ramnit | aa42191bd18cb6f98c9b5324d053ed40bf27c12396078891d9a70a2764802ee1

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

186289681118b2e422babea77d2b83d9_JaffaCakes118.exe
Size

109KB
MD5

186289681118b2e422babea77d2b83d9
SHA1

483fcf6c86f34249283a8f58a4f25700c8aec546
SHA256

aa42191bd18cb6f98c9b5324d053ed40bf27c12396078891d9a70a2764802ee1
SHA512

9457affaebe567426de8c044bc3f48516d71d8e32b6219e8244c2cab5b69246bfdcafb94d0c85108a78e94e6fa2eec08ac35dd652d2017e8600af8460ecfe9b6
SSDEEP

3072:ZZfYO7p820efPp12eVH4CL9NVnkXHuQS/AgGgTQ:ZVh7p820kKeIuQsGg0

Score

10^/10

ramnit banker bootkit persistence spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

908 cmd.exe
Executes dropped EXE 5 IoCs

Processes:

186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exewuaucldt.exewuaucldtmgr.exewuaucldt.exewuaucldtmgr.exe

pid process

1200 186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe
2684 wuaucldt.exe
2504 wuaucldtmgr.exe
1648 wuaucldt.exe
2672 wuaucldtmgr.exe

pid	process
908	cmd.exe

Loads dropped DLL 10 IoCs

Processes:

186289681118b2e422babea77d2b83d9_JaffaCakes118.exewuaucldt.exewuaucldt.exe

pid	process
2232	186289681118b2e422babea77d2b83d9_JaffaCakes118.exe
2232	186289681118b2e422babea77d2b83d9_JaffaCakes118.exe
2232	186289681118b2e422babea77d2b83d9_JaffaCakes118.exe
2232	186289681118b2e422babea77d2b83d9_JaffaCakes118.exe
2684	wuaucldt.exe
2684	wuaucldt.exe
2684	wuaucldt.exe
2684	wuaucldt.exe
1648	wuaucldt.exe
1648	wuaucldt.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe	upx
behavioral1/memory/1200-11-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1200-14-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1200-16-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2504-40-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2504-43-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2672-68-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2672-67-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2504-70-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1200-129-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

wuaucldt.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wuaucldt = "c:\\windows\\system32\\wuaucldt.exe"	wuaucldt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuaucldt = "c:\\users\\admin\\wuaucldt.exe"	wuaucldt.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

svchost.exe

description ioc process

File opened for modification \??\PhysicalDrive0 svchost.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Drops file in System32 directory 3 IoCs

Processes:

186289681118b2e422babea77d2b83d9_JaffaCakes118.exewuaucldt.exe

description	ioc	process
File created	\??\c:\windows\SysWOW64\wuaucldt.exe	186289681118b2e422babea77d2b83d9_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\wuaucldtmgr.exe	wuaucldt.exe
File created	\??\c:\windows\SysWOW64\wuaucldt.exe	wuaucldt.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

wuaucldt.exe

description pid process target process

PID 1648 set thread context of 2140 1648 wuaucldt.exe svchost.exe

description	pid	process	target process
PID 1648 set thread context of 2140	1648	wuaucldt.exe	svchost.exe

Modifies Internet Explorer settings 1 TTPs 59 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A3CE881-34F2-11EF-BD87-DEB4B2C1951C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425701858"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A336301-34F2-11EF-BD87-DEB4B2C1951C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exewuaucldtmgr.exewuaucldtmgr.exe

pid	process
1200	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe
1200	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe
1200	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe
1200	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe
1200	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe
1200	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe
1200	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe
1200	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe
2504	wuaucldtmgr.exe
2504	wuaucldtmgr.exe
2504	wuaucldtmgr.exe
2504	wuaucldtmgr.exe
2504	wuaucldtmgr.exe
2504	wuaucldtmgr.exe
2504	wuaucldtmgr.exe
2504	wuaucldtmgr.exe
2672	wuaucldtmgr.exe
2672	wuaucldtmgr.exe
2672	wuaucldtmgr.exe
2672	wuaucldtmgr.exe
2672	wuaucldtmgr.exe
2672	wuaucldtmgr.exe
2672	wuaucldtmgr.exe
2672	wuaucldtmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exewuaucldtmgr.exewuaucldtmgr.exe

description pid process

Token: SeDebugPrivilege 1200 186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe
Token: SeDebugPrivilege 2504 wuaucldtmgr.exe
Token: SeDebugPrivilege 2672 wuaucldtmgr.exe
Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

2596 iexplore.exe
2596 iexplore.exe
2596 iexplore.exe
2616 iexplore.exe
2596 iexplore.exe
2596 iexplore.exe

description	pid	process
Token: SeDebugPrivilege	1200	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe
Token: SeDebugPrivilege	2504	wuaucldtmgr.exe
Token: SeDebugPrivilege	2672	wuaucldtmgr.exe

Suspicious use of SetWindowsHookEx 26 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
2596	iexplore.exe
2596	iexplore.exe
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2596	iexplore.exe
2596	iexplore.exe
2596	iexplore.exe
2596	iexplore.exe
1512	IEXPLORE.EXE
1512	IEXPLORE.EXE
1492	IEXPLORE.EXE
1492	IEXPLORE.EXE
2616	iexplore.exe
2616	iexplore.exe
2596	iexplore.exe
2596	iexplore.exe
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2596	iexplore.exe
2596	iexplore.exe
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

186289681118b2e422babea77d2b83d9_JaffaCakes118.exe186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exeiexplore.exewuaucldt.exewuaucldtmgr.exeiexplore.exewuaucldt.exewuaucldtmgr.exe

description	pid	process	target process
PID 2232 wrote to memory of 1200	2232	186289681118b2e422babea77d2b83d9_JaffaCakes118.exe	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe
PID 2232 wrote to memory of 1200	2232	186289681118b2e422babea77d2b83d9_JaffaCakes118.exe	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe
PID 2232 wrote to memory of 1200	2232	186289681118b2e422babea77d2b83d9_JaffaCakes118.exe	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe
PID 2232 wrote to memory of 1200	2232	186289681118b2e422babea77d2b83d9_JaffaCakes118.exe	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe
PID 1200 wrote to memory of 2596	1200	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe	iexplore.exe
PID 1200 wrote to memory of 2596	1200	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe	iexplore.exe
PID 1200 wrote to memory of 2596	1200	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe	iexplore.exe
PID 1200 wrote to memory of 2596	1200	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe	iexplore.exe
PID 1200 wrote to memory of 2616	1200	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe	iexplore.exe
PID 1200 wrote to memory of 2616	1200	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe	iexplore.exe
PID 1200 wrote to memory of 2616	1200	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe	iexplore.exe
PID 1200 wrote to memory of 2616	1200	186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe	iexplore.exe
PID 2596 wrote to memory of 2628	2596	iexplore.exe	IEXPLORE.EXE
PID 2596 wrote to memory of 2628	2596	iexplore.exe	IEXPLORE.EXE
PID 2596 wrote to memory of 2628	2596	iexplore.exe	IEXPLORE.EXE
PID 2596 wrote to memory of 2628	2596	iexplore.exe	IEXPLORE.EXE
PID 2232 wrote to memory of 2684	2232	186289681118b2e422babea77d2b83d9_JaffaCakes118.exe	wuaucldt.exe
PID 2232 wrote to memory of 2684	2232	186289681118b2e422babea77d2b83d9_JaffaCakes118.exe	wuaucldt.exe
PID 2232 wrote to memory of 2684	2232	186289681118b2e422babea77d2b83d9_JaffaCakes118.exe	wuaucldt.exe
PID 2232 wrote to memory of 2684	2232	186289681118b2e422babea77d2b83d9_JaffaCakes118.exe	wuaucldt.exe
PID 2684 wrote to memory of 2504	2684	wuaucldt.exe	wuaucldtmgr.exe
PID 2684 wrote to memory of 2504	2684	wuaucldt.exe	wuaucldtmgr.exe
PID 2684 wrote to memory of 2504	2684	wuaucldt.exe	wuaucldtmgr.exe
PID 2684 wrote to memory of 2504	2684	wuaucldt.exe	wuaucldtmgr.exe
PID 2504 wrote to memory of 2028	2504	wuaucldtmgr.exe	iexplore.exe
PID 2504 wrote to memory of 2028	2504	wuaucldtmgr.exe	iexplore.exe
PID 2504 wrote to memory of 2028	2504	wuaucldtmgr.exe	iexplore.exe
PID 2504 wrote to memory of 2028	2504	wuaucldtmgr.exe	iexplore.exe
PID 2504 wrote to memory of 764	2504	wuaucldtmgr.exe	iexplore.exe
PID 2504 wrote to memory of 764	2504	wuaucldtmgr.exe	iexplore.exe
PID 2504 wrote to memory of 764	2504	wuaucldtmgr.exe	iexplore.exe
PID 2504 wrote to memory of 764	2504	wuaucldtmgr.exe	iexplore.exe
PID 2596 wrote to memory of 1512	2596	iexplore.exe	IEXPLORE.EXE
PID 2596 wrote to memory of 1512	2596	iexplore.exe	IEXPLORE.EXE
PID 2596 wrote to memory of 1512	2596	iexplore.exe	IEXPLORE.EXE
PID 2596 wrote to memory of 1512	2596	iexplore.exe	IEXPLORE.EXE
PID 2596 wrote to memory of 1492	2596	iexplore.exe	IEXPLORE.EXE
PID 2596 wrote to memory of 1492	2596	iexplore.exe	IEXPLORE.EXE
PID 2596 wrote to memory of 1492	2596	iexplore.exe	IEXPLORE.EXE
PID 2596 wrote to memory of 1492	2596	iexplore.exe	IEXPLORE.EXE
PID 2616 wrote to memory of 1872	2616	iexplore.exe	IEXPLORE.EXE
PID 2616 wrote to memory of 1872	2616	iexplore.exe	IEXPLORE.EXE
PID 2616 wrote to memory of 1872	2616	iexplore.exe	IEXPLORE.EXE
PID 2616 wrote to memory of 1872	2616	iexplore.exe	IEXPLORE.EXE
PID 2684 wrote to memory of 1648	2684	wuaucldt.exe	wuaucldt.exe
PID 2684 wrote to memory of 1648	2684	wuaucldt.exe	wuaucldt.exe
PID 2684 wrote to memory of 1648	2684	wuaucldt.exe	wuaucldt.exe
PID 2684 wrote to memory of 1648	2684	wuaucldt.exe	wuaucldt.exe
PID 1648 wrote to memory of 2672	1648	wuaucldt.exe	wuaucldtmgr.exe
PID 1648 wrote to memory of 2672	1648	wuaucldt.exe	wuaucldtmgr.exe
PID 1648 wrote to memory of 2672	1648	wuaucldt.exe	wuaucldtmgr.exe
PID 1648 wrote to memory of 2672	1648	wuaucldt.exe	wuaucldtmgr.exe
PID 2672 wrote to memory of 1676	2672	wuaucldtmgr.exe	iexplore.exe
PID 2672 wrote to memory of 1676	2672	wuaucldtmgr.exe	iexplore.exe
PID 2672 wrote to memory of 1676	2672	wuaucldtmgr.exe	iexplore.exe
PID 2672 wrote to memory of 1676	2672	wuaucldtmgr.exe	iexplore.exe
PID 2672 wrote to memory of 2072	2672	wuaucldtmgr.exe	iexplore.exe
PID 2672 wrote to memory of 2072	2672	wuaucldtmgr.exe	iexplore.exe
PID 2672 wrote to memory of 2072	2672	wuaucldtmgr.exe	iexplore.exe
PID 2672 wrote to memory of 2072	2672	wuaucldtmgr.exe	iexplore.exe
PID 2596 wrote to memory of 2356	2596	iexplore.exe	IEXPLORE.EXE
PID 2596 wrote to memory of 2356	2596	iexplore.exe	IEXPLORE.EXE
PID 2596 wrote to memory of 2356	2596	iexplore.exe	IEXPLORE.EXE
PID 2596 wrote to memory of 2356	2596	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\186289681118b2e422babea77d2b83d9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\186289681118b2e422babea77d2b83d9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2232

C:\Users\Admin\AppData\Local\Temp\186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe
C:\Users\Admin\AppData\Local\Temp\186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:275458 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2628

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:472069 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1512

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:734212 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1492

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:4142086 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2356

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2616 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1872

\??\c:\windows\SysWOW64\wuaucldt.exe
c:\windows\system32\wuaucldt.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2684

\??\c:\windows\SysWOW64\wuaucldtmgr.exe
c:\windows\SysWOW64\wuaucldtmgr.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:2028

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:764

\??\c:\users\admin\wuaucldt.exe
c:\users\admin\wuaucldt.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1648

\??\c:\users\admin\wuaucldtmgr.exe
c:\users\admin\wuaucldtmgr.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:1676

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:2072

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
4⤵
- Writes to the Master Boot Record (MBR)
PID:2140

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del c:\windows\syswow64\wuaucldt.exe
3⤵
PID:1352

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del c:\users\admin\appdata\local\temp\186289~1.EXE
2⤵
- Deletes itself
PID:908

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a5488ac8a7bb74c6a071a37c612c4689

SHA1
5d50c68ed4eae8367074ac125ce65db9f8cc131f

SHA256
c568d2cacbc840eab4268897a258f008988b4378400b4c873d3f225c4174c5ec

SHA512
0442692af087cc043155b58abeef7340579f8c4c6438c81541a0b4b8e5be4016e8a779895e00e94c11ba42556c1ed589509b81b2b0ddac77b47e48b5ddd83170

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a26679d7e174ccf11e4039ffd02e2227

SHA1
8fc2de14f1ed0b2cadcfbd35bc48d8bd92fe9a1f

SHA256
b563ecb93936a325eab0282759e83cfb77bb50a71604d622ade5f0f6d688dcc2

SHA512
e9e9f78580990f72194f6d8072f86cbd64529604023fbfd7dfd9a0ddacf9b91fa9f38879adcc999ea08e387048ec2e2deef53f20154761c6069ad39e2f73c743

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
1c6e510673cad356cbcf6da3cede1eb3

SHA1
ec91d29db04f90f99785416bb8a63c8ece39e6bf

SHA256
a4c07228822fc078e9fd1087cc4eae48a3ccf806a77b70391914d37e6d52f996

SHA512
257e15d71c744040f3c1a74ef57cc8780e620a58f28ed629aace05e244a4463db26e53aa5663aae223680a1267f7ce6d18cce19d19aaa7171a91df5c064f9ed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
1adae661557179d2f4fc966b4ebd163b

SHA1
c118d3ca8c0594af294ffc90508e00f9d3542c0e

SHA256
9c461ad108f9a3a6049bf8e8516ffaaa5956a2909a114a30027cd38f90a659a3

SHA512
d3af8e30ba64c2cbb789376c7db3a40ec595ceceb7622d98327a2bdaa414d3ac5eaf825bfc81d742515dfa10b7356dfc20fb50d23b10f95baf2b28678ccc8e7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
4555b40168f49d5798296da35abf5660

SHA1
8bc1230ed2df47678d86f6440ac9ecdfcec37a58

SHA256
47f0f1fb2b0315247fa8ceca79e1e72369c28898782ec2c874a73060867958a1

SHA512
b70fc5123c977978621181efc3b6fda3ad8e1bde14937a1c2e8bb453aaf03b989b18782463cd9907ca34be5eac4ac8bb275d931b1f597c26e3f689b2636794cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c5abfba3198f5d4e909bd20d4d0dd8e2

SHA1
7184ccbc16f679f286482f9d261fba9dfdfcd8ba

SHA256
1ad8dbb69a1c2674b30de5c538abf0701303da5df05f152ab62afc418974cd01

SHA512
637ceeca98bf9b0eb5e4e76e3020933f6fe41b46088ed6ad17cc584c0d58fc932e08d2813a3b256eae589244fdb7c86357c4ae734cf3ee0b52baeb3bb3e812d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
8358f568d7e1959ca36142ff288838aa

SHA1
107b4311ca17d95156cac8cde29c29d8b309bb6d

SHA256
ee13a8b0702ab38ff0ad4da082e9fd4065a2eb8530b8fcb4cd7ca9a090dc6494

SHA512
32247148b3f2b279088741c28b348a0ff048ce9f2bf7f3c7a80cf0853e8516b194d2549face074c953e925b46ae6042b72306c6697b20d590154c7bb83209de0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
0e1e6a46b2cbcfbf016887bb23e1caf8

SHA1
a85196f803140ddfced71b78745738b786baf1c9

SHA256
b29b47f992d9cdfbe6a203b0bab2916a9f99eb77545483ac6d1b6845bcc2b1bc

SHA512
6e13a0a046a643b42775eee36b7369fca2de690780f5a0d6a6b2713f49a8bc3376e6dfa89d179ee873470bdb8aece4194d8c21063c88356e9312b94cfe3909e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
b865ada6c5c79489ded2eb6f9c7a0940

SHA1
d52acc37ad5ad1beb404f46c8b6d8252df9a0510

SHA256
904e0076ca489b22201deb457b29d320eded0c9570fdb0d3df1669db5bc8caa6

SHA512
e899dfa0eab4a81d73b75fbe94dfb4541bf2777bd90d714dc17dc55c9e84947bd9094e5ce56380f6a4a1a1c5f8661b0888e9548e29414b820ff2e114da2cbcaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
f4ba01a6e37825e49cf23f6fc8d9bb63

SHA1
ba21ffa53fcb59dc5e3df8458a4e9c6376928681

SHA256
e87a35b8e88c23a2373bae7880103ddd62356c03b2fadaa41060f6005acbae61

SHA512
df14f50f4be9f798c2aa1b2205b73054faa9a502783b24a70b040260c043a13b035bfa48ac653429c53217a1f47169c7cb5999f21a6bdf092613f9bd771adc8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
0997a51fa3a5c8c700f6ad50bf74b311

SHA1
7e7e958bb3dff91d313db38c056a632d88da78fd

SHA256
16c6c92266d7d2b15c2f4eb527804ff827af1bb37e10a90f01619c4a8f3cc3b8

SHA512
585182904a35442d158f644b3fdb873e3fdbdf97d670b3a12aee46f512b414d74cbf854421e8b57dc78f048395424b10a01f319424d1bd25801a8e0f89d61003

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
88c582ae690a9070c9172ef54b979004

SHA1
75956f3cbec7037988b021699839ff89bcebddf9

SHA256
0a8aabf0922f16dc1a0a14ff25d8a36d9656be6ec3c1a5b020641a055ff4f8a6

SHA512
786ad2d73172019c434a3e54527e7d1e70f056bc89a4f20ee0e4c97f05b469be4f04d16266d2e18cb4e9ed695d338f75e10b6d6346ddc868bb7f8912e439fd1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
f024ea61544ac74a5406f6b5d3f8fdaf

SHA1
01fe7b15afbfef90095642cef97353eb922e5c59

SHA256
0de6506bdc5b55493236d660f0865612220c8f27adf86a8adbc37c5cbfc24c12

SHA512
0529d582af517adaedae9b78935e103fc7478c61ef9910a455913284585302793cd2d710c4c0826441fa2dd7497ff866ad6856dd5ae200d267d5b744f4a7c506

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
ccb3a96dc340d34be69845da770d6eb6

SHA1
ff03da348174b2672f5206fdd8df24fe94837410

SHA256
986bcb548069a3e5c4e0715cab99c9078053b985a2e16645c4ef6044772cc50a

SHA512
add418a5f6649366e3b09d1fa27dd729ef2dfde507c930dfe3ed7f80441ffff0f33b0c13720d12e275fcba30af00ef6dc101a3283ab117c7524901563ca21e19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
f0c4008ebbfe9c55f054f9301277f0d1

SHA1
ac22c5d09c1eac6aba38e09a0af1a73ce4b4cade

SHA256
9b86842c8969776c824ed63425d6efdac009fed1a17dcc2de9b17d5f9c8a3edf

SHA512
4b7130ecc1dcc5361aafa835afc61193e95b695d5ef9fa0cfe5baf40d10d8ef068d8eeb2f13b3fc4bcd23abd80e5df955e6a908c3b79aeb7c72e7b048a99b725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
e4464496e58d2b9f4e788dcb659e5a46

SHA1
8473b196d6360436ee85ab4ef2ce0437784b1eec

SHA256
de5f1737a558f2ee445f6d9b9ddfafaf9692fe857c859e213b9cb1e1edc0d733

SHA512
95c7250861f8cac9eb1dd4f3b1d1d24acbf128ffb381a3fa712dcafaa3e8249fbcdd88737b65cb952c78ed4a8d629d0856889c422d0920109ea49e0508b28403

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c68229fe5b83e04cc5eaba9c7ed7e749

SHA1
f46172d43c24c93bfd4de4a3c6648b7dc8d393a4

SHA256
23bd19bf06ceacab2db1838ec0c04f455d361aef10939682707dc46f7f0212e1

SHA512
415b04d3f1afd65496ec5d44619a48cc567824508b3deaded25b9e98adab28cd12b890978252de65d85ce10af403fad6ee02d8f673d35563f1df2a5d5f3718b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
4d1d8332e34236b6150bf863cc70d4c5

SHA1
347622007d8e4855c74ccd8ad30cc83313d229f4

SHA256
a6473e118f277e29ec2a7f556c80f1394fe96c6326f2131c531eef72c6602187

SHA512
47fedbf96bd674b5e4147c39bc23b082bc81c8dbbd12d00ab5058a0f5577ad3db1329813e696dc63c56cb1b9d0d118c90ff1ddfc859292333cb694620d925eea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a469229fd0d6a37e81cddb3957c944e0

SHA1
d416e3ccd51c79889337b24c3421450f619fe9c7

SHA256
303688c5b53f8ca4920a4a638cadd75b2732827929ab6af7e470e9bfc4153f4c

SHA512
7a9404a9880aa6d97a8dc52566226004f2c3b9808a821348b8b12c4066b4c6df0314e04c3c6894526e578b7dbfce058ab3d6c3017fdc45d857857bf12fdd51b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1A336301-34F2-11EF-BD87-DEB4B2C1951C}.dat
Filesize
6KB

MD5
cdd39a2e1d47e976a097e229fa60ce1b

SHA1
bf28210e55b20f07f6809757006189f04d42ee40

SHA256
fa6947ab55277e8a46caea3e1faa758af3f7ad47eced470e06c0c84474b12790

SHA512
5e8c4d6927b4ccb7b4d36e88ab836f66a93159d8074567104568476aa52fa0bc342589f10c87bc33a63329ffc1992bdaa70482d6b1bd23e1e725efad1edd7dc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab88D2.tmp
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8971.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\186289681118b2e422babea77d2b83d9_JaffaCakes118mgr.exe
Filesize
73KB

MD5
23842802587d1c2570eec734a06cc188

SHA1
aecd57ced1f79fa0dcc93076b3254216d08b907f

SHA256
aa94699c1420a0a2c0d07a936fe2acc26cdbb410f7bc47552110504e91b4a8d8

SHA512
80ebdf18eff5b25e4ce2dccb44d5b55a9e377b5b339da3a253679d0a4eb0e6fb57595aabb979014aa4e3d59f8622d4660df763d79d8a813365eff0538c05b1c7

Download Submit
\Windows\SysWOW64\wuaucldt.exe
Filesize
109KB

MD5
186289681118b2e422babea77d2b83d9

SHA1
483fcf6c86f34249283a8f58a4f25700c8aec546

SHA256
aa42191bd18cb6f98c9b5324d053ed40bf27c12396078891d9a70a2764802ee1

SHA512
9457affaebe567426de8c044bc3f48516d71d8e32b6219e8244c2cab5b69246bfdcafb94d0c85108a78e94e6fa2eec08ac35dd652d2017e8600af8460ecfe9b6

Download Submit
memory/1200-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1200-11-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1200-12-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1200-129-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1200-15-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1200-16-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1200-13-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1648-72-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1648-73-0x0000000070000000-0x000000007000B000-memory.dmp

Filesize
44KB

Download
memory/1648-57-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2140-75-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2140-84-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2140-81-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2140-78-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2140-76-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2140-83-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2140-80-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2232-4-0x0000000000220000-0x0000000000266000-memory.dmp

Filesize
280KB

Download
memory/2232-9-0x0000000000220000-0x0000000000266000-memory.dmp

Filesize
280KB

Download
memory/2232-17-0x0000000009000000-0x0000000009009000-memory.dmp

Filesize
36KB

Download
memory/2232-18-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2232-1-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2232-22-0x0000000000390000-0x00000000003AE000-memory.dmp

Filesize
120KB

Download
memory/2232-30-0x0000000000390000-0x00000000003AE000-memory.dmp

Filesize
120KB

Download
memory/2232-39-0x0000000000220000-0x0000000000266000-memory.dmp

Filesize
280KB

Download
memory/2504-40-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2504-41-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2504-43-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2504-42-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2504-70-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2672-68-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2672-67-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2684-31-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2684-56-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download