeac803a8f05fe5fef5f1394ec074f6b3fc1cc8003f6d7879bdfc345b0ded3dbd335152e35704525c05f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fa9d58f9f494dc87b774378ece23bbf

SHA1
96b12575cdb1bb9c6f9a5953fdab155a0fbf897b

SHA256
5d2caad82146985d7868b9304ffbe45689eb6d01b29ab1f6442da1096cebe8cd

SHA512
24fb42cdbd98c591dae17ae799619fae06bb2a9b8abaddcd79025bfbb43356734516ffc146601b7dc522fd6e299752cde2ff1eb24e3a0f8eff5c2827f99ea20d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d08da7b99a90a582b6727fb4db79617d

SHA1
c1ada03d3c02a06b63da67f2cc8c51f129ff564c

SHA256
cb438b95056570b164aa5c92f4cceac92bc7612a3c7ffe1cbfe7872427e7900b

SHA512
48024144b1632c1c712c7b0b568e09c18f9f72ddfc4809d4809b0723ed7c5186939e6e5b3c0e38c44986e4538f09b6f7e8022abf1fd65137ed8975d8473ba5f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b7b200c8b32481a72925e67c9717a00

SHA1
1c957ab7e72c8e6ab2b4897791a9079e44b1f384

SHA256
4cc6036d877eb50d90eff3d6e9628d20721883c49170ce9f0481c9334aa94002

SHA512
78beeee5f594509bbe4d51aac1b802b9aae13b88c8e8c81ec90899d7d14353eae381e6aade7327d603e4867a93ba93484747012180e56069a510becf2ee5110b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bf2338020ca8dbd37637556195baea5

SHA1
6e0d895f94a54602a681641ec7335bf9f3be7caa

SHA256
d6d42043b730edeb2a981690ff43800244f485201daefbaa7cea1369347fa9a3

SHA512
dd68162f7acfe99c1698cd0b20d9a1c5c860c03797fc6e1ba3603bc6bceaec29bccd0d6c0ef2879bd2bab46f827a0538afa1ac684995bc02e2a61a8feb3515b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc7f455c4be849c00f063e7b72881097

SHA1
7c710c75bc3da15661168bb2a754cff10c323bef

SHA256
128d4c2475829420b0787c4195c56efbe1f4ef36d1e5f43208b8a1f39e25b0d6

SHA512
c2e91e03c2c7ba534b9bfe2f73f6414ff42020741564cbf935d2f18b9ec01d8b3c8a496d6de8eafb5de890c097242a60b4c149b55739a7113e4c60b925c6078d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
392ebb416ebc082aa8df5a370f5f70ad

SHA1
d46ee896f0a8cc86f555dbead5e9699326c8ff6b

SHA256
0583afe9a3a58e57b4c104d9f2967bc6c9f253d8073a124f71edb572895f769e

SHA512
b4389e6bc77b34cfb219f264961ffcfd74f6218eee39c90cbf0aed465c5556cb068b11bd56fccc29954f304d970e7aa2fe1643b886ee9757d3e526b2c22601ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0883392bbe8887cf1d28500fe682843b

SHA1
9e332ed3bead315c19ca273d0f01fe5ae57bb043

SHA256
fe49cf6b1db0aa82564e7bd4c8b584109f2342ab97c0f9fcb1bf99fd9475e176

SHA512
0809e51b44bf6850f8e181032e88c2631c23f8b5a3c95b9902718d802373b021bbdfb6b2651b80dce41ebcce8be65e0d1dcfec3943705aea2b1edc45723fd157

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC19D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrvmgr.exe

Filesize
94KB

MD5
f8434f362add5334f4f050f4b4b373a7

SHA1
f5915cb0d72c8faffe11126bc29da1b1db8092bc

SHA256
d34b378ede04c585c2bff8cf32112904e8512ee80c5a9fbb34ba224d8dbc868b

SHA512
6c6b4ea2b0e37a346145ee2814789d9da4c2688aff1c3e1cced16a620e8dc81566670336a3fe8a510b1754bbac6c3c6ac20aa7e20359b9c322bb220b50ac30b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC21D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\JaffaCakes118_19f447bf03a5055f379751ec9d47735fSrv.exe

Filesize
152KB

MD5
2c60a0eb60587e6e9dbd389576a30d91

SHA1
9fc335861b437bb6cb3079fb07e420d8f39a4b12

SHA256
e8452f0b8c328b8737d3244729cfb9b5e4295167bfda075b2679c0c9978ab631

SHA512
10f7f201c1c6a36d23df72bf333663de844b7dc1b7ab7cdfeb787e66bff2bc47cda3dbe96db2d6ecb2b33364923c8334310ba1a00937e7de3e1cf8e4869e3697

Download Submit
\Users\Admin\AppData\Local\Temp\~TMA0C2.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TMA101.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
memory/316-15-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/316-23-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/316-7-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1912-53-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2164-39-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2284-38-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2284-25-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2284-36-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3008-43-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3008-41-0x0000000000230000-0x000000000023A000-memory.dmp

Filesize
40KB

Download
memory/3008-6-0x0000000000220000-0x0000000000267000-memory.dmp

Filesize
284KB

Download
memory/3008-40-0x0000000000230000-0x000000000023A000-memory.dmp

Filesize
40KB

Download
memory/3008-488-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3008-0-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3008-57-0x0000000000220000-0x0000000000267000-memory.dmp

Filesize
284KB

Download
memory/3008-58-0x0000000000230000-0x000000000023A000-memory.dmp

Filesize
40KB

Download