70d723f8dca9d3e4a714b097aa9c64f287b8c09c8f2cbd77bcc5603dd11bcb1d

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a08c83a6940714ab74e81fd55fca535d_JaffaCakes118.exe
Size

428KB
MD5

a08c83a6940714ab74e81fd55fca535d
SHA1

d41e282db3497c92c7df45b88c9d89fe6af339ff
SHA256

70d723f8dca9d3e4a714b097aa9c64f287b8c09c8f2cbd77bcc5603dd11bcb1d
SHA512

e469f3f84e9f6656e78455f869371c7a70facf25f609a7aebea267f00bd2ef569f5a16438b333af2c5a8241121667de3135b4d3ce287b5d15aad65532fd87c5c
SSDEEP

3072:NJ7Mct7+2fZEuAgXQ/tRw/GYczLuTdUout:XdUoS

Score

10^/10

defense_evasion discovery evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 18 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-75895004"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-95779769"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-54181014"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-63749861"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwinnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fih32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgemc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portdetective.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wfindv32.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RDRCEF.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avptc32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwin95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwinst4.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panixk.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxmonitor9x.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldpro.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntxconfig.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccpfw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcdsetup.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ants.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleaner.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscanavshadow.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\licmgr.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UCCLSID.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avrescue.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsm32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibmasn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldscan.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wradmin.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoupdate.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpmon.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsupp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navstub.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setupvameeval.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pspf.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrecon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsched32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mghtml.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspatch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ogrc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfgwiz.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iface.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\neowatchlog.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sofi.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tftpd.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ent.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcfwallicon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbust.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Filemon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsuppnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tca.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsscan40.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentw.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spf.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tgbob.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Restart.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dv95.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icmoon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	a08c83a6940714ab74e81fd55fca535d_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
2640	winlogon.exe
692	winlogon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/724-0-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/files/0x00070000000234a8-7.dat	upx
behavioral2/memory/724-12-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/692-20-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/692-23-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/692-25-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/2640-37-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/692-39-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/692-157-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/2640-293-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/692-431-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/692-526-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/692-621-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/692-1608-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/692-1705-0x0000000000400000-0x000000000043F000-memory.dmp	upx

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\459485254544B4D4 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\459485254544B4D4 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Indicator Removal: Clear Persistence 1 TTPs 46 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ORGCHART.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SYSTEMSETTINGS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IEINSTAL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOASB.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOHTMED.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\NGEN.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RDRSERVICESUPDATER.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\EXCEL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\EXTEXPORT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOSREC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\POWERPNT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PRINTISOLATIONHOST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SVCHOST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACRORD32INFO.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IEUNATT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IEXPLORE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSHTA.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOSYNC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\NGENTASK.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RDRCEF.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IELOWUTIL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SPLWOW64.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WORDCONV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PRINTDIALOG.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNTIMEBROKER.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SELFCERT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IE4UINIT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ONENOTEM.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GRAPH.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MRT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOXMLED.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ONENOTE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SPOOLSV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WINWORD.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CLVIEW.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\EXCELCNV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSCORSVW.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSFEEDSSYNC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOADFSB.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSQRY32.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PRESENTATIONHOST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SDXHELPER.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACRORD32.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MICROSOFTEDGEUPDATE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SETLANG.EXE	winlogon.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2640 set thread context of 692	2640	winlogon.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a08c83a6940714ab74e81fd55fca535d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\hugedomains.com\Total = "32"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "5507"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "4254"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003f945ed72d44d3489ac9a36be9e2e8b1000000000200000000001066000000010000200000008fdda2a2f014725912a0367d67cf33ece10908621aa3312c0d3eb7291a78694c000000000e8000000002000020000000c1375589d8a2f9db18d1526c9f2ce3fd95e01bdecacf8294d394fa606b4b2fec200000005b08f29e4a4e97dff7bd3499b8f86321f11cecd901abe9f8e3e49a899b09d4e3400000003c77c95cd5c94ede0a706241ddfa96b08f3233c4817cb75ad91de87a01ae6917b5a8bae16cb2815609a1c2f1e84164a2af4a03e239b10b6af8aea295f4f72768	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "15692"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "5656"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "5756"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.hugedomains.com\ = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "12377"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2969"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "4197"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "4375"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "4229"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\DOMStorage\tiny.cc	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1688"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "2943"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003f945ed72d44d3489ac9a36be9e2e8b10000000002000000000010660000000100002000000045480026cd0878d3b926036e6ffbe0141c0b203977d820757d46f88129efd99e000000000e8000000002000020000000906031b560b683abfbd2bbf573ee8d3a10a047f3416c3cb6fc18eec5a34b9c2720000000824a08ba19119cef0fccf09f6479206da755f167882379180dfc2029a1474aa540000000080fd7b6c1688ab98fe9c8785111272a4b5a513331d97f7b9d96c036109a93ca6805bdb37c7832a95cb969d684297b1f02027ad4168e865ba35ba4511ad7f3ab	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "3026"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "225"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "15635"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "282"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1499"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "197"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "5814"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003f945ed72d44d3489ac9a36be9e2e8b1000000000200000000001066000000010000200000004a9d9c5cadc70d311f15abf60c43e084672e60dc5bb1b233506b0aa9b2f3e44b000000000e80000000020000200000002990896f272b3f9b4b5af1074cb0af35e927abe57c10d95ec80808af1cc075b320000000e0fa743b1a0bd895434dcab42f7bc1e0d05a4770d22b3b09ec470001182c433040000000c754886234bd0115655cacaafa48547edfb1d3b7e232bf014ffbef2f878243d99b0ab37b6c63706704448b04ed84857440548e606ae5292e3c5f50f6c04e435c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c09979ea3df0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1543"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2968"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1474"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "4318"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "4197"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0bb44c83df0da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\tiny.cc\Total = "82"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30216edb3df0da01	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://1vv1po52r3y41j4.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "13653"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.hugedomains.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "2886"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "2969"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "12320"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://85wpdqs4rgke22n.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://g5y6670xw26edd9.directorio-w.com"	winlogon.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{691E6DEB-C3CC-4B6D-9CB1-B6F368AFD477}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{C04CCF67-4185-4F0F-A5BD-D008F7018FF2}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{8EEE1DA2-EC08-4507-A38E-8933D50670EC}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{B10B8715-485A-4C2D-818A-767D0074B508}	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe
692	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	692	winlogon.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
724	a08c83a6940714ab74e81fd55fca535d_JaffaCakes118.exe
2640	winlogon.exe
692	winlogon.exe
2984	iexplore.exe
2984	iexplore.exe
3640	IEXPLORE.EXE
3640	IEXPLORE.EXE
2984	iexplore.exe
2984	iexplore.exe
4100	IEXPLORE.EXE
4100	IEXPLORE.EXE
2984	iexplore.exe
2984	iexplore.exe
3736	IEXPLORE.EXE
3736	IEXPLORE.EXE
2984	iexplore.exe
2984	iexplore.exe
4548	IEXPLORE.EXE
4548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 2640	724	a08c83a6940714ab74e81fd55fca535d_JaffaCakes118.exe	87
PID 724 wrote to memory of 2640	724	a08c83a6940714ab74e81fd55fca535d_JaffaCakes118.exe	87
PID 724 wrote to memory of 2640	724	a08c83a6940714ab74e81fd55fca535d_JaffaCakes118.exe	87
PID 2640 wrote to memory of 692	2640	winlogon.exe	91
PID 2640 wrote to memory of 692	2640	winlogon.exe	91
PID 2640 wrote to memory of 692	2640	winlogon.exe	91
PID 2640 wrote to memory of 692	2640	winlogon.exe	91
PID 2640 wrote to memory of 692	2640	winlogon.exe	91
PID 2640 wrote to memory of 692	2640	winlogon.exe	91
PID 2640 wrote to memory of 692	2640	winlogon.exe	91
PID 2640 wrote to memory of 692	2640	winlogon.exe	91
PID 2984 wrote to memory of 3640	2984	iexplore.exe	98
PID 2984 wrote to memory of 3640	2984	iexplore.exe	98
PID 2984 wrote to memory of 3640	2984	iexplore.exe	98
PID 2984 wrote to memory of 4100	2984	iexplore.exe	114
PID 2984 wrote to memory of 4100	2984	iexplore.exe	114
PID 2984 wrote to memory of 4100	2984	iexplore.exe	114
PID 2984 wrote to memory of 3736	2984	iexplore.exe	115
PID 2984 wrote to memory of 3736	2984	iexplore.exe	115
PID 2984 wrote to memory of 3736	2984	iexplore.exe	115
PID 2984 wrote to memory of 4548	2984	iexplore.exe	119
PID 2984 wrote to memory of 4548	2984	iexplore.exe	119
PID 2984 wrote to memory of 4548	2984	iexplore.exe	119

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\a08c83a6940714ab74e81fd55fca535d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a08c83a6940714ab74e81fd55fca535d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:724
- C:\Users\Admin\E696D64614\winlogon.exe
  "C:\Users\Admin\E696D64614\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Modifies firewall policy service
    - Modifies security service
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Windows security modification
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:692

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2496

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:17434 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:17440 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:17444 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
df35560f7b5c7504f4eaa52b9cf59407

SHA1
15792efa0c3312d98b66453706775c0dfaef0ba8

SHA256
2b6ccf51f4b54c6222166d3004bf6959c21b1cc2bbb36b71a4aa0d4a1cec1f5a

SHA512
3863d1bfee58951cfd5d7effa966776027fd1a73c010d0a6537d61143e83113abe97bfc2ea8ff93aa0ea3952df33baaa55f6a988f909d16a63e2baf35b46e807

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_BE32D9F1882B93E37445F58E05C44495

Filesize
472B

MD5
57748c830496d9d9e895a00c79663a28

SHA1
f3f24f86207313fcb8008c82bb3a553f85526da1

SHA256
82f2f03a686a7fec97033172589796ebea140ad872075fef832cd12b4bb5b1e4

SHA512
64620d2301a19b784e4527e7beb56f8761f6f85846095b135dcf7577f91f58a0240d84ffa8c80ac7f2fc9a18fe213a0b5fd38cc71d13c7ee1ab0d2b4ed31d1d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_F012769CD1C3C6C60F530443394C9F21

Filesize
471B

MD5
05da222dfe000de172fea91dc378b5c9

SHA1
2b54a5d9c36929343bd3a0208772bdcfd664cfe6

SHA256
b7bc715bb0c19f6a851afcd92cf6cc9068da1e6578eb31ed1ee935b888df9882

SHA512
a7d9b929fdfae90759bf89b23eeb83cfdf2f48d5cfa0fc7c664737f9964d1d13ea6dd3b17174e94fbf7d36da39110e35af947687846d0d0a7f992fc799648c9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
7fb5fa1534dcf77f2125b2403b30a0ee

SHA1
365d96812a69ac0a4611ea4b70a3f306576cc3ea

SHA256
33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

SHA512
a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_5CF45833F44BFC2995315451A3896ACA

Filesize
472B

MD5
a2e2e90d42cc9a12f496531106d98fa1

SHA1
a13f8a0076b60a21d01e07cb1fbe02d6cede9b50

SHA256
1c324e337dd70609a5f865ce51813c1e0bf6cd4895fd89ea80da1c0423c8d365

SHA512
2d809907bc89be4ea6e110048a8fbe09b0a3209134c4647bd182e2fe632cf7a50e37abfa37620d1aeba8ba6a621882a70f34eceb1037368b15db99bee56522b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_0FE7F9E544828605E8602D3A6629EA0D

Filesize
471B

MD5
d349a1866d7709b39e8674bcb948996c

SHA1
511ad4723e09f326dc40fc824d2d84235fed2888

SHA256
55c2231a99ca4078875210e753fc02baa935dc182f63ead3e7e1a9279e8aab4b

SHA512
67c4fccdfcb199adbe22ca5467cde98a120e7a0bb4eaeee518b3a4c1a84525fa0d3a7eae4388ffa23cccc53b7974962191fa9d56baca1222d16155b0859cec41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_68D058512F3515153DEB95A1F4E72552

Filesize
471B

MD5
f99306257352ce35ae4872dd82d54f54

SHA1
b7a9ca9a1c3cc1f0c3e877f6b32fd85b446acafe

SHA256
f7227f4ef267791faa83535dc69d8200dc0284df52bcaa0499170b504dc9ef9b

SHA512
9bd9b4121bd8c18a9cd97be240fcfd3ac786d890e92ee5cd214542f51187d584a6c12d75f37704c9a289b78b98f16076cc9d8c7af8e19d77518476cfd17e316d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_BD094DBD6C208A0E1DA0426D465799ED

Filesize
471B

MD5
edb82a33ae18503bb0f508d9a15b984d

SHA1
ef16165880bf84f08f63b25caa2a9b75e11fbf2e

SHA256
d6b1e8416b25d262158b52c4bde3ba2ee3941e687daff3383a18a70986704d68

SHA512
2dfd026594cbbbabf5cfff6c0fb21b1490575e2413dbfd3fe5760755ac9e35009b5e49dc9497fbcaad75f85939db58bf4942068c5fa1bc08284398d50b7a1c8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
471B

MD5
8be3c56854f6439df964d9b572616f40

SHA1
979cc947d08d634efe62c2b44504696b6b8a0944

SHA256
a7094ea19610539b6339150d50213b7fcd354afca981477493f5b383a8a29408

SHA512
71b6b928c9878e3356e92be6fef6fba41f658066217df7a02788322acd5fc09810893755c43c688a1892cd3fafead72987d4a458f4a7c7903a215f3a5bce4af2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
622e433b00d35288dff8d0e504f8cc2d

SHA1
e90b65a3a779f68941580714a922ece00666df51

SHA256
decdb81ec36cbc5cd9929daf6d5443ea7fe0ac81874ceffab6473eaaf634b063

SHA512
5ca9f73f1ef9295fd487e8ce45d76205400fc2c0cb6f26de8919274e06d005ce6a47610ce9c52749177929f669ad0331a066b5dc78f96ca1df49d34dc95b00b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
e865bf3f76a83f73d145fb02f66d1479

SHA1
c55fc52d36415f4ac3114835b20ab4ca8cd7e740

SHA256
55a115045795c91743645ea343ea7b73aacb8d3a6b34ec112a3bd5155b8ff2d6

SHA512
6b6d7815a5c0dd0b1172fb010619cbc9e9c56b3ed983b53412c4a23b682af8b4525c20ddc78924d234542032653ca397d4857724ff0edf0576e6d3e895d679df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_BE32D9F1882B93E37445F58E05C44495

Filesize
398B

MD5
cb5d5dc789034dcb467d27504fc8a79b

SHA1
1560542be24a05992f0ad6e499be2b9a91af1102

SHA256
e1de0ef1ca2e2bc6d2b6a56c914867091cc762ae52e200732d7435e1f964d19b

SHA512
7d4c5fd886ea364562942096e30bae85fe1f44477ac6251afab50f2aa44c9d3d1ba501853bb4464eec9e61f1abb93e4692b6c895f0e3e57848b82fc6657a2094

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_F012769CD1C3C6C60F530443394C9F21

Filesize
402B

MD5
aab6e4846d159360dbbb2c1fccad1308

SHA1
127772c660dacd5c7c926cec8349d674e48110f0

SHA256
743521a4643cd356fa2574a9fa38e6893efff34c9a8411d474f58f749132768e

SHA512
723a231c0f46b087727868b85362fb24f1b906ff0b346736b5d30fc1e7beb5db4e3ac3347fa19e7eb99fcb1ad80bad63e855df2fb861dd7891c6929f88477d71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
52810eba8141f835634fc93710bd9191

SHA1
c7249d7a0d5ca5cb3a54861bc439abedbffc411b

SHA256
babc0555f7d416f7ea7ebbf99eba0d98919981e5e8c758b633ae95d4260d3948

SHA512
e13a78618c987428ed552deec81f572a1e03543abafd6a8d7377dd8e8d854cb4a49a070d3d83f37bdee2dee0fcc87819685237b17a0b7a5f3e510d5bef64edf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_5CF45833F44BFC2995315451A3896ACA

Filesize
398B

MD5
230177fe5b41d3132a74e8e52a795ab9

SHA1
02793c2c83795c7dec20af7076173c5c5ef009ff

SHA256
4cb28e40e8e9d9f69cbd26c97ab3d9fa293f1220f77988a977df529358053f01

SHA512
2c65efe75fa454cdf89a67a05ecae0fa4c3942b26954106f02e193f189ddc4432e2be91837f2603ca4499014c8c1b616072cdcc4ba6041b99378801de44dace4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
10954f4e5294b2fbe1f973e54d8376d5

SHA1
548ea2b734b215642b7055d828fb17ef82184d13

SHA256
27ec9023bbfa4c1fca6ee1d9147e0120e6a42905c805ce8e16f2ea8f4d254e1c

SHA512
6128173d3062f8ec37aa8a4e5000fc2aa62627878d18dc6467400050e0f9a67c0d3bca707e6790d113a254c5d931c4d1f9d9ae1136b39867f6a63a82b90b3435

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_0FE7F9E544828605E8602D3A6629EA0D

Filesize
402B

MD5
5728813cc37f99d5695ff94c625ed923

SHA1
bf588765657cfb9b8a225f7900041007101dd578

SHA256
822b96a71cc5155de2c25c16f60f89cd342915d110c0cf7367aaa68331a88bf6

SHA512
ed866c0d27e460746a6548b4d8686bc0aaa7988fd2126c2fb7abf369c3310648b9189250787cb670cdbc4d2ff32210842158ce94479ca2ffe872c6272887a1b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_68D058512F3515153DEB95A1F4E72552

Filesize
406B

MD5
f28b4f54e8a2438b5ab63d0c26afa4a8

SHA1
771780e78970a76bc26e96edf098dd8fea204c08

SHA256
01e3cf180a9558cfbd2fff2b5b01c45130345d891496e3f8f0e72ddc30df99a5

SHA512
92cc0baa6a52f15e5dcb9c4042f4283141cca7543eec8a058cb53a7a115db8a1f0f094e179eb8a70e6bbe81c92736cc7bc181fd03d97ec9331b65b4b2a692e1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_BD094DBD6C208A0E1DA0426D465799ED

Filesize
406B

MD5
f2d74b618f182a8a85a045b52e19b539

SHA1
c12860da8a470383a5f760e1ba4b234009255353

SHA256
7a80b1449aec3c8f7f38a208747d72b2faaa2971238872074f30d35ff9922e30

SHA512
c15c2cadf831bd4cff739391ed7ddb6f507cff44d081639b9a192b3d11370c660aad8da2b17d04b279110eb40af205c3784f1d5cdf2330dc2e56cba94553c0e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
412B

MD5
3cc43dbf3cf3888a06113719c8feb625

SHA1
99b7a72b7264b96412e6ab231c1f96c8d9fcf0ef

SHA256
0f3f79a6f31679b22b2c674068a862431480f164b0a3dc87df160703e649763d

SHA512
0ffd39a6457045ac12a5f8e56cd940b27b93ad92665e672a43e3d78acb5c0ef06f073445fa9456d56f139a41d386f77238b491568eefb13522910063c78de4d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\1MAZD3IK\www.google[1].xml

Filesize
99B

MD5
83b0decc39a35fe9496e298b5df5b2ec

SHA1
61b624350c6761c2c8da9413bfd4a0e3f8069614

SHA256
162e01631ccbef8623641ac6a2f207dc3a7cdfaac387d79ae7e79277805ae89a

SHA512
6682fe7605ed188d75b1c2841a1a1ff070ec8a60884c531eb76c7ab427f0a55d84695268bfbfa3b2ad31ffa718f2e34e0be2884731560c5be8a13cd16aadfc01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\BYO4K9YU\www.hugedomains[1].xml

Filesize
116B

MD5
eca44a9e9444ee30d8e35ac3eec3cf96

SHA1
2bb709954df23d69235c790912196f5efd81a260

SHA256
d4677c602edf5dca58c848b0ec082b851e6c7b68fcad1535352fa82c49458586

SHA512
951459cb747d9b02de86071d1d4ae89de41f4165c101902d72444b0887e8de34c62d302751511f5a4e1e73914b7c0742d288af82199d2e304ed4597160c9c7ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\BYO4K9YU\www.hugedomains[1].xml

Filesize
145B

MD5
27ac1d04c50a9a9e1832c13cb39c113b

SHA1
88baa0a19c0a5b2f836198893c4655217001bfa8

SHA256
b3027c5cb6d1255e89a1c2c68bdc64efff02226ab0c36c8c5373fb96cb945f28

SHA512
154d8e1e5c1d43fda9807888a97553f1b3f5250b00724112ef0d1bfb9debeb8dff7c96346fd6d0493ef9d03efe9d8d5f4e89035312ac176c09956379244a8b12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
4KB

MD5
4f5c1f119f60c1d2758d80e982f7553f

SHA1
649da59501193dad1d2669640b3b8eb3e137b7f9

SHA256
f1476befd97c4393d2b79a6d6e6f7d6f09d1d26ebdb1d20108d3b32b52f2e8e9

SHA512
d51acac87be3751ed93d721a710101bd04266ca2b9e170cadaa0b3bb7fc8b9ddea7245aeb1268c0fdd440b6b1fe592b7ef7d84cfc8e605a83c8fc491171ca311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
18KB

MD5
d91e1eb1c96cc2db26392b6c118e5f13

SHA1
f6aff6bbf28401f00a7c8c05848d2ff30eb3980d

SHA256
02620b4d36a25ce55ea274752a7abc2a253b45185e7b664fbbb7295874a59e8a

SHA512
df642433cc6ef6f73d89be20a4e6e018a32cafe774dcb0b4b9c353567fb9227b05648ad8c18233b9f8a9ce8e04fbcfeb957664a1bd30a8ef044cdc31394db3ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
438B

MD5
69e04f0b7d83f9c9b069c312a1aa30be

SHA1
0c885460665ea19ed349cf6f989ff9de49575f11

SHA256
d781721da1a3bb6a4f79248d7c3f969c9890cea84100372f0e8265ea0eb3e6d2

SHA512
771bc82602541db3593c0b3cf8558e90abbb723851f6c619c0746204011a58101b18d8d2d0040f71f89ab27580e7113410dd9cd6826d7ff0c455ef6f4c087a82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
20KB

MD5
0c2619674b0b9222f2800fc1099cc920

SHA1
4cedf39d01db75d3a720c2a49d93b70953494847

SHA256
a607e2ec93a9f8d2b7202f1d95b68d1e35eea06265679d1a5992d4247f45ffd2

SHA512
9ab630c5f5d6fd1fe05db2666d693c62ea3a67f4a584fb268ce0f3aef8c987d400f3f42f24d568c0ae2c8ceb22b24abf1a29ccc72cbae6f86d4494806cddb90e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
4KB

MD5
fb5fa0ba75b79b679ab9883d96acc593

SHA1
278e662a8b59102db3f431f2c752c85c824e1921

SHA256
ba7784f2f7af0b40188cfd5da6bc9e42ff39d13edb9a33d822c816c1487b2c99

SHA512
f12f4643366012e2027ba431fbacd84f4f56aaf7e2b23b772c56a2df32ba0679da3f421906193ed39a735eafea1c95e2dafeab98d150185aa5624303ea91fd6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
5KB

MD5
92f5a3470e6fe952a778018a7e7a1fc4

SHA1
a019cfe1b46ddae32b50741a81d40c082002c195

SHA256
44582cd1107b9b369f5d2d1e4a4697f7c6c1b46c1d3aedf223fb1331b4271ec2

SHA512
139cbda6582dfe88b000d71be1213822bbe76555641e8efa09886cb81541c17516352214c79e5b9d92a43fd75572d5b49f86ac9c677d96c448c3e86647ff5160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
5KB

MD5
694887ded5cea753299da571b0b6881b

SHA1
f40015282e9e75fef96c900ca311bdc4d5d8848c

SHA256
b49ce17c83ad8ef41cb0864e73da0cabdff27864de70385c536f015d12aeb929

SHA512
0694755b6e9964776fef7f1ef885f9734caa289e618562a084ca1bd4fe34b646df2d5be86314cad1ef448e57f323a5615702058cb7b33f350572aec930fa9569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
22KB

MD5
261e24f1b21963c5655f5756489f23e4

SHA1
3fb09180333835a6b09d98440e0cdb88ee21e63e

SHA256
e5597578079563a215b0e6f28672f161a15e94536de88cded55679498d3323a8

SHA512
d5a9fe7996bb9ce4fa72b70ae8aad08d88ec1b19ddf2a4c0dfe78692f1c08131b02081a54e9422aec74acec35dbb9c5e5bdc53c72766a460eae6074cbd8db66f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
7KB

MD5
b2a13baf317e27011806fd8092f0f26f

SHA1
fcfc0f4abec6ae581f03a5d793426dd8db7f3f49

SHA256
25ed6343adf3f82dbccbc0ba25a53e7404511a7bb99ee78f14afe54e915098d6

SHA512
b56328a3ae89a294bf40972a9f5d70e2223bf5b9dd6777e5b1b0d8353c396a2774c58e97333edae776378463dea1c026b1fc4ca062665e8ef0315d4c8248304b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
7KB

MD5
c8416a28edc26e29bb1a452a7705a56e

SHA1
f19c5953acb1291d4cf9dfcde61a48693e4a11e7

SHA256
f0ba00a86709778462ad93ea4e036f50ed90adef4035bd1af4e4dfc8767b9c26

SHA512
601ea156e36329ccb6c5cf5e1ad60836ad7e998c9d89a8866e75bb32954e2c88bcd3c2b9d09b3947f2e21c723df5542e48faeae59ef9e26b2001c2c72d4e6b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
578B

MD5
dd37311474338dd3fcb61503d46e20dc

SHA1
3c0880b9981f39f9096086cc7e082f2030f5a83d

SHA256
32b6877ed9f306405f78e518f77e207b9818cddfa1b0a62daa7aeb8235484b39

SHA512
d053f97ea3fc40e3375418d3c52616dbf5e31729cde3853787df050165b118ec1d132d94d7e3bf3e0d4abff11234b36c3e6d227a5e3f56c8b1f860862d199ad4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
578B

MD5
af9b6dae9d249fa2fb243eca5c1eeacb

SHA1
68a44dee1f9a6bb6e267556081d1ac60aa81d65f

SHA256
991b31b6bf0bf2b5e96af69c1061f9ce2e9872e7ef652b5d77be1ce71b03059c

SHA512
cd81e07e206ed742390501cc20c6d859ca22a2e90616940793011af219f19cb01c5a5864980ddc381ee0d73e0643697d0aa6a5c529fece24542243f403d121fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
2KB

MD5
4c45709b49bb9305ad46a543cbcf70b3

SHA1
a8ab91626c493579881e09aa13b69c2a9fe72ccf

SHA256
fcc2567159e26f5eac3dad08239b183027d9d9997020a49ab421bf905fbe41c1

SHA512
d7a689d286c59d79fbff00ed0c818f44277b9695e1440b3198d70da6c72c3c9aca153a5ec25829d4558d403859fc964466196f458e1aa009cdc48ca5ebdc8fa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
578B

MD5
faabc6e0a5c2926201c2d37849216536

SHA1
0225714055a9b74355d3534bb962e5011972b5b2

SHA256
462b06006347ed8ffa1bcad05dfbd315a3b8dddf8e76632f6b528afa56b81932

SHA512
cf49dc1c1b7eff0c2cd263aca1eb3f81e33fbe6d8d23fdf51a5a5e881dc755623e68cef802174149c0a570c514037d70f2452f8cd8a1e8a12ee892ef5870e90b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
2KB

MD5
bf549cf2c7bddea95c76a3c3407e74d8

SHA1
1c07b2a8821bea2e2cc0f59e9061d81a31c89d5a

SHA256
792e4f5b4b358c2f5c7e7acee4a677ec752c91dff2a664343106379d5059e61a

SHA512
ff42a21526a3df9ffe9b248a104d3ab35e5a74dc15c9321bcfdace4cdcef4ae3d0e9d25d4289401c598a0d10149f399c29f2022845987a7d94c46b93e37e96b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
16KB

MD5
829339e5a550dbcf7eafcb130a966ab7

SHA1
4f6da70053e9f8b701ffd632c504191dc4891ecc

SHA256
5f20e5fce6a57cb014061898d7f7d5df597d432f46ef2573dbfb8452b0f43bb7

SHA512
810379538f27e0195d537179aa686fb18b93953ec44a2046ae09c072f04ee9feec20e340beb34075bbe73184f98c94e7c2ec4f63ccdb0ec34f55979b246f49bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
2KB

MD5
03e23ac70eaf67e889bdfe5d312158ba

SHA1
8fca2df6c2882f0897abe9f18c34368ea9a44c56

SHA256
aec1ec39c38e104bc94e2a1771dbb8fc3aba5cae1933212759e8e21edc686f56

SHA512
8c7dee65392d8d5d38de972e527aa5d3474fc5252fc03eb3c9ee4e1fbf5c275a9dc51b219b420f36b8708b81e241c10e50abc0fa6a1b9f95b83c5c56d1593c49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
3KB

MD5
cec8f885466d4f2f6906cbaa2f3f8021

SHA1
f05a1b8e079179c591baeb1687c12abde209d6ac

SHA256
7cb4882e4334fc5aa55483ebeea9c5e088005433cc8608cbaa967b7fef996521

SHA512
bd9b51f13f436e3d36cc2b44ee0b3a5a588bcf0a1881109a0ba15f2f6efcef803243f1c2f081334ad10cc1e072d3489dd963d5cb9db6b3f64a318db9919d5466

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
2KB

MD5
5c52afd6a3cd10d6422a6e219e93fafc

SHA1
3c11da8d06f170bd7e06089a4312bdd02f69f26a

SHA256
7a2518f7af1e1ce55e71ca38ef64f78d7fb6300b5c14607b3c65410a69afa01a

SHA512
3f2b0eef23798f786e1c7f92b84679fa12e9261ada1237f97bffbade901244af27b028536a510b02a86e3cdf70a20f3a88c4a73901b53448e8dc6d0b6193484a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SD3FWSEG\www.youtube[1].xml

Filesize
4KB

MD5
4578fe7fcf250a6e3f5af051d982993d

SHA1
6cb0ebf8e1ae47aedc95bfd5d21ce3eded1cb4dd

SHA256
6a65a5ad213c45d2a899e781c2c40a2f43cb3988376b0890898e154b0781dda0

SHA512
cf35a0d40edc2bf95339653e6587de79fc9cc5e745a078cf908e7a42777585f401ac7ee7592f4cb4cef3555f1442c269615a9f92be17be6e4264f93b8bdba689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\X4HD7MR1\tiny[1].xml

Filesize
276B

MD5
8ac5e791c51575c71435298200187156

SHA1
793bac14a99ff2b6d85202c854911417ea8be42a

SHA256
06a122c10547d2f293c9dd258f2bf88fe0fd7278a45660e3f64f77d779deec29

SHA512
3a6a0dec9f002fe8660770d79d393b37ebd64a1e8ff0403d3b8a6f43ba9c781af3ca83d398e74037a7c06459090fc4b0028b17b9a4f8824cd3e25ebe39f2d42a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xml

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7TBBQW6D\KFOlCnqEu92Fr1MmYUtfBBc9[1].ttf

Filesize
34KB

MD5
4d99b85fa964307056c1410f78f51439

SHA1
f8e30a1a61011f1ee42435d7e18ba7e21d4ee894

SHA256
01027695832f4a3850663c9e798eb03eadfd1462d0b76e7c5ac6465d2d77dbd0

SHA512
13d93544b16453fe9ac9fc025c3d4320c1c83a2eca4cd01132ce5c68b12e150bc7d96341f10cbaa2777526cf72b2ca0cd64458b3df1875a184bbb907c5e3d731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7TBBQW6D\ad_status[1].js

Filesize
29B

MD5
1fa71744db23d0f8df9cce6719defcb7

SHA1
e4be9b7136697942a036f97cf26ebaf703ad2067

SHA256
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

SHA512
17fa262901b608368eb4b70910da67e1f11b9cfb2c9dc81844f55bee1db3ec11f704d81ab20f2dda973378f9c0df56eaad8111f34b92e4161a4d194ba902f82f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7TBBQW6D\api[1].js

Filesize
870B

MD5
aa2728d09997079c4292657aabe3e50f

SHA1
12deb1b28ea79952fb582cb6840e5e53e3d01667

SHA256
1bd9d97ca6363b413d3721647ec0cb1cf6d0639221e47c91b62ce31b63862d50

SHA512
4d758d4197335f8d703a69802180adf7d75e3cfd6446301597736875dcabdde0a15ebaa4f177a39ea22f8082e1ec3bd705b66c7563be0c5b41b59f7225d8a3d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7TBBQW6D\banner[1].js

Filesize
99KB

MD5
6b1506e94ef140bcda65924f33eb2d4d

SHA1
e9ad74fb7d2a1b761b992bc58cfd4d46a26db690

SHA256
ef8916e10719b5acae506568cf90b13afa248522bee92df20056935ad553ae8d

SHA512
ba9552eeb78a57aec1a62616a0326cd8746d5e1e29c2a5730e6081839118126cded62856755742d03cb752140ebfe1eb7d078427a2cf4a48fe83c8f63ba55c4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7TBBQW6D\d[1]

Filesize
23KB

MD5
ef76c804c0bc0cb9a96e9b3200b50da5

SHA1
efadb4f24bc5ba2d66c9bf4d76ef71b1b0fde954

SHA256
30024e76936a08c73e918f80e327fff82ee1bd1a25f31f9fce88b4b4d546055d

SHA512
735b6470e4639e2d13d6b8247e948dbd6082650902a9441b439ceacc4dfce12cd6c9840ee4c4dcb8a8f1e22adb80968f63ace0c0051811a8d6d1afb2b3c68d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7TBBQW6D\hd-style[1].css

Filesize
41KB

MD5
2ea4a69df5283a1cfd0a1160203ebfe8

SHA1
1c454fb9cac7ac0b1f65cd5c93bc2c9a0da8479a

SHA256
908a427dd11cc624f78bf96e4f775ba708e1bb1fbaaa8566977f3ec54416126b

SHA512
197333dc17a36ff127e6e001a898583322ad7ffa76e24003378f462b041e215194a2529eedd5f93e7e35a0e21dcd88db49c5afd18a0f7cff4cb00f50700c884d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7TBBQW6D\jquery.fancybox.min[1].css

Filesize
12KB

MD5
a2d42584292f64c5827e8b67b1b38726

SHA1
1be9b79be02a1cfc5d96c4a5e0feb8f472babd95

SHA256
5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0

SHA512
1fd8eb6628a8a5476c2e983de00df7dc47ee9a0501a4ef4c75bc52b5d7884e8f8a10831a35f1cdbf0ca38c325bf8444f6914ba0e9c9194a6ef3d46ac348b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7TBBQW6D\js[1].js

Filesize
279KB

MD5
b11b1470fe33890f2cceeb4f1798a25d

SHA1
193541307b65b55513407e9acf7e53a4b01f71fe

SHA256
732d3e94cc5c477f08b61b22b7b9c26b924e7b8f6396f5e8b923549c7c2d704e

SHA512
4f5981285ee9d6338695b19af4b49e9c6e0377139e6e83b6d9bd59b40bfcebf2e17633c9d249409c853e4aecfc8da67e3ed3cfc499b2b05b6aeb5533c102dac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7TBBQW6D\logo[1].png

Filesize
3KB

MD5
f988bb4ef8b8ffa55ca04841c9056312

SHA1
52b0d79df1da68016157367c5de7b1c977bce0c1

SHA256
bfb7ccbb51dfdbb3b540b8da2ca6f7f34c35d028137e67a0017d7e3da5426703

SHA512
db3b6bfb59f09758878d6f55d3d6728186e00b13606b6340fe07b80f0eb2e45fe75f4cc51c12e9f73db468729d973f305bca9e1dd90a35f42a70a1552523ab99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7TBBQW6D\responsive[1].css

Filesize
66KB

MD5
4998fe22f90eacce5aa2ec3b3b37bd81

SHA1
f871e53836d5049ef2dafa26c3e20acab38a9155

SHA256
93fcbfca018780a8af6e48a2c4cd6f7ad314730440236c787d581e2cef1ab8f8

SHA512
822158dac2694341f6cf5c8f14f017ac877c00143194d3cd0a67ffd4d97f9bf8f2305e33b99fa12f62eee53ba18029541c0601ea5496ff50279d1200cfa03232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7TBBQW6D\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7TBBQW6D\vyMFcQYVkOU3HLD7Nm9WYP3dPU_OqvDCuZm5lkktLlo[1].js

Filesize
54KB

MD5
3d46b40c6487768dccb167ff52978a42

SHA1
2a81fe0267fdd614cc991bd82310928b1e24d037

SHA256
bf230571061590e5371cb0fb366f5660fddd3d4fceaaf0c2b999b996492d2e5a

SHA512
7f9a06ca3b15215f883f9204681012421efd994e55fe090b25cbd94240509d5ee24ee022687fdbb8054d13524d384731a5857dd04db884b964ccf04b2714a0bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7TBBQW6D\zyw6mds[1].css

Filesize
1KB

MD5
a5bb75d5bd1b19def25c1dd4f3d4e09c

SHA1
d0c1457e8f357c964b9d4b6c0788e89717fe651f

SHA256
ff0689879c72300a01eae0c05c3205e2ca57c4bc1a6bfa0718fa6fea4a51627e

SHA512
b9fc57f7ade8f34cb02ece2935acb30757ed846e4bcf81d3fcf5bfcb45611d386bd337a6337e9945c5654cf044dce4dd3fafd60a2b42ed5bdc857ef96d077a69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BOIFDBOU\KFOmCnqEu92Fr1Mu4mxP[1].ttf

Filesize
34KB

MD5
372d0cc3288fe8e97df49742baefce90

SHA1
754d9eaa4a009c42e8d6d40c632a1dad6d44ec21

SHA256
466989fd178ca6ed13641893b7003e5d6ec36e42c2a816dee71f87b775ea097f

SHA512
8447bc59795b16877974cd77c52729f6ff08a1e741f68ff445c087ecc09c8c4822b83e8907d156a00be81cb2c0259081926e758c12b3aea023ac574e4a6c9885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BOIFDBOU\base[1].js

Filesize
2.3MB

MD5
5da8b5936dbffa925b6a70881b1c67f7

SHA1
398af32dbfb3f4ed5ff502ae60780d34d851e339

SHA256
672f1c72ea1f5956613656fd5d8cae18e2fdba212abd4ecae90e6db02ecd1c39

SHA512
a6b870627a7ace8a745f5dcea9baf3d08595540c5053caee18df7e96cbef4184986db5721e07eb96c968dc1347eb08ab0145044c4a70252a3f6af380822b724b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BOIFDBOU\css[1].css

Filesize
530B

MD5
1e7cca7a1b89ea2980669f4adb65becd

SHA1
62da7767f3bb769a9b31e400df446a4698e4db63

SHA256
598ad75d6e2e244b759b3f376b510f0ba560b77cc74f48351dcf2abdb7df474f

SHA512
206b90eab94f9ce7260ec624ec9a8afd70bba96d4dc5d8a545a29cd73e55832196e509523da1123c2279eb4cb63fef429e28a3438a268dd3fabd1fd949caf1c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BOIFDBOU\enterprise[1].js

Filesize
1KB

MD5
e5012de816bdbf1ec54255fb1ee90eef

SHA1
91ecd8249332432fddc2d629e44204864f7a3686

SHA256
2b8d4c3232dc1f2c7ff8e1f3e339a9c2a08dcac6f19a11219f424616b83eda7c

SHA512
79ead22917ad07dcb99f870becb07a3eff423621c6fdc5751d1081185b22ef2d1946a66f80b9456117eb249513ffaeefb606978586b92a553bc15a68e59d0aa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BOIFDBOU\escrow[1].png

Filesize
2KB

MD5
78b034232f0b70262484b314a1e1647d

SHA1
8da15f0b8a2a9898dc9caecd8f6d592bc07c0a84

SHA256
d479e382c9e8278ef3b6f9b7a349d1a849056ec4a7b35f4b71d1b6e8e12e2580

SHA512
7ca7ffcf11153cb754ea3c5f5cb300497a7ab22c34922adc59a74dece2d75ff8a25335299e7d045aa2b4bee87541d6a7b99de144095d4c952a88488ad9ae3638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BOIFDBOU\geo[1].png

Filesize
2KB

MD5
d690e7ca1d1e245a00421f46d6bb361a

SHA1
a0e1e032366440d721fb91a14839a4ed2bc77ff3

SHA256
5a5513105fb8a11a2522ab5f69bd6bd86321d77623d3169d8599641bab053543

SHA512
d42a491a15fac8eda60d131ed051546734788854f3152b5768ca7ea4b4b3c8c66c30e31752beac66816f1c291a54d7cd37c12d8019ebff25598228ac24cee592

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BOIFDBOU\hd-js[1].js

Filesize
23KB

MD5
6761faa022e0371e84e74a5916ebaa44

SHA1
5320c3d53d5447bad2a02c63208deca7fb94b655

SHA256
da17fb5b54c0fcd77c7358ff274823cb6a02ba0c4b6fcdf347c1ef611818bd9e

SHA512
a8cdba92942f299b648e87109d193a1f7eeb8f243eb2bbe4224423b512c400fccf930d81cd403a925fdf99220fdffcf89da69305cdc054963a64da470072d019

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BOIFDBOU\hd-js[2].js

Filesize
337B

MD5
4c559442c38eb9d4f33276b9361d0ad2

SHA1
0596260f9b2b640162ea570851e9a04932e89c32

SHA256
2a010ba77fb49f2737ce1c3ea8c1a5f803f7a83a54ef82169d74bce7b2f0a172

SHA512
05fec477811d627c0fa7e053598070aa4d0ee6bd8809cc2d2cdcdd03bc7cc02102030844a36a9699b80b3ebe9905c4cf6df909ccbefdb609b2007d3ca51dc428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BOIFDBOU\main[1].js

Filesize
7KB

MD5
b94953c0c7f9092eea71953c060d76e9

SHA1
1969b3b33863ede14eb7dcf13967ef345e4f202a

SHA256
1004e25b2cefdccaf0a61da69ec12e41609540bd46b3161b3ef8db439c7fb93a

SHA512
b79091d41e855e09a5c8a95319fd806d85db1f0400a0302093e218b3e6e79ae0d51cd623659830d951a88a662cce6d50933f9d2fc930413f5d072033c3a55b34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BOIFDBOU\o-0mIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjcz6L1SoM-jCpoiyAaBO9a6VQ[1].woff

Filesize
16KB

MD5
adda182c554df680e53ea425e49cdf0d

SHA1
9bcac358bdab12b66d8f6c2b3a55d318abe8e3ae

SHA256
d653648b9d6467b7729f0cea0c02e4e9f47323c92a9fcdbcb12475c95ac024df

SHA512
7de2140ee3859b04c59a9473129c3acad91022962d46ffc63529bff278661f0e106a16dde90e8db523f826f82e7c20ad9b23f45a25e81932fd2d8708b616fba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BOIFDBOU\script[1].js

Filesize
96KB

MD5
28becf0e5ce8d65f6f9e33e5954a1a79

SHA1
69d67a8f41d803b62218f02a28ebaf53f32e072e

SHA256
c59fa2847d6798cd7b5ebbd9b7832eb95e6b8aeffff195d3312ac7094049ac50

SHA512
3d6734183f99b73e5bf6097f2f388ca83ca7d20a849b77c871e28c2cd3e65d9fc0a020fbd349b08bbd916493089396386623d695af964a6a1f273429cca1ad6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BOIFDBOU\style[1].css

Filesize
165KB

MD5
65760e3b3b198746b7e73e4de28efea1

SHA1
1d1a2cce09b28cffc89378b0a60cbb1aa8a08c4f

SHA256
10e40ea3a2ad69c08d13e194cf13eb4a28a093c939758a17a6a775ef603ac4fc

SHA512
fbcb91f26b7bd874d6a6a3b1d4d6f7277ded091cdae5706c285b4d5d17446a1bf58572c224af38393ce49b310a51d5c5d60711c7094e5d32abbaaf10d1107e1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BOIFDBOU\t[2].gif

Filesize
49B

MD5
56398e76be6355ad5999b262208a17c9

SHA1
a1fdee122b95748d81cee426d717c05b5174fe96

SHA256
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

SHA512
fd8b021f0236e487bfee13bf8f0ae98760abc492f7ca3023e292631979e135cb4ccb0c89b6234971b060ad72c0ca4474cbb5092c6c7a3255d81a54a36277b486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGWUB7UN\KFOlCnqEu92Fr1MmEU9fBBc-[1].woff

Filesize
19KB

MD5
de8b7431b74642e830af4d4f4b513ec9

SHA1
f549f1fe8a0b86ef3fbdcb8d508440aff84c385c

SHA256
3bfe46bb1ca35b205306c5ec664e99e4a816f48a417b6b42e77a1f43f0bc4e7a

SHA512
57d3d4de3816307ed954b796c13bfa34af22a46a2fea310df90e966301350ae8adac62bcd2abf7d7768e6bdcbb3dfc5069378a728436173d07abfa483c1025ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGWUB7UN\KFOmCnqEu92Fr1Mu4mxM[1].woff

Filesize
19KB

MD5
bafb105baeb22d965c70fe52ba6b49d9

SHA1
934014cc9bbe5883542be756b3146c05844b254f

SHA256
1570f866bf6eae82041e407280894a86ad2b8b275e01908ae156914dc693a4ed

SHA512
85a91773b0283e3b2400c773527542228478cc1b9e8ad8ea62435d705e98702a40bedf26cb5b0900dd8fecc79f802b8c1839184e787d9416886dbc73dff22a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGWUB7UN\care[1].png

Filesize
683B

MD5
92fb833b653eabd92e27c6efc5aab3fe

SHA1
95d9db7a7478a820c99184686b1677ed428e50ad

SHA256
648a2af4c5486a91b68bfa1ee8b60a8136410fabaa602d6e593852fd9d1d3ebd

SHA512
955c38ba8dbdd20a6df9807993c342124c45e21cb6075eeaf339fb66aaf64a2239a92fd415bce3109efa9c5bcd4246983626a1f75a5dcd3d720fa6938130352d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGWUB7UN\common[1].js

Filesize
8KB

MD5
56b21f24437bfc88afae189f4c9a40ff

SHA1
a9d3acad3d4c35da454e4a654bdd38f8d2c4e9d0

SHA256
cfece1b609f896c5cd5e6dbe86be3ba30a444426a139aec7490305ebf4753ed4

SHA512
53d4718e60a47526be027c7829f9ad48f381e22765790f20db35ff646bd994f8085b12b8fbeefd5b29ecda8f71f4c6c62b64652bc9a7256e001b5e4047c21651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGWUB7UN\domain_profile[1].htm

Filesize
6KB

MD5
e6476e15f8e507ebc1183fd1b91a9056

SHA1
a59dde5ef0649fd1e6fa0e9f2978a353aeb99e26

SHA256
4a1139d73baca643ee316d01a0060a56741d486090bad05cb83422159c55edec

SHA512
e73791cfd4093206a1a2fc3750415273f135329997cdadfd7c800e86add088c37b87a3309224454fc5b779b5357f52f4bd51b7d456f6a23ecb83edc561a41625

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGWUB7UN\domain_profile[1].htm

Filesize
41KB

MD5
d0563f9f63372922ce9bb3b47bb22a70

SHA1
5624e9fb90cefd9de354e0a18cd2a5491f5f7531

SHA256
42602a91817f20329846294a49719b2eec058a74c68841e7b0f52302a99d3a6d

SHA512
a2e6e425f970ad64f5f38ce8a4093de15c9401c04e2365a03aa424e57cf9887b9f2e03a77fa5932b8978466a9bdfa5652f3e92027e96c2e255157422c29213da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGWUB7UN\embed[1].js

Filesize
66KB

MD5
6c5663d8fd3d3546d0bf2dc1435b95c9

SHA1
2b7354e37f152ae2a81a26887d51c5090419c392

SHA256
12bb44bfd488e552fa96237babbf55887bbc76ca10470c0b536543b0b2c8f47a

SHA512
3e0f5c704a52df52956ba667aeff5a51b56c55ae17ff31a71c2718b953346213d46e5846b23fc846d1fd58889acdaf9c09a4bcbe5d4a82a7c37a8feb4cb8d288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGWUB7UN\guarant-footer[1].png

Filesize
1KB

MD5
ebc6a32aaf8ea9681969745fb569ba91

SHA1
6620dac92b6a9274b943ab6fc0d1c8ae273b3f9a

SHA256
f871b5aac8bac1e406f07ceed1e33f7c0f4bdfdcf3cff87ed30b54986d21647d

SHA512
95352a45075dee231df82884b5a8f4fd1bc1cb08374ecc4d58bd77d8f2173bc5b0e5eee41cf5f94ec45a7608b0483c48d00c1dcd5ad7c463582409a5e7c32c07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGWUB7UN\hd-style-print[1].css

Filesize
1KB

MD5
7878fda89f8e725fa06880d1890f9c00

SHA1
3f8e8aa44d26d3cff13159830cf50aa651299043

SHA256
6d17b244f2b4b8a93886dbe5cffad1cbe8fc9079495fb972a10fac1eda0a16ce

SHA512
392d457f4c54088abef2b4deeb042220ab318d00d1157fc27386a5faac821c70c78c8452c99bc75758fa36643932938274c171589307919ec01e293010ea35fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGWUB7UN\jquery.min[1].js

Filesize
84KB

MD5
c9f5aeeca3ad37bf2aa006139b935f0a

SHA1
1055018c28ab41087ef9ccefe411606893dabea2

SHA256
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

SHA512
dcff2b5c2b8625d3593a7531ff4ddcd633939cc9f7acfeb79c18a9e6038fdaa99487960075502f159d44f902d965b0b5aed32b41bfa66a1dc07d85b5d5152b58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGWUB7UN\phone-icon[1].png

Filesize
705B

MD5
296e4b34af0bb4eb0481e92ae0d02389

SHA1
5bd4d274695c203edc3e45241d88cda8704a9678

SHA256
eada6e51071e406f0ec095cdd63092399a729a630ae841c8e374ff10dca103aa

SHA512
0bed089f0ac81291a532194377acde5beafa7763f445e80c3eaa7206740c582dde843f65b5b3885d9b2e34610b2eda45885c8d45c31408761adf4f81f3caed1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGWUB7UN\reboot.min[1].css

Filesize
3KB

MD5
51b8b71098eeed2c55a4534e48579a16

SHA1
2ec1922d2bfaf67bf3ffabe43a11e3bf481dc5d7

SHA256
bd78e3bcc569d029e7c709144e4038dede4d92a143e77bc46e4f15913769758b

SHA512
2597223e603e095bf405998aacd8585f85e66de8d992a9078951dd85f462217305e215b4828188bf7840368d8116ed8fb5d95f3bfab00240b4a8ddab71ac760d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGWUB7UN\uVtrB8mfYkSeGiJQPzMX2K5aR434XKq5huJIZl4eJIc[1].js

Filesize
24KB

MD5
f35eb4bfc97287b71d66f27a4f1986bf

SHA1
e8a82c098cb2cd80e3eec59f488190567747669f

SHA256
b95b6b07c99f62449e1a22503f3317d8ae5a478df85caab986e248665e1e2487

SHA512
9593cd4fb1b17f82fbecca612cc05a2c3cb82332aab35982648a72155cec027791a81fedda2e65c64506b6ef48b58af021f4ab6f67d5dc6070be6f9e19b0c9eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGWUB7UN\webworker[1].js

Filesize
102B

MD5
cfb75de5b30bf427c44f5a02e8616345

SHA1
25ced704596e89f7a2e50227129d71b0e9bd5da2

SHA256
82d3b76db4d62ac71bfd0abd0528fc3a03a8dc2ce3c65eb90ca4a3b0181122ec

SHA512
8327c6e09830f0c3526c439dbe2213bfae5de2485575ca8b74fa83fcc2d3b1f824a94ef324511c16e8aa2d35a8655da0d5792eff46b9e37ca3202db175802be4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGWUB7UN\www-player[1].css

Filesize
376KB

MD5
f18c457e9084f86ef43c2efbdede8891

SHA1
7449eae7060ca1246651a86d7c5b2f34c1205086

SHA256
bce04b253bdde030d0b43e084a11f694604bd4528c5b81209df71b1a9daa450b

SHA512
31742ec3abb2362ecda4a38c0da10a410db5df0596e5d916f6ed46df4bf997f013773998af54c7f28e592974dc8a53316b95c7cb574006f3220ea4135e19622a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LI43KEDR\KFOlCnqEu92Fr1MmEU9fBBc9[1].ttf

Filesize
34KB

MD5
4d88404f733741eaacfda2e318840a98

SHA1
49e0f3d32666ac36205f84ac7457030ca0a9d95f

SHA256
b464107219af95400af44c949574d9617de760e100712d4dec8f51a76c50dda1

SHA512
2e5d3280d5f7e70ca3ea29e7c01f47feb57fe93fc55fd0ea63641e99e5d699bb4b1f1f686da25c91ba4f64833f9946070f7546558cbd68249b0d853949ff85c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LI43KEDR\analytics[1].js

Filesize
51KB

MD5
575b5480531da4d14e7453e2016fe0bc

SHA1
e5c5f3134fe29e60b591c87ea85951f0aea36ee1

SHA256
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

SHA512
174e48f4fb2a7e7a0be1e16564f9ed2d0bbcc8b4af18cb89ad49cf42b1c3894c8f8e29ce673bc5d9bc8552f88d1d47294ee0e216402566a3f446f04aca24857a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LI43KEDR\counter[1].js

Filesize
35KB

MD5
b5af8efecbad3bca820a36e59dde6817

SHA1
59995d077486017c84d475206eba1d5e909800b1

SHA256
a6b293451a19dfb0f68649e5ceabac93b2d4155e64fe7f3e3af21a19984e2368

SHA512
aac377f6094dc0411b8ef94a08174d12cbb25f6d6279e10ffb325d5215c40d7b61617186a03db7084d827e7310dc38e2bd8d67cf591e6fb0a46f8191d715de7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LI43KEDR\domain_profile[1].htm

Filesize
6KB

MD5
afb1c68b9a4ba97ff4f8a4d71a3eca88

SHA1
cd1d152cc9715bbbf917d4ead45ff4ec82e3e95b

SHA256
1e9c98c50dacf53bf6cb22bb8743f730af626a35fa1ec8049adf29ce67397227

SHA512
5274891f7de24fcc59fc622ee19c2f2eae2f8cfe60a2769c9e54a877cba7d029a17d6d63617fcc7387995c20b34340d53d6850523e7bb88145237687313cc901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LI43KEDR\domain_profile[1].htm

Filesize
6KB

MD5
cfb5d2cd924f9ef4e49acda6608ed4c9

SHA1
cb781def2189a826d30b79eeacaed87fe7a72e09

SHA256
b2eb81b2b2399a4d4ea8ff742e1214e382dedb1db6dfc79afb0a43f14656463b

SHA512
de55a20fc90f5b4b69125d40b039da45a12ae0692be7d27c8611b94bb5bf710224f71515cc843c9c8ef4ba34a9850f0f6046fc85bd3ec72f46f724e9ab6389e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LI43KEDR\js[1].js

Filesize
212KB

MD5
7d8c3a0ae0186dbdfec625e666db45bc

SHA1
d4b53842c38a4a397b9fc5d958b6fce39ce159e7

SHA256
44f96a62c62e66009840cca3cb2f4a70c2ad752b818bd23dc02806ae0a555e2e

SHA512
49792907cfbe1fd5d55c52edccfbed55eed30872494cd0e379c24b0d11f4ab175e5e4e22dd94a6dc2bf510016f2e74ec3d59049ec3eb68d7e5c952c6c021ae8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LI43KEDR\js[1].js

Filesize
279KB

MD5
4747630e29dafac3795c4be9fe5641eb

SHA1
8e83cd784a0e896d5a0bb8c7f513fb3ccdb3cf1f

SHA256
0ee3d195097610e69c77ac48a248bd8c977e7d2ef6a3070b32ba888ae4986171

SHA512
64057a126aa5acb3ce6cc5a0bea39bec4b677e32a5540a4266972a1f01bfd91739cb74d2beac833a0c21e9c5315c4dd59e54995db13c3d56b19f76938a9a38d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LI43KEDR\logo_48[1].png

Filesize
2KB

MD5
ef9941290c50cd3866e2ba6b793f010d

SHA1
4736508c795667dcea21f8d864233031223b7832

SHA256
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

SHA512
a0c69c70117c5713caf8b12f3b6e8bbb9cdaf72768e5db9db5831a3c37541b87613c6b020dd2f9b8760064a8c7337f175e7234bfe776eee5e3588dc5662419d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LI43KEDR\o-0mIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjcz6L1SoM-jCpoiyD9A-9a6VQ[1].woff

Filesize
16KB

MD5
642d45886c2e7112f37bd5c1b320bab1

SHA1
f4af9715c8bdbad8344db3b9184640c36ce52fa3

SHA256
5ac87e4cb313416a44152e9a8340cb374877bb5cb0028837178e542c03008055

SHA512
acda4fedd74f98bcee7cf0b58e7208bdb6c799d05fa43b3fb1cd472e22626322f149d690fe5f2cdc8953244f2899bebe55513b6f766a1f4511d213985a660c3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LI43KEDR\p[1].css

Filesize
5B

MD5
83d24d4b43cc7eef2b61e66c95f3d158

SHA1
f0cafc285ee23bb6c28c5166f305493c4331c84d

SHA256
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

SHA512
e6e84563d3a55767f8e5f36c4e217a0768120d6e15ce4d01aa63d36af7ec8d20b600ce96dcc56de91ec7e55e83a8267baddd68b61447069b82abdb2e92c6acb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LI43KEDR\recaptcha__en[1].js

Filesize
531KB

MD5
1d96c92a257d170cba9e96057042088e

SHA1
70c323e5d1fc37d0839b3643c0b3825b1fc554f1

SHA256
e96a5e1e04ee3d7ffd8118f853ec2c0bcbf73b571cfa1c710238557baf5dd896

SHA512
a0fe722f29a7794398b315d9b6bec9e19fc478d54f53a2c14dd0d02e6071d6024d55e62bc7cf8543f2267fb96c352917ef4a2fdc5286f7997c8a5dc97519ee99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LI43KEDR\script[1].js

Filesize
9KB

MD5
defee0a43f53c0bd24b5420db2325418

SHA1
55e3fdbced6fb04f1a2a664209f6117110b206f3

SHA256
c1f8e55b298dc653477b557d4d9ef04951b3b8ba8362a836c54e2db10cda4d09

SHA512
33d1a6753a32ec06dcfc07637e9654af9321fe9fa2590efc70893eb58c8603505f2be69084fb2bcbf929218c4e7df9f7a8bc3f17a5b41ed38c4d8645296ebab5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LI43KEDR\styles__ltr[1].css

Filesize
55KB

MD5
4adccf70587477c74e2fcd636e4ec895

SHA1
af63034901c98e2d93faa7737f9c8f52e302d88b

SHA256
0e04cd9eec042868e190cbdabf2f8f0c7172dcc54ab87eb616eca14258307b4d

SHA512
d3f071c0a0aa7f2d3b8e584c67d4a1adf1a9a99595cffc204bf43b99f5b19c4b98cec8b31e65a46c01509fc7af8787bd7839299a683d028e388fdc4ded678cb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LI43KEDR\www-embed-player[1].js

Filesize
328KB

MD5
5b83a2436150d9f10e2a4130b71a085a

SHA1
4315652e1d1c55e1d7e89b170b5ae84e2a2abc71

SHA256
bda90577d3522b775612732fe91c4e0c3f65c3a713af891a8c551598da11e9e2

SHA512
288169d6a4869f4f7f0b157f51e5b296d96ee9f57b42f5168fe99c477bffebed0fd4aa6cf376af786325b4ab39ee894cc35c8834636578240dbb376726721e44

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
428KB

MD5
a08c83a6940714ab74e81fd55fca535d

SHA1
d41e282db3497c92c7df45b88c9d89fe6af339ff

SHA256
70d723f8dca9d3e4a714b097aa9c64f287b8c09c8f2cbd77bcc5603dd11bcb1d

SHA512
e469f3f84e9f6656e78455f869371c7a70facf25f609a7aebea267f00bd2ef569f5a16438b333af2c5a8241121667de3135b4d3ce287b5d15aad65532fd87c5c

Download Submit
memory/692-20-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/692-23-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/692-157-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/692-621-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/692-39-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/692-1608-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/692-25-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/692-526-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/692-1705-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/692-431-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/724-12-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/724-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2640-293-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2640-37-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download