1d4b24ddbd00a7cb94862b2705b818819bdc660623eaf922b7dbdda57ae14b0c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5eca01abdb65e6b1bc82bd6fecf9fa5d_JaffaCakes118.exe
Size

96KB
MD5

5eca01abdb65e6b1bc82bd6fecf9fa5d
SHA1

50b1e6a496c0804ec575e0fbb9fa6a0330a4c364
SHA256

1d4b24ddbd00a7cb94862b2705b818819bdc660623eaf922b7dbdda57ae14b0c
SHA512

0a58d921a9fd638d9c3fe340479cb81fc2c9da7bd28768e5878465c3281ea809b898391b056b8cb160ed940de51be3fbc8040b7d0aca64b031511c1e8d714efa
SSDEEP

1536:cnMhHVopQGLIllwHGzHK447x6xF4TJas7WYyIq4hGzW3QEPaBk97mk:+wVopQGkWHz4GxWF4JDYmicaBsf

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 18 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\syshelp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UI0Detect.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibmavsp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mgavrte.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\neowatchlog.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweep.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\efpeadm.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsuppnt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\n32scanw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navex15.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpost.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IE4UINIT.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\callmsi.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\etrustcipe.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fprot.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SbieCtrl.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweepsrv.sys.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wink.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Netscape.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alerter.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luspt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcfwallicon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbust.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xscan.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fslaunch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpnt.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwupd32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsave32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rshell.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnlan300.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan40.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navengnavex15.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netcfg.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\programauditor.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppinupdt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\proport.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav7win.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeweb.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpd.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\doors.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ping.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symtray.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Filemon.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HelpPane.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Opera_964_int_Setup.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-prot95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naveng.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fa-setup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbscan.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpupd.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\claw95ct.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scvhosl.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\supftrl.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwinntw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsetup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SVCHOST.EXE	winlogon.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	5eca01abdb65e6b1bc82bd6fecf9fa5d_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	winlogon.exe

Executes dropped EXE 3 IoCs

pid	Process
3816	winlogon.exe
2188	winlogon.exe
2356	winlogon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4592-0-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/4592-2-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/4592-3-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/4592-14-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/2188-23-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/2188-20-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/2356-28-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral2/memory/2356-32-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral2/memory/2356-31-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral2/memory/2356-35-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral2/memory/2188-106-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/2356-188-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral2/memory/2356-800-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral2/memory/2356-821-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral2/memory/2356-904-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral2/memory/2356-2210-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral2/memory/2356-2876-0x0000000000400000-0x000000000043A000-memory.dmp	upx

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4696 set thread context of 4592	4696	5eca01abdb65e6b1bc82bd6fecf9fa5d_JaffaCakes118.exe	85
PID 3816 set thread context of 2188	3816	winlogon.exe	90
PID 2188 set thread context of 2356	2188	winlogon.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.hugedomains.com\ = "32"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cdc5e48483fa34f869ba9241b9515380000000002000000000010660000000100002000000044b5594fdcb1ac321ddb6845f395406d77ffb22a7a1274579038d3ec9addf7ab000000000e8000000002000020000000cb06f7dcf010e5f4a0eff4c8f9333e9cef49f6460f9e3f7bb281291da00f06d820000000083c89a20a245e7bf9e23c7e5f923a31fdc70bc4e769773e79210324f8c4275a40000000d79ac4df5a282b45d2a7d603def1e53d7d764c9ddae1c84ccdbe33d5476bf3a16042f1d271a91138478372624c71cf2dacb8603d2572c07b414bba68f89dd8ce	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cdc5e48483fa34f869ba9241b95153800000000020000000000106600000001000020000000bf2447588301390d9bf433bad162e7568f0739405858b897fcbfaabd9700c5e4000000000e80000000020000200000004db4e63d82353757cc5671147f0c3ff3309e74a4cbcc7cb5e1b0f41635d29d6820000000db80cf627cd78de263a3dbc1582f44c31925deef307acdb38f7e925638c24b02400000001990402d5000c51df8ca0f1d10e4c4aeb8c376f58ae7c80c409b150bb2c4051dd275ccc72ec698dbbd1159afb0eff083eeec1156f0d75d6200535ea64cd0dca3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://szq7nx36ohsr254.directorio-w.com"	winlogon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0bb1d7551dada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\tiny.cc\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0062807e51dada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\tiny.cc\Total = "140"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\tiny.cc\ = "180"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31119953"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.hugedomains.com\ = "32"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409ec49f51dada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "32"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3083537351dada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\tiny.cc\Total = "180"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "276"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cdc5e48483fa34f869ba9241b95153800000000020000000000106600000001000020000000f28e2c847b3bdd1f4ffd4d5a3b60143ecb7f85673ba73d41ee765a56b10748b6000000000e800000000200002000000095ef96f623bee2a5f21c14e6e7b49dd889fca9bb90d4b56399a63a15433b779020000000f579412d54cd9664ff0f467b2ac0b40c747c6d7bf7d681f4b555dd3d8f980e8440000000116f2f490626f152bb9c15da68b060b2af3d848b0a4badc1713103a34f06a296a03de5a19795c72a622a57c3c9ba805729b3dc0cbc7edd9e84a230386d1a3bca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\hugedomains.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\tiny.cc\Total = "259"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e31e8951dada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\tiny.cc\Total = "43"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\tiny.cc\ = "101"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.hugedomains.com\ = "32"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\tiny.cc\Total = "82"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://2o46zpd55le2931.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\tiny.cc\Total = "101"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31119953"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\hugedomains.com\Total = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "316"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cdc5e48483fa34f869ba9241b95153800000000020000000000106600000001000020000000e0d880ac7fb4285480a555c121c2140b9981079e7f7c3a944a502fcdeb068fb6000000000e800000000200002000000025523c775b2714a543c1f2eae6ea73b752daafc3eb841463dacc6f253f11260920000000182b2784b8490ab42ef36bb92048f235a43873c0c710fd418feb7de349f5f1df400000007fc5166fae94546adaa8e0f3eb7a269196bde80926bb38127431a918d19839bc5e554e97ef55f87d91a1aeef975a79e7fb945179d8f8f7218d66c4a6194a77ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\tiny.cc\Total = "219"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\tiny.cc\ = "43"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\tiny.cc\ = "259"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.hugedomains.com\ = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\hugedomains.com\Total = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2151101364"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "316"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.hugedomains.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b02f3a9751dada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100f8d9b51dada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cdc5e48483fa34f869ba9241b95153800000000020000000000106600000001000020000000a8e2eaf97266dde995e766fb8468479217723e78f3aaf9bcd102aeb83a71278c000000000e8000000002000020000000ab9d6e3e2b93224daedd3774ffecebd9702db80044b5e068d20e45be7cbe6c8920000000251384bd8dbfaca4fa38040280ff113bcbebe6d6d9fd2208628e2466fea0ec87400000001937487f850e35a5f1cceb4f5c128b5661f44473b0974e8783cfc66555cbd757fbae7f18b2cb365fcfdccb826f8327fa26a2c4f2c43efe0afb7573e9640e3c94	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\tiny.cc\ = "82"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://1v80h63835gz2sh.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://6w7zsqa4e40zju8.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2356	winlogon.exe
2356	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	2356	winlogon.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4864	iexplore.exe
4864	iexplore.exe
4864	iexplore.exe
4864	iexplore.exe
4864	iexplore.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
4592	5eca01abdb65e6b1bc82bd6fecf9fa5d_JaffaCakes118.exe
2188	winlogon.exe
2356	winlogon.exe
4864	iexplore.exe
4864	iexplore.exe
3636	IEXPLORE.EXE
3636	IEXPLORE.EXE
4864	iexplore.exe
4864	iexplore.exe
1068	IEXPLORE.EXE
1068	IEXPLORE.EXE
4864	iexplore.exe
4864	iexplore.exe
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
4864	iexplore.exe
4864	iexplore.exe
1552	IEXPLORE.EXE
1552	IEXPLORE.EXE
4864	iexplore.exe
4864	iexplore.exe
4876	IEXPLORE.EXE
4876	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 4592	4696	5eca01abdb65e6b1bc82bd6fecf9fa5d_JaffaCakes118.exe	85
PID 4696 wrote to memory of 4592	4696	5eca01abdb65e6b1bc82bd6fecf9fa5d_JaffaCakes118.exe	85
PID 4696 wrote to memory of 4592	4696	5eca01abdb65e6b1bc82bd6fecf9fa5d_JaffaCakes118.exe	85
PID 4696 wrote to memory of 4592	4696	5eca01abdb65e6b1bc82bd6fecf9fa5d_JaffaCakes118.exe	85
PID 4696 wrote to memory of 4592	4696	5eca01abdb65e6b1bc82bd6fecf9fa5d_JaffaCakes118.exe	85
PID 4696 wrote to memory of 4592	4696	5eca01abdb65e6b1bc82bd6fecf9fa5d_JaffaCakes118.exe	85
PID 4696 wrote to memory of 4592	4696	5eca01abdb65e6b1bc82bd6fecf9fa5d_JaffaCakes118.exe	85
PID 4592 wrote to memory of 3816	4592	5eca01abdb65e6b1bc82bd6fecf9fa5d_JaffaCakes118.exe	87
PID 4592 wrote to memory of 3816	4592	5eca01abdb65e6b1bc82bd6fecf9fa5d_JaffaCakes118.exe	87
PID 4592 wrote to memory of 3816	4592	5eca01abdb65e6b1bc82bd6fecf9fa5d_JaffaCakes118.exe	87
PID 3816 wrote to memory of 2188	3816	winlogon.exe	90
PID 3816 wrote to memory of 2188	3816	winlogon.exe	90
PID 3816 wrote to memory of 2188	3816	winlogon.exe	90
PID 3816 wrote to memory of 2188	3816	winlogon.exe	90
PID 3816 wrote to memory of 2188	3816	winlogon.exe	90
PID 3816 wrote to memory of 2188	3816	winlogon.exe	90
PID 3816 wrote to memory of 2188	3816	winlogon.exe	90
PID 2188 wrote to memory of 2356	2188	winlogon.exe	93
PID 2188 wrote to memory of 2356	2188	winlogon.exe	93
PID 2188 wrote to memory of 2356	2188	winlogon.exe	93
PID 2188 wrote to memory of 2356	2188	winlogon.exe	93
PID 2188 wrote to memory of 2356	2188	winlogon.exe	93
PID 2188 wrote to memory of 2356	2188	winlogon.exe	93
PID 2188 wrote to memory of 2356	2188	winlogon.exe	93
PID 2188 wrote to memory of 2356	2188	winlogon.exe	93
PID 4864 wrote to memory of 3636	4864	iexplore.exe	101
PID 4864 wrote to memory of 3636	4864	iexplore.exe	101
PID 4864 wrote to memory of 3636	4864	iexplore.exe	101
PID 4864 wrote to memory of 1068	4864	iexplore.exe	109
PID 4864 wrote to memory of 1068	4864	iexplore.exe	109
PID 4864 wrote to memory of 1068	4864	iexplore.exe	109
PID 4864 wrote to memory of 2032	4864	iexplore.exe	113
PID 4864 wrote to memory of 2032	4864	iexplore.exe	113
PID 4864 wrote to memory of 2032	4864	iexplore.exe	113
PID 4864 wrote to memory of 1552	4864	iexplore.exe	114
PID 4864 wrote to memory of 1552	4864	iexplore.exe	114
PID 4864 wrote to memory of 1552	4864	iexplore.exe	114
PID 4864 wrote to memory of 4876	4864	iexplore.exe	115
PID 4864 wrote to memory of 4876	4864	iexplore.exe	115
PID 4864 wrote to memory of 4876	4864	iexplore.exe	115

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\5eca01abdb65e6b1bc82bd6fecf9fa5d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5eca01abdb65e6b1bc82bd6fecf9fa5d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Local\Temp\5eca01abdb65e6b1bc82bd6fecf9fa5d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\5eca01abdb65e6b1bc82bd6fecf9fa5d_JaffaCakes118.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\Users\Admin\E696D64614\winlogon.exe
      C:\Users\Admin\E696D64614\winlogon.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2188
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Modifies firewall policy service
        Modifies security service
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Windows security bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Event Triggered Execution: Image File Execution Options Injection
        Drops startup file
        Executes dropped EXE
        Windows security modification
        Adds Run key to start application
        Checks whether UAC is enabled
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2356

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2092

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:2240

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4864 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3636
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4864 CREDAT:82956 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4864 CREDAT:82960 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4864 CREDAT:82964 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1552
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4864 CREDAT:82968 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
8d1040b12a663ca4ec7277cfc1ce44f0

SHA1
b27fd6bbde79ebdaee158211a71493e21838756b

SHA256
3086094d4198a5bbd12938b0d2d5f696c4dfc77e1eae820added346a59aa8727

SHA512
610c72970856ef7a316152253f7025ac11635078f1aea7b84641715813792374d2447b1002f1967d62b24073ee291b3e4f3da777b71216a30488a5d7b6103ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
b15aa8e661114b4000f3f180d9ba50e6

SHA1
e7a98e30a03528392b4e27078b6a2b9b8fb6b643

SHA256
cf701c897f7dd2904dda74c021c9fdb804fa285c782c74c7211be308ac7556cc

SHA512
bab164b3fc8baea733e1db7fce7ea44c480ec6eafca102b2b0f0ca496fa7519380050ecc187f90a6c9b4b6be28d26996271462bf0fbc935861cbca1f0f374d76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DA548C7E5915679F87E910D6581DEF1_2127CDE0B8BA86E04FEDA60E9E7BEC3F

Filesize
472B

MD5
801041b064a159356cd13debde723ffe

SHA1
dc8c2a8aded4879a55a01462fd5fc70fbf96be5a

SHA256
540dd4664185183ab49ccb52570ca87abf29de9f3bec0b4dfc35afa0d81b212b

SHA512
1ae12f64189091c3a4f86a7d9181a2ebb9490e164e2ff631a535db6cb7254a78c087e4828e87a1f41a31888c8ce0c1e21f1db2d83c888c0d4f297de734b7e400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
7fb5fa1534dcf77f2125b2403b30a0ee

SHA1
365d96812a69ac0a4611ea4b70a3f306576cc3ea

SHA256
33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

SHA512
a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_32201FF65E9A20A693462A3946A29CAE

Filesize
472B

MD5
8ed11cc2877da0e2ad73aff3c3b34fb0

SHA1
0408361069ad097511adc1c5b71f688fc30720b0

SHA256
1e7edc7af66cce5619c248d3b4befdd2e54281bcfa00619b4e0b73c090b23a00

SHA512
aa27e26b21378b2dd9f0b848cda2a8c86eb6482c51cbc3bc184ac7f66be9195934535b13a41ebe2aba2904aa7da8bb0838b97f6e34d330706f11cdbaaed5fafc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
1bfe0a81db078ea084ff82fe545176fe

SHA1
50b116f578bd272922fa8eae94f7b02fd3b88384

SHA256
5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f

SHA512
37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_697B85986BA53F639B96C385F501E04B

Filesize
471B

MD5
8869c15d7f868a58c18acd816802a6cb

SHA1
6f24a9679f4f027b8768f26917c8e8e462cd877b

SHA256
5ee71038b31ec4a0b530c7f869a2ab570c0a5df9e741c56f6449d4cc102b7c84

SHA512
1d5f8ebefd79fc2f77958e25695914d88e5ac5e586ef4902aace86093c815441c1f0863925d7ba162e1f7fd2289da184236982536f0f50d657ae030913a550af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_857450206B889F4FEA0F888FA03D68DB

Filesize
471B

MD5
91068c39d313261893af5838a70d4005

SHA1
e868a3bad427d66b32847e5d5d83139ed8db889e

SHA256
54191ee4eaed67878ee6431b9f48b024de2db1eb953dfb64f8ce024fe8064120

SHA512
01ba0d72a5b31535834a02198a51c4a63e070491868305a348d0760c35bbc77f8f051ee159f6e48e9a8d913937861ae7884ed594717b96c952a100abb689c5ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_A544EBE79B1DD7EC00B6BC577CD08BE2

Filesize
471B

MD5
f30a89be41f447c1808fa097834ee77b

SHA1
6eacca4ae05359942cd29d0f11248886257bf214

SHA256
8165ebe0a16694f05221ff53512551b42988aa553af2edf32c036c13a84dfc41

SHA512
06c8376790aeee8529ae753e04ddf7919d060fcdefc1a2853d052af428a4e627cb08a20131b4854e35d51944adc951ef31efaeed83e742fd16e0d1e2cafa46d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
471B

MD5
8255fd3bb06e2a508b446ad8c8ee8fff

SHA1
b308bf70aae7703ee9dd0927a2a3686010054a30

SHA256
3874bcba92b60a47d5738864d76d22b877b9bf3f46dd862f95db1f0fbe816b1b

SHA512
86053ce0432df960c7b8ed7f67f6dd2c86eb5c23007c833bbf352cee0d3ff65154e872068fe824538564d4beeec603d6a48d8beae6561364777322aac5451670

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
471B

MD5
ef005d46b6023f37ee1a3c40be7fd337

SHA1
308bc55aa8c2d2b5a9019b80c7f593c721b20aba

SHA256
1b8b69634f47e70e8117c5c2aaae5ddc44e9426b6f84989628985f4e9aa33642

SHA512
a254bcbcc51aefb8742c3ae8b64b5420630500a9ab217dd7974ebf5efad85b0e7dd3b36d6f4d2e1ec14c65a07f1279c78c336da5ba49bd91843ce530d504ee65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
c787004b9b290430ea56c6b9815937c2

SHA1
887de6d95aa00bd54d1bdb0196b318309ef080e2

SHA256
235a548d925a8a7751847ee109010e603a9e64c57c3f105ff85bfcb4929d96b7

SHA512
ea91197ca61c9cfb387c8b154b8616673a69085c2dbf9edb276846c6d19a578f781947ebd90ef92a3097b62fbdf130eb19a4f7a3773dc0590a216a8a7349ef93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
1b171adf7e5c39d2baed97c00d86c1b8

SHA1
1f15b3fc7b2890d11395376637247e0d46446404

SHA256
6a391b460b1a41f16f8a3d3f235d63c6ef8a2c0ba4e608539367a8b6a483cf30

SHA512
7ecf4ccb7c92541adf4392c8f0223c63a732229a3adeffa70d961658d82b96e6188e7b8838ff9bb03369ee0af7ab060778756b0cfc3a5f12fbc06f0b38ce26fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_2127CDE0B8BA86E04FEDA60E9E7BEC3F

Filesize
410B

MD5
8c4361faefd5db49c3255e1416c96007

SHA1
4f8a69f7aeb3b090f3f92251f36452ba41b42e75

SHA256
f967c6f853e9facc80e1dd406ccc328c6e50347cbda9df3c609f021d0c83119c

SHA512
ea7e9a993dd8854c636d5bf5e091d2e0437e4dcbeedafbc5231eddd28ee6ef633077dc2374c87d6d6e78a44e444356599063e4fb4d108cbfb96151460132cfb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
3c53b6ae91bd5ead08bb91e393be5e79

SHA1
e320af6e3a578ced52c2231582c823f67557a969

SHA256
f77b1abfd900b009eacc4d8798d67e760194293862562efbb1854525fcc7024c

SHA512
947d6eef62cf049dd75a165225093d08b113d5bad7c16401b262ad6ca38ecbd6bf16a7bfbf7e4af636082984ade26c6fb0b7080cba5a710c44fad3f4671aac8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_32201FF65E9A20A693462A3946A29CAE

Filesize
402B

MD5
519c3b3560cef4d61457efb1dabc4bad

SHA1
34d321ebb352afe100bc317e6f18ad21fed0bf98

SHA256
605c88d365f04c6690d42b7c9799fd327039dd4f997acd6d0d98db23f5c563c8

SHA512
afaffee067a60aa7edea2c203ea79af9d050f3964455e887570a9cb62473963dd903b7793565503b45b58968fb7cc7a58cb464e759f8ee1f1c7b918566c14ad5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
199eed613604dd53b84c30ea7bfc2960

SHA1
593cc45274bdf3c6d9f65e4b260053bb7d7733cd

SHA256
4dc2a178676fa4d10b0d31ad1b935b81cbe8317a0baff1aee7c4c2fa791cbbb9

SHA512
762f0bcd1fdbf09d10e39053bd5fd4613459dc3090c7adbd527fcda53161e2d84af94ffe0dbe8438cf3b2acb80d753422ec758f1ac30683839c1c68b6f94bc2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_697B85986BA53F639B96C385F501E04B

Filesize
402B

MD5
952f3d6a0f6114057ddcae8f5df426ce

SHA1
0b6acb39f06080f0a494caa666f14f98994a324f

SHA256
6aaed10d38846b28d891e020844fc8cd3a984ba1f142d1d069f72ae081a4ad91

SHA512
5dffc6c3f3f784743609fbe381775698f8fad7737b6b357a952e8d4c6cdfeeb5c1ef53e7d30bdcc4ded7d898202312a68fa799296d297ab31c96cf1c1c10b0e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_857450206B889F4FEA0F888FA03D68DB

Filesize
402B

MD5
a73405af00a9304ec25fb0119af90b7a

SHA1
5ee61a4517deee13452535bcc18b27432ce10879

SHA256
6c1e8513746cb6c050a54f656f23d466b58320b8c99f5c59b388453c373e660d

SHA512
fb64681455ff31fc1b07e73e6f10379a129d2333f6e918f09a3bf9401d13cf77187544464abd1a26213eae3bb6d6787c0056b022e33156061fba226f52fec5d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_A544EBE79B1DD7EC00B6BC577CD08BE2

Filesize
406B

MD5
58569b76055b3991715b64819c93bc3c

SHA1
2d97ab6f4f34c30fd831f4ee3124a798c351b442

SHA256
55731aeabb041e3f95ac0823985acecb40907a04eb21ac3341e974c1f753ce23

SHA512
ea747f1fc099526274299b2dc55279fbab73c9599626aac74546c130ae8610efe6ffbc4ad0075364c4374b819b325e6a479e56a678d9d0d9f150d438ff5ce68a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
412B

MD5
7080c87bdad8b07046ba37636b6d170c

SHA1
96410900e15fca94f2fb9f08d1bad7223f001197

SHA256
063f4a0e0b465fb75509960a4150598a4e39f9ead0656409f09f8248bc6ebe26

SHA512
9bdd5b36dd906d8394560e95b7ed149aab02846d082aa0ebacd1b2fd43141770541ac4b4e4d9919e3f9a7416e4c26e2f0a61020ed466786a9c0d6d2f45f15b95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
412B

MD5
ca30669f71dc463f76cea61fc01dde18

SHA1
4c5a5ebf14d6747c8c8fe87a61383c8a9e3bdbdb

SHA256
7de17d45dfd1141b19fafafdcd55a7012df7d103990ef93aa9f6cfc02612bee6

SHA512
aededcbe566aead8fe984f93f605c37640267cc897a7fafb4af3818a9b42233835a14958f7078dd7c7a2014eb5d8dcd432b314ae73d634603ff11e3a30ea5694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\KF13OAZO\www.google[1].xml

Filesize
99B

MD5
508cc083e6a43426a09d6cee52518fa2

SHA1
526e3257dd3c40515bf549f0d4fcb704ad72f3dd

SHA256
e7523087e6c8fc6de643290e285c72aec37a3b0ee74aaeefd8a7d870ff0d788c

SHA512
76067cb5d2113dcd260239031a27cf4d1135506984dffa00aec198a023d1abd4f9029ffe98a9f5038409aec1dce5c69048ea5fd9affd5d3bfec93994cd157383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\LVKDYPPZ\www.hugedomains[1].xml

Filesize
116B

MD5
f16220008aa5ea5ada955b6c675dd120

SHA1
07b495a83f66b19896096c08f79ac681b8438619

SHA256
a3a54683689f34e3f4e52782ede02f64847c48a3c725b56c5bc68d5b0e606e10

SHA512
d7b1dccb66b6fe19138278e3b525d0be3ffb3b5141956b717ad0834ca36da54e3e430684e7af5322b9acfb65ead1c923419b0617c8fe3a71745db11c5bdbe0a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\LVKDYPPZ\www.hugedomains[1].xml

Filesize
116B

MD5
2560d7f7f5d14470c730b98eb9e80091

SHA1
c8229b28ae3f551062175e965c06976fa8570d83

SHA256
9384256dc536d156ef227c0cadb63362a6743b022b74ca4e79c2353cfe4396c0

SHA512
3f6818c789b7b87d700cc4cd6c74ecc87f7036302601d7c949308c6d785aad1a61c48e01038dae6f40ef919f5aa591ba45e22fddd92f547b25edc2f2448741e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\KFOlCnqEu92Fr1MmYUtfBBc9[1].ttf

Filesize
34KB

MD5
4d99b85fa964307056c1410f78f51439

SHA1
f8e30a1a61011f1ee42435d7e18ba7e21d4ee894

SHA256
01027695832f4a3850663c9e798eb03eadfd1462d0b76e7c5ac6465d2d77dbd0

SHA512
13d93544b16453fe9ac9fc025c3d4320c1c83a2eca4cd01132ce5c68b12e150bc7d96341f10cbaa2777526cf72b2ca0cd64458b3df1875a184bbb907c5e3d731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\T8GpkddkA6CSyLz5asofCO_HZBRBM8cVyQXF-JPmwG8[1].js

Filesize
24KB

MD5
aaafddb619afe0c5ba99bc8828ebd751

SHA1
d1d8b3dc4e27135b877f49c99b0cca84c858c15b

SHA256
4fc1a991d76403a092c8bcf96aca1f08efc764144133c715c905c5f893e6c06f

SHA512
cf0a3ddaa4183ff85ea3877852b4a273361abbef1b62060077983e52d11f5e7bb954b11beb0c19e2ee17857296d8c32c8ab750a645ba7ed81193054358d0d1d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\analytics[1].js

Filesize
51KB

MD5
575b5480531da4d14e7453e2016fe0bc

SHA1
e5c5f3134fe29e60b591c87ea85951f0aea36ee1

SHA256
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

SHA512
174e48f4fb2a7e7a0be1e16564f9ed2d0bbcc8b4af18cb89ad49cf42b1c3894c8f8e29ce673bc5d9bc8552f88d1d47294ee0e216402566a3f446f04aca24857a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\css[1].css

Filesize
530B

MD5
1e7cca7a1b89ea2980669f4adb65becd

SHA1
62da7767f3bb769a9b31e400df446a4698e4db63

SHA256
598ad75d6e2e244b759b3f376b510f0ba560b77cc74f48351dcf2abdb7df474f

SHA512
206b90eab94f9ce7260ec624ec9a8afd70bba96d4dc5d8a545a29cd73e55832196e509523da1123c2279eb4cb63fef429e28a3438a268dd3fabd1fd949caf1c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\d[1]

Filesize
23KB

MD5
ef76c804c0bc0cb9a96e9b3200b50da5

SHA1
efadb4f24bc5ba2d66c9bf4d76ef71b1b0fde954

SHA256
30024e76936a08c73e918f80e327fff82ee1bd1a25f31f9fce88b4b4d546055d

SHA512
735b6470e4639e2d13d6b8247e948dbd6082650902a9441b439ceacc4dfce12cd6c9840ee4c4dcb8a8f1e22adb80968f63ace0c0051811a8d6d1afb2b3c68d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\domain_profile[1].htm

Filesize
6KB

MD5
74e5a9cc7eb99cf9f02c5396fb1320fe

SHA1
da3cb5cbc676e70c9e8552ce7045a6fb20fa76c2

SHA256
6c1a2c6591b8f56cf88f5d45103f91787b8f87f8ccf19399323ddb8daf5a5cda

SHA512
6212751343d84a6bad8502340f60f4f96cdc8c4da2036e6211bdda073bc5b966ea59c00a56db947fb7771a80cce3cb63ef146bc63cf6f15e759b76fe17e51cd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\jquery.fancybox.min[1].css

Filesize
12KB

MD5
a2d42584292f64c5827e8b67b1b38726

SHA1
1be9b79be02a1cfc5d96c4a5e0feb8f472babd95

SHA256
5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0

SHA512
1fd8eb6628a8a5476c2e983de00df7dc47ee9a0501a4ef4c75bc52b5d7884e8f8a10831a35f1cdbf0ca38c325bf8444f6914ba0e9c9194a6ef3d46ac348b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\jquery.min[1].js

Filesize
84KB

MD5
c9f5aeeca3ad37bf2aa006139b935f0a

SHA1
1055018c28ab41087ef9ccefe411606893dabea2

SHA256
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

SHA512
dcff2b5c2b8625d3593a7531ff4ddcd633939cc9f7acfeb79c18a9e6038fdaa99487960075502f159d44f902d965b0b5aed32b41bfa66a1dc07d85b5d5152b58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\o-0mIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjcz6L1SoM-jCpoiyD9A-9a6VQ[1].woff

Filesize
16KB

MD5
642d45886c2e7112f37bd5c1b320bab1

SHA1
f4af9715c8bdbad8344db3b9184640c36ce52fa3

SHA256
5ac87e4cb313416a44152e9a8340cb374877bb5cb0028837178e542c03008055

SHA512
acda4fedd74f98bcee7cf0b58e7208bdb6c799d05fa43b3fb1cd472e22626322f149d690fe5f2cdc8953244f2899bebe55513b6f766a1f4511d213985a660c3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\phone-icon[1].png

Filesize
705B

MD5
296e4b34af0bb4eb0481e92ae0d02389

SHA1
5bd4d274695c203edc3e45241d88cda8704a9678

SHA256
eada6e51071e406f0ec095cdd63092399a729a630ae841c8e374ff10dca103aa

SHA512
0bed089f0ac81291a532194377acde5beafa7763f445e80c3eaa7206740c582dde843f65b5b3885d9b2e34610b2eda45885c8d45c31408761adf4f81f3caed1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\t[1].gif

Filesize
49B

MD5
56398e76be6355ad5999b262208a17c9

SHA1
a1fdee122b95748d81cee426d717c05b5174fe96

SHA256
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

SHA512
fd8b021f0236e487bfee13bf8f0ae98760abc492f7ca3023e292631979e135cb4ccb0c89b6234971b060ad72c0ca4474cbb5092c6c7a3255d81a54a36277b486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\api[1].js

Filesize
870B

MD5
a93f07188bee2920004c4937da275d25

SHA1
901cfea09bc88d26a55cf2c57ccdaf45dfaea95a

SHA256
587d5394ddb17dec6f39de2e973431f161a1e08a45d499fe7c7a6333a93904cd

SHA512
16855a943a768355129e31623e5eb7064741d4d07ac2c0fcd21c5742a1b2e2a2c3af38e0f481bd7b8006dc96c408be07b91bbbe28ce7c4f7f0f7d53e427500c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\care[1].png

Filesize
683B

MD5
92fb833b653eabd92e27c6efc5aab3fe

SHA1
95d9db7a7478a820c99184686b1677ed428e50ad

SHA256
648a2af4c5486a91b68bfa1ee8b60a8136410fabaa602d6e593852fd9d1d3ebd

SHA512
955c38ba8dbdd20a6df9807993c342124c45e21cb6075eeaf339fb66aaf64a2239a92fd415bce3109efa9c5bcd4246983626a1f75a5dcd3d720fa6938130352d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\geo[1].png

Filesize
2KB

MD5
d690e7ca1d1e245a00421f46d6bb361a

SHA1
a0e1e032366440d721fb91a14839a4ed2bc77ff3

SHA256
5a5513105fb8a11a2522ab5f69bd6bd86321d77623d3169d8599641bab053543

SHA512
d42a491a15fac8eda60d131ed051546734788854f3152b5768ca7ea4b4b3c8c66c30e31752beac66816f1c291a54d7cd37c12d8019ebff25598228ac24cee592

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\js[1].js

Filesize
273KB

MD5
a90a41f6e25810289e1214e5069b183d

SHA1
ff8a7ea5e855b75e5168f30aed6e0e9b74260ecb

SHA256
d21ec14308a33276ab9622edc6a9a6eeb7ec724f1dd1e92b6789723d3586c294

SHA512
2a7daf724bda6b126c28435fff2bbe54dc3858840b6cf285ef4f6059b7b4c8f8adbd9017c7c376c09bdab5c0e94fda0775c15ec9ab545497a7c49decd9322847

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\logo_48[1].png

Filesize
2KB

MD5
ef9941290c50cd3866e2ba6b793f010d

SHA1
4736508c795667dcea21f8d864233031223b7832

SHA256
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

SHA512
a0c69c70117c5713caf8b12f3b6e8bbb9cdaf72768e5db9db5831a3c37541b87613c6b020dd2f9b8760064a8c7337f175e7234bfe776eee5e3588dc5662419d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\webworker[1].js

Filesize
102B

MD5
f66834120faccb628f46eb0fc62f644c

SHA1
15406e8ea9c7c2e6ef5c775be244fe166933bfcb

SHA256
8f063ae681a530a407ea4d17859790d9e45fd81ce5b3bb6202fc9e30cef95996

SHA512
7c596e61967fe787bc29d262c945d7eb4e02f9f574d3c8c664f333c9c3b4dd4aff1dfcde8f34be1acfaf8c05423c1c118a4bfd50684a7cd9f90e5f40fbc89653

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\zyw6mds[1].css

Filesize
1KB

MD5
a5bb75d5bd1b19def25c1dd4f3d4e09c

SHA1
d0c1457e8f357c964b9d4b6c0788e89717fe651f

SHA256
ff0689879c72300a01eae0c05c3205e2ca57c4bc1a6bfa0718fa6fea4a51627e

SHA512
b9fc57f7ade8f34cb02ece2935acb30757ed846e4bcf81d3fcf5bfcb45611d386bd337a6337e9945c5654cf044dce4dd3fafd60a2b42ed5bdc857ef96d077a69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\KFOlCnqEu92Fr1MmEU9fBBc9[1].ttf

Filesize
34KB

MD5
4d88404f733741eaacfda2e318840a98

SHA1
49e0f3d32666ac36205f84ac7457030ca0a9d95f

SHA256
b464107219af95400af44c949574d9617de760e100712d4dec8f51a76c50dda1

SHA512
2e5d3280d5f7e70ca3ea29e7c01f47feb57fe93fc55fd0ea63641e99e5d699bb4b1f1f686da25c91ba4f64833f9946070f7546558cbd68249b0d853949ff85c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\KFOmCnqEu92Fr1Mu4mxP[1].ttf

Filesize
34KB

MD5
372d0cc3288fe8e97df49742baefce90

SHA1
754d9eaa4a009c42e8d6d40c632a1dad6d44ec21

SHA256
466989fd178ca6ed13641893b7003e5d6ec36e42c2a816dee71f87b775ea097f

SHA512
8447bc59795b16877974cd77c52729f6ff08a1e741f68ff445c087ecc09c8c4822b83e8907d156a00be81cb2c0259081926e758c12b3aea023ac574e4a6c9885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\domain_profile[1].htm

Filesize
6KB

MD5
a89009e57943888272e0b85f8ae75f22

SHA1
97a5aeabdfc123b09d43cebd9d632797da8faadc

SHA256
a89c8f517cd2864919e6951066cd04030a62b4b23796f6eb361ce3bab078e4ca

SHA512
1485ce7bc3791378faf874f3ef484f560682698454256f4c653d18046db624457572db69651752e066c6d58c0aece75acdfe22ebb318ab32c4dd6b5f42223714

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\guarant-footer[1].png

Filesize
1KB

MD5
ebc6a32aaf8ea9681969745fb569ba91

SHA1
6620dac92b6a9274b943ab6fc0d1c8ae273b3f9a

SHA256
f871b5aac8bac1e406f07ceed1e33f7c0f4bdfdcf3cff87ed30b54986d21647d

SHA512
95352a45075dee231df82884b5a8f4fd1bc1cb08374ecc4d58bd77d8f2173bc5b0e5eee41cf5f94ec45a7608b0483c48d00c1dcd5ad7c463582409a5e7c32c07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\js[1].js

Filesize
207KB

MD5
9215bf7017931371574a130e3d9b29ba

SHA1
6187e27265f80d136b8cbb1caf4075902a73b618

SHA256
d465e0277f2c7bd3d7f68158d1e65cc1b3b5fab891ff041bf2836806b5fdc123

SHA512
6e6dd1f25c105d9135bbfc397fffd92ef56982204e5dac613b1913ca40e98b625ec06e31d31a6050c59450b9d589da6b7516a0fb35c15b92aeaf09396cadf673

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\logo[1].png

Filesize
3KB

MD5
f988bb4ef8b8ffa55ca04841c9056312

SHA1
52b0d79df1da68016157367c5de7b1c977bce0c1

SHA256
bfb7ccbb51dfdbb3b540b8da2ca6f7f34c35d028137e67a0017d7e3da5426703

SHA512
db3b6bfb59f09758878d6f55d3d6728186e00b13606b6340fe07b80f0eb2e45fe75f4cc51c12e9f73db468729d973f305bca9e1dd90a35f42a70a1552523ab99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\o-0mIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjcz6L1SoM-jCpoiyAaBO9a6VQ[1].woff

Filesize
16KB

MD5
adda182c554df680e53ea425e49cdf0d

SHA1
9bcac358bdab12b66d8f6c2b3a55d318abe8e3ae

SHA256
d653648b9d6467b7729f0cea0c02e4e9f47323c92a9fcdbcb12475c95ac024df

SHA512
7de2140ee3859b04c59a9473129c3acad91022962d46ffc63529bff278661f0e106a16dde90e8db523f826f82e7c20ad9b23f45a25e81932fd2d8708b616fba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\p[1].css

Filesize
5B

MD5
83d24d4b43cc7eef2b61e66c95f3d158

SHA1
f0cafc285ee23bb6c28c5166f305493c4331c84d

SHA256
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

SHA512
e6e84563d3a55767f8e5f36c4e217a0768120d6e15ce4d01aa63d36af7ec8d20b600ce96dcc56de91ec7e55e83a8267baddd68b61447069b82abdb2e92c6acb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\recaptcha__en[1].js

Filesize
533KB

MD5
93e3f7248853ea26232278a54613f93c

SHA1
16100c397972a415bfcfce1a470acad68c173375

SHA256
0ec782544506a0aea967ea044659c633e1ee735b79e5172cb263797cc5cefe3a

SHA512
26aca30de753823a247916a9418aa8bce24059d80ec35af6e1a08a6e931dcf3119e326ec7239a1f8f83439979f39460b1f74c1a6d448e2f0702e91f5ad081df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\responsive[1].css

Filesize
66KB

MD5
4998fe22f90eacce5aa2ec3b3b37bd81

SHA1
f871e53836d5049ef2dafa26c3e20acab38a9155

SHA256
93fcbfca018780a8af6e48a2c4cd6f7ad314730440236c787d581e2cef1ab8f8

SHA512
822158dac2694341f6cf5c8f14f017ac877c00143194d3cd0a67ffd4d97f9bf8f2305e33b99fa12f62eee53ba18029541c0601ea5496ff50279d1200cfa03232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\counter[1].js

Filesize
35KB

MD5
b5af8efecbad3bca820a36e59dde6817

SHA1
59995d077486017c84d475206eba1d5e909800b1

SHA256
a6b293451a19dfb0f68649e5ceabac93b2d4155e64fe7f3e3af21a19984e2368

SHA512
aac377f6094dc0411b8ef94a08174d12cbb25f6d6279e10ffb325d5215c40d7b61617186a03db7084d827e7310dc38e2bd8d67cf591e6fb0a46f8191d715de7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\domain_profile[2].htm

Filesize
6KB

MD5
0146ee5a88b7435cbd27f39c3b521e58

SHA1
0f009c76bdf6df508e5cf36b3f97dfdd5a9b2218

SHA256
23a6e315440d39583668852f2f09a631271425e52da7e32532ad1d79e9a70c49

SHA512
8271a7c3e2dc4035544c0429582365de75c46ca964db111d85a1c11c1e7d8942620435ec83e2782af5bd7dee26c60977feeb8985236fa1f7adfdf85fc95c5372

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\escrow[1].png

Filesize
2KB

MD5
78b034232f0b70262484b314a1e1647d

SHA1
8da15f0b8a2a9898dc9caecd8f6d592bc07c0a84

SHA256
d479e382c9e8278ef3b6f9b7a349d1a849056ec4a7b35f4b71d1b6e8e12e2580

SHA512
7ca7ffcf11153cb754ea3c5f5cb300497a7ab22c34922adc59a74dece2d75ff8a25335299e7d045aa2b4bee87541d6a7b99de144095d4c952a88488ad9ae3638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\main[1].js

Filesize
7KB

MD5
aeb2452d98a9c13bfebfb5f07fd7945a

SHA1
80060b26cb653bd8b7a4e3e4a12b059d105ce6cf

SHA256
6b847d4dd75d8072899ce6b9e0e2fdb5192072c9cad0681cc91deed684ac5508

SHA512
7a247e854610698f60438e0393be4966ce149a764dcc313c77fa301ab9de7172e23cdd46b3272f2b8ba6aca0248c976e1b36b6881677d1225eae1ee398acf0ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\reboot.min[1].css

Filesize
3KB

MD5
51b8b71098eeed2c55a4534e48579a16

SHA1
2ec1922d2bfaf67bf3ffabe43a11e3bf481dc5d7

SHA256
bd78e3bcc569d029e7c709144e4038dede4d92a143e77bc46e4f15913769758b

SHA512
2597223e603e095bf405998aacd8585f85e66de8d992a9078951dd85f462217305e215b4828188bf7840368d8116ed8fb5d95f3bfab00240b4a8ddab71ac760d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\script[1].js

Filesize
9KB

MD5
defee0a43f53c0bd24b5420db2325418

SHA1
55e3fdbced6fb04f1a2a664209f6117110b206f3

SHA256
c1f8e55b298dc653477b557d4d9ef04951b3b8ba8362a836c54e2db10cda4d09

SHA512
33d1a6753a32ec06dcfc07637e9654af9321fe9fa2590efc70893eb58c8603505f2be69084fb2bcbf929218c4e7df9f7a8bc3f17a5b41ed38c4d8645296ebab5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\style[1].css

Filesize
165KB

MD5
65760e3b3b198746b7e73e4de28efea1

SHA1
1d1a2cce09b28cffc89378b0a60cbb1aa8a08c4f

SHA256
10e40ea3a2ad69c08d13e194cf13eb4a28a093c939758a17a6a775ef603ac4fc

SHA512
fbcb91f26b7bd874d6a6a3b1d4d6f7277ded091cdae5706c285b4d5d17446a1bf58572c224af38393ce49b310a51d5c5d60711c7094e5d32abbaaf10d1107e1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\styles__ltr[1].css

Filesize
55KB

MD5
4adccf70587477c74e2fcd636e4ec895

SHA1
af63034901c98e2d93faa7737f9c8f52e302d88b

SHA256
0e04cd9eec042868e190cbdabf2f8f0c7172dcc54ab87eb616eca14258307b4d

SHA512
d3f071c0a0aa7f2d3b8e584c67d4a1adf1a9a99595cffc204bf43b99f5b19c4b98cec8b31e65a46c01509fc7af8787bd7839299a683d028e388fdc4ded678cb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\t[2].json

Filesize
192B

MD5
23c7c9601fcef4d3b7a0156f978f548b

SHA1
59a47fe9edd6026b0b468628eb3f96b05a010f1c

SHA256
eb2697b60c526a1d4980e0874700e7c2b4f43bb9292770f71bb4bb972506e415

SHA512
3d250e9a223259a23f0ebf4fbb20db3fde955fdf80a64b9c7278290c60ec2560ebf665764d4e35515f9e69e1cba2f4e21fa7504505cf3ac8d3a380201a284f6d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms

Filesize
3KB

MD5
81b0dfea7491757d1ba289b909f4a822

SHA1
12cb99b4e2edfad5d47ee71315c02c728a278af5

SHA256
21e73446e9f979ef066946d04178c3861d418735c24de5dd5b317f18dab30882

SHA512
85f95b8a0555af2db681c1e2f924d6ea1ec39683f9b8e546e4fd24d663cdb1eca61079ec13ea0238915e6a8a424a5f27482c236f018363131e5a62d44ecf1c50

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms

Filesize
3KB

MD5
1ed3f8bc732726d05256bdebfb95b07f

SHA1
3964741000e2982267e3adffe432ba85864b5167

SHA256
edbb6d0796b1a1dfc149fe4ff0cc37e5a6a4d5cd176c9119dc362afcd1af6223

SHA512
cc96649fa306b94d2909ff78365c4c4cb75c338025c420b9795bf71009eaee2c3a5d95a875b12297c5aa1596795d33f8725a436ace1848f8e6778f3ce51d60c9

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
96KB

MD5
5eca01abdb65e6b1bc82bd6fecf9fa5d

SHA1
50b1e6a496c0804ec575e0fbb9fa6a0330a4c364

SHA256
1d4b24ddbd00a7cb94862b2705b818819bdc660623eaf922b7dbdda57ae14b0c

SHA512
0a58d921a9fd638d9c3fe340479cb81fc2c9da7bd28768e5878465c3281ea809b898391b056b8cb160ed940de51be3fbc8040b7d0aca64b031511c1e8d714efa

Download Submit
memory/2188-106-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2188-23-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2188-20-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2356-821-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2356-188-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2356-32-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2356-31-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2356-28-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2356-35-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2356-2876-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2356-2210-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2356-904-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2356-800-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4592-14-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4592-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4592-2-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4592-3-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download