e1fa0b0ad452c245b20ff059b9c80b780c1994b14fc9661d23da0310fda17364

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad999f2b63db4c871be322239547600c_JaffaCakes118.exe
Size

865KB
MD5

ad999f2b63db4c871be322239547600c
SHA1

76d4b2d45aafc3471dbe56ac3ab1adaaa8b563bd
SHA256

e1fa0b0ad452c245b20ff059b9c80b780c1994b14fc9661d23da0310fda17364
SHA512

31d1929c27cd1d0168bb9ad0fd2842f2545ad1f4234debea99d015cee727e08c1dc95f0ecf7c1ac708328406abe364b78aa66f2febc4a7c38ea705aa27abc6af
SSDEEP

3072:kHsPdAFnEY/2hhHZf66XUNnrJHLBTHHNOVRKout:kCdkoRKoS

Score

10^/10

defense_evasion discovery evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 18 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-65027206"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-5813705"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-42871933"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-97194074"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpcc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atwatch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netspyhunter-1.2.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navrunr.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\platin.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmgm32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Safari.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navauto-protect.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navengnavex15.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswinntse.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hwpe.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmnhdlr.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuard.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UI0Detect.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ave32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navwnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvlaunch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jed.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spyxx.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccshtdwn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwatson.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\etrustcipe.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmiav.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antigen.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ent.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530stbyb.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panixk.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccwin98.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zauinst.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsched.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zauinst.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\EXCEL.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\padmin.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcontrol.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsbgate.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ecmd.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rrguard.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcmserv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscenu6.02d30.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hidec.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esafe.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmor.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectx.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winservices.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winsfcm.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SandboxieDcomLaunch.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsrte.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mxtask.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pingscan.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monitor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwservice.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcdsetup.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfiadmin.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drvins32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frw.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tc.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmntsrv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	ad999f2b63db4c871be322239547600c_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
1940	winlogon.exe
4316	winlogon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4316-19-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4316-23-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4316-24-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4316-25-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4316-39-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4316-156-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4316-364-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4316-559-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4316-748-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4316-1049-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4316-1262-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4316-1392-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4316-1715-0x0000000000400000-0x000000000043F000-memory.dmp	upx

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\159565A415842554 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\159565A415842554 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Indicator Removal: Clear Persistence 1 TTPs 46 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PRESENTATIONHOST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RDRSERVICESUPDATER.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SDXHELPER.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SPOOLSV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\EXCEL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSFEEDSSYNC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOHTMED.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOXMLED.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOSYNC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SVCHOST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SYSTEMSETTINGS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSHTA.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSQRY32.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\NGEN.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOSREC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ONENOTE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ORGCHART.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SELFCERT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACRORD32.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\EXCELCNV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IEUNATT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOASB.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOADFSB.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\NGENTASK.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SPLWOW64.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACRORD32INFO.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MICROSOFTEDGEUPDATE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MRT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSCORSVW.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IEXPLORE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\POWERPNT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PRINTDIALOG.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RDRCEF.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CLVIEW.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\EXTEXPORT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GRAPH.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IEINSTAL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNTIMEBROKER.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IE4UINIT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IELOWUTIL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PRINTISOLATIONHOST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SETLANG.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ONENOTEM.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WINWORD.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WORDCONV.EXE	winlogon.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1940 set thread context of 4316	1940	winlogon.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad999f2b63db4c871be322239547600c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1506"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "339"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\DOMStorage\tiny.cc	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\hugedomains.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039570b57fe416e4dbccca910bc3eabbd00000000020000000000106600000001000020000000b6b8c0cde5ea88158b5a9864b4d2dea48f2bc9122c730685616a8f2239361c5b000000000e8000000002000020000000130b1c42a2e5c33cc8b1a9316dc5459e93a86d426358e043196639c797bf23df200000003fdc2b951e67e5ed94bec7eb2e67eb8bb42bd047632da2121d7a4a59e5e8778140000000e65e14e700eff5fe5d15a4393155ac12ec26a89a27eaa7444786e3b29ddda7de65ac1862aa41cc1b63c52435c459002279d734548924bec1519bf96997533408	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "7165"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "7139"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "8688"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "18151"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "197"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "3037"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "3037"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "7310"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "178"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "4383"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "5704"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b09f5ab7abf2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "12550"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "8750"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "8745"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "18309"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31126187"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2916"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "8540"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "11175"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "8687"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40cbedaeabf2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\tiny.cc\Total = "101"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1720"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "2949"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "8663"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "18155"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "254"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1506"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "17487"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "8629"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\tiny.cc\Total = "82"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\tiny.cc\ = "101"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 801e33a9abf2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "8827"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\tiny.cc\ = "82"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "197"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039570b57fe416e4dbccca910bc3eabbd00000000020000000000106600000001000020000000e5e714dd94a4f352952aa06c7984ecbf79e0d2b17a34b8826ae47bb087afc263000000000e8000000002000020000000e4b0877f31af90e2b20c377c4a1d11de43e74400d12f3fb0a1a9dc07db32b8d920000000cd59ac9b62d74486c2d4450346818e182ed6da2fc681f08ada11f6d8afb3a30d4000000026c99d97f794a5a32fa81b31271d3b53a4e228b37e8af82bf8ccd876dca749dc956f22f175e1356487c81a45fdef2b65672f50629e8c9d099b7d16cf6433e9ab	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "3031"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "8689"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "8695"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "8574"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "9916"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "7071"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "8573"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "8537"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31126187"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "2916"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://pr56643hw3qb514.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://175qck086230sfa.directorio-w.com"	winlogon.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{E32659C6-A50C-451B-89B8-172592093694}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{BAA11573-ED4D-40E6-BEA7-60406CC04974}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{E738D629-84EC-44B0-939C-C34A6887D63E}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{C9582FFA-ACF8-40A2-946D-D660DCD43559}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{6D1F187D-ADF8-4AA7-A80F-D244B609DE4A}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{319B950C-FFD1-43F7-9B4A-AD0B02D169AC}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{ECE025ED-149E-41A0-B118-B4029646286B}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{CC8A10A7-ABB9-49F1-B3AD-4A5F2C5AE1E6}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{2B40372E-DA80-4231-B32B-7469C3F10C36}	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{E3B28516-0DBA-41A7-BABF-D69EBA7E37E6}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{83502C26-7875-48AA-BD97-D833F5598477}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe
4316	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	4316	winlogon.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2632	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2748	ad999f2b63db4c871be322239547600c_JaffaCakes118.exe
1940	winlogon.exe
4316	winlogon.exe
2632	iexplore.exe
2632	iexplore.exe
740	IEXPLORE.EXE
740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 1940	2748	ad999f2b63db4c871be322239547600c_JaffaCakes118.exe	85
PID 2748 wrote to memory of 1940	2748	ad999f2b63db4c871be322239547600c_JaffaCakes118.exe	85
PID 2748 wrote to memory of 1940	2748	ad999f2b63db4c871be322239547600c_JaffaCakes118.exe	85
PID 1940 wrote to memory of 4316	1940	winlogon.exe	89
PID 1940 wrote to memory of 4316	1940	winlogon.exe	89
PID 1940 wrote to memory of 4316	1940	winlogon.exe	89
PID 1940 wrote to memory of 4316	1940	winlogon.exe	89
PID 1940 wrote to memory of 4316	1940	winlogon.exe	89
PID 1940 wrote to memory of 4316	1940	winlogon.exe	89
PID 1940 wrote to memory of 4316	1940	winlogon.exe	89
PID 1940 wrote to memory of 4316	1940	winlogon.exe	89
PID 2632 wrote to memory of 740	2632	iexplore.exe	95
PID 2632 wrote to memory of 740	2632	iexplore.exe	95
PID 2632 wrote to memory of 740	2632	iexplore.exe	95

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\ad999f2b63db4c871be322239547600c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ad999f2b63db4c871be322239547600c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\E696D64614\winlogon.exe
  "C:\Users\Admin\E696D64614\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Users\Admin\E696D64614\winlogon.exe
    Error 448
    3⤵
    - Modifies firewall policy service
    - Modifies security service
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Windows security modification
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:4316

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1156

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
58fd856ece8c070d5df6faffe2273c60

SHA1
8cc3b05cf38684288a27bf273d94449fd15cab5d

SHA256
1efeaf11f4fdaef3a7a15835e2ec5e70330057ade2a4334692630ffdc952555e

SHA512
7ef07526ac45e0f7ed24db22db44614f102b88e9642952a9ec2e0bc550e73fe3fccec9754a8a426d1a573d8d9c3d0ae798949a6bfeb204302267870b563d2d17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
257d38076bb33cb93a2708ea16bfda65

SHA1
cb7a295095e53aac040d4d43c135820bdf4a2b10

SHA256
55500981886f78cbe1c011cb79c152ab2baab45bd2215ebb9ea854d3b35bb50a

SHA512
016093f40cb173c90ba18b1f05e736bf713f9c3b0f8551118cb7d8dbbab6ac9eed8174466b3ffa42d834c07e95818b5af612ef5d645acb54c14d76dde1e53e48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\1J4U5GDJ\www.google[1].xml

Filesize
99B

MD5
57d99c8912e72c1918ddfc26a7f23a96

SHA1
a8ccf9510307e0fe9e61664c5b35b0e81fb549d7

SHA256
fe32f72e98d671185e22c1659c2a12821ea912c6a4daa1abb36d9da07e6d3660

SHA512
f531343ed57a4ec4050f5d156aa07ad4570506076f84c86c57d805c8a32fd4bce31481da2bfc8ccdda9838ca766f246532b583ea5deb634fca9dcbce199f2800

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
22KB

MD5
2592f14a2488714edfe5c580fa88cfc8

SHA1
e59c04248af3548bdb8541a76a5c9f4919d2e054

SHA256
4c46f4500c14559c0257fa120e04d5a06a74a7a31ce14a95774dd9ff440f9629

SHA512
511dba8b831ac5631e6a7eec35681d6ac4b10b5dca3d5ec2df8a666771a2d28230f3669b63ae4ef1e8513b608740f8a8578b280a915cfabe3b377c8045536740

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
7KB

MD5
a1ae9de6837e40c46f8fc60ef02a20ee

SHA1
60ddf9a5cafaf3df1378ab5e0f67ed7616bb18ff

SHA256
b6bd84398303d82fefe4a32130a1aa86f8c88f280a252fa098e420628f285812

SHA512
188bb2ee1a8cea430471ad82a5801145e1e590b7efa4fb7c594291ed39a5ea7dd7b1879df122fbed01e4db681f1cbcff5c93a54554d974203dc4eea69d03dbe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
7KB

MD5
04f2520eb18921577a584567ddbba427

SHA1
ee5eeb4743ceb1478012bc9209f1c9aa2a41ab4b

SHA256
bacc8b2ebf5ebde625435421cc82244b0baa99c01f24a4e894b5087555207c95

SHA512
9a68f1bbb559175106366ce62289fb1f57bbb0b08151218c02480f8113cf60639f0b0a3e46c5f05a088b34d7c8dee310931f19ebea2f7a1dc0200f0ec6d08398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
7KB

MD5
26fcf1a7a3aad22dd9be9793a1ae65c8

SHA1
ce46357208510b23bb30f5b2635fd265d3077de8

SHA256
77d5d5191b0d27fc3fb459398d336f82661ee3ae6ec72f56330538b80aff322a

SHA512
871d68f081bc74b3383ce72c0ec750477fbda89536366be248d06dbab4b6a568e606c0276db1e210f255b5d8e5d2d18c4af8811762d02f60e110dd27c7db24a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
24KB

MD5
52dc9d6916c9cdacb8b35affdde7c2f3

SHA1
1d9ef28638b73cb3ec1c092642bc4ef94e274903

SHA256
443fbb828bee1f341ffac65787daf86727f29cf0b7d2701d84b4a2116fc2521f

SHA512
6561abc238ac63d627689ad99447f0f916f76124e81462bdf3d7bb367c4baa61f9f6d79b6db745a1485c1b9ce8eb49bd610512526c903ca5d62c087b6a5a8b57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
9KB

MD5
0de0a84bfee9bdd1cff5f30efcb79540

SHA1
6086005816cd45322aad152682ec7d8d8bc42eba

SHA256
8f3461b23ef1b4cf0d0ca5b166aef6fabad064c10ec8b789dcdc88d5850dd2bf

SHA512
7c9843ea8e2396fca3d12eaabed0a343b5998c5e211d84d6e3c4c2d11936e7262fd30023f8e557012f597a0202f3a5550b0dca7bc74d776679d85f5ecc4f3c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
9KB

MD5
e31b90218b5c7b29a37b6c431cd426ef

SHA1
b0682aa9a41fa2cc7ccb7ed91fdf811ebe81a575

SHA256
ef7a0ef867ad9196fcfc48eb86a0f613a3f5ee04ee5f2399986df232a97c9745

SHA512
f7efb90d6f43cddab5c8258001f2b86511a6a63b6e52a350223490eb2b7ddc9c0fb7e836448744f5deca294a428b787ee5c318d70e90082cabe70cbad53392e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
9KB

MD5
07ab7e5d9e4fa0f900ee90def6637e27

SHA1
93c333b7f33f5c37f8071fa611c880945f13672c

SHA256
4dbe8e79b9add2a2762a476a37ea0aab5ed9007380210b4485310cd78fd83890

SHA512
0d1caa254429e896e9479ab8be76f53d928bfda0bd888398cb2541749d99d479a196bf12f1107eddbaf3640c8ac57bf4654f64cab0080df9d0902718c6f5f606

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
24KB

MD5
48a852caee4a67dff9bf3da2c4c9b86e

SHA1
c2d0ad3a3fb9344fa77fda0ce9d4fa7a88323fe6

SHA256
6835de4280be32eeb7c7b13e6f19e6c7a60685ec46c048e4ee0095196b0aaf01

SHA512
431ba7eab692ea64f324715174c2d78b44ef6b93a31b107b55fdd2b9a15c303ba363d10822a8ceef02ccb061eefeb613f21ce4b140d64715c2fdaf73330e4c32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
11KB

MD5
2868c8e4e72d6bce02182293ae62086e

SHA1
ca4104ccd6edeb0aae0ee5d8abe1141d84300f4d

SHA256
c20d650954420b2e2c2b6b869db36de12e3ea2cbcfa202042c2a0d6915b6910c

SHA512
35698e03739dc913d43e97dda7b748caa547dc1ac709be6658f2bf4fef701329bab7aad883dcab820134eac6f73891f14bd37397569a3e9684667b66e4f53ae6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
11KB

MD5
bd1b929d47864083fada4d87f4df1323

SHA1
4af278c06daa6f020f4bb68f6c5041b73740cc0c

SHA256
051d60e97a9866d71c0a58f0da8efa3c1f637380cfed8145bb774524bcf031a0

SHA512
a8acd22f3e0afc795ce3a72685c60fd691691689e71cd342fcac574cbfe4898ddc501c8ee3e1b6cb929907984dafa0dd482a148b282dc6b55092a4419ec1736d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
28KB

MD5
8546b227964643e12dc38d0875637657

SHA1
422f939d31f209e08c06a580da0d9b6b74d55135

SHA256
dd498152edc66bbc89b9a93c0769a8ca73a68b602ee5a47a4cd5e7dc7aad7b98

SHA512
ab180cfe117e28b7eba0961fb4fea3cc12095f95903c280bbd2136704de1907c5866b0a65b5459528f3b2ea9f52ea93c02136509305a4ce3aadbb14022cfc2f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
440B

MD5
0b434f8e68b740c26d6ab9bc092d6766

SHA1
7c58eeb1efdd29d264a0c0c740fdc74555e2050b

SHA256
a553c25bb996d3f6bfb55015f204006f706a96683742d46692b81e42c75b8f79

SHA512
e38996a1dc3d022b9c93615732b542f2c351e2eb6b1c59f70fe7c3f34aacb9eef991fa1273509adf35b766947a1b4543f8ca2180cf4c8a1a76cc2e6b70bfbed0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
9KB

MD5
e1a953a053f294ad41f815ee06cd2a0e

SHA1
dd5c6d124dc05b1e111cb033470c5e276a244247

SHA256
e694feda0b56bb6d05aceffb9ced1957c883f96a49e0133698fd8c71a6aa254d

SHA512
67fabba1af0338dd4077fa65418547fca35d2c3acfc43ad86090d92fea4ec1166888eec4eb35c47c8adf8ac0a15f3f2213fe8439062446ad838be40cebd29071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
11KB

MD5
839a40f4a2a703bc5d5810cda3e477e5

SHA1
1d8e5f76e871dad01f9d9c7f20568bafe0bbfd2c

SHA256
1668cb60518a1ffd239a5751b39965bc0194a5a1ca625bf198c512cb8423b75f

SHA512
cd9034f3b49a244ed1f19cf3ca208d304069389161ca37d7ebcc695c71fc2e5160de5cbc65417dfbfc8c4af79a4cf2a96683fea106de1a402bc37a7fd5b5e7fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
11KB

MD5
42e7f6b93ebaeccf27845f6ac0262f4e

SHA1
8a01a1d652e579c8e8a4924206f3851ab28fcb51

SHA256
4a45a31f463bf1197b9e344c72623650384724256ab9b778349b918cce66a55e

SHA512
703be6c40ad51a5e7ada57ac7f9af11e9e51da790be4eb059eb45cfa780b873938d016df3611f6d6a385490be8d9c004e657b67cc5c71336aeca9928b021df61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
11KB

MD5
544c90b2e227a9f89dd375ece44d4c9b

SHA1
e3f8b7404fdcc3fc188908d7a802128e0f1e3782

SHA256
55eff4a3390480e423e9b6832b78746d05a6ca568de4ec527a9230ab481752af

SHA512
cf0b2d0fe3c9e345b4d599ddae35432ae175106bb5e0c5aa1da3cd96366b8fcc2a734f5c3207069ee2f50eed30744b8ab4ea726701964d90faa373adae9e0ce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
26KB

MD5
11b2d81add62b248812510eb7b2c7aef

SHA1
428be64e8ac79641e2c2f860e9dd0a89177a72c9

SHA256
e4d96c6c469d6140b365cb69de020b09dc21ef7059f158c15386412b3ff4cced

SHA512
67e6d02b8052ec89ab971e4625138b5a1c2e9644d46f4f92deaeb91470f5ff1a9186bae4cc82b048a2adc3e684cfcbe0e3d2c882e790c687ddab4b502957ebc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
9KB

MD5
f02ba16b68f1c9b69bfd9cccdb097cf2

SHA1
7396fd8b13d38fb7792b95b14827f3c8cdb551e9

SHA256
c6f76843d98bfa2eac08ba3a805efbcda6ca7f34f9041e1150e0d21be27c3a3e

SHA512
e504921c2aad8df3217160832e2e3eaf3126ec08958d2d281f8911516b44472ff2a7935e880e2b95bc174ea1d9a3da76b0b91f2a41a037284668df82fcc9952c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
440B

MD5
db9654c402df4a4f1e002a3519bf7973

SHA1
78cd9df28d331bd39dac92da7d21db8c75f50289

SHA256
3fc2f617aea36cc38e646ee1e300f1356f3ba316432cbc6bc6c13a40f81bbc8b

SHA512
32424b976260503b2ad80a20bb2ee5a074871059f189e195fc3fbfc8dbdefffa77f145cf53c77e1d10d51052ac5d9a6b7612b7554eeec6f60832323bbeff6438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
11KB

MD5
764fe25cea5a340c8400b05da9d11b96

SHA1
a62eb8297e9004eba53d806f02cb1c472c1885a4

SHA256
b778da9b4b2c4fd652459a4d92c9935eb4d9d11d81a6458fd64f29ccaac77007

SHA512
40b37bc3e83712800a450e0b78913902559ae192c75977d6c003abd6058e5f6c042b19047bc0f5b458b217415a5a470a87685aa959251e7b8ad6ad2c3fc9532a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
11KB

MD5
b2c6a48b62de492712c7f811fa37efa2

SHA1
ffa03077230a6d1b9677bd158603f6d58330388b

SHA256
22dfbd20ed6a030f229c0f51d519eae8abae184de09169d49eeff1a5fa032a44

SHA512
6db851120fc7fa538b379ceb29a98f63c981cb9579ecf1c0b8c9241bcc7984928baaf642948c95c4cc3f99e13bb92da4d2e173af22072440e047061c0b15c322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
11KB

MD5
7bbc95ac4f26ab3233ce522ab0009e63

SHA1
91b7da2a2d7c24e84d00d31662cab2769bd5eb0c

SHA256
8a4349100f493130baf78e50b2a8ce8f017d3852d0fb0285fca7528420e75b04

SHA512
7f2dd221e2b4ebc5de9c34b55316da68bb33ade45dd6ef3ff21dedfe52496fdef50070c2df5bd7d5f897307a1776d32f8d024d45a2b7b8818c36df178fbe5319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
26KB

MD5
8748db66c79a47dccfe7ae05e4075a6a

SHA1
a42195a35f6e15ab7490b30e8618462f84576756

SHA256
e382e595641154381f0c21b0b76528c9f4451a47e9847685cac97d2ab31e5485

SHA512
512c77bcc63d835574d1595f43687d958d3b17b5ca07b847de37e40b6e33d28858424f1f758cd51b828227e47ec880b7f5de2fd814f0e58de9df6bf88ca09675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
440B

MD5
359bb5be8d337ccfa5cd746b25a25954

SHA1
d17eb7a59c860d7e589fc84abc12ccd8305c3b8b

SHA256
1379505798386518fab93ad977b532cbcc8267c069de8ac424bf13d7c5fd43bc

SHA512
9fd8789e71f69e27214bfabe4b1a45ac3ec6598715d22120cd5f413b37976dfa897e0afe4f7c1cc666ee2f173181e0dc01c65e905a0f92ab5af443f672221719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
13KB

MD5
08ddead4e64a718143ae59bc8b8e0469

SHA1
a1b6d7dad0b8f63ecee6497ddb2ae3610914a56a

SHA256
3a14ec6346511d542b522dd8993ae8bb160ab48c8e4467a5edb06a1b2b98238a

SHA512
054e629c4a6940f3075d5e7eff21e91869c0467fbe170a4261a340a07c6ea9d204d1ee9953146b47b6fb861bf284a9022d8bf5230f3159df265ae4c956cefe24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
9KB

MD5
9c09a04a847cc7a2b20af6f798568b0d

SHA1
339c4a7e3d8fe4b150eabc1389312a9578ec9062

SHA256
1888469124e455c830e577f915540efe1039a3e026be38de9e36c06762718fde

SHA512
eda37e34b97b12ca332d88b5845bc96b2821034e4a1213a6bd3a5ce7ccddffcdc55c488b34235c2e9eed635c05075fe385fe6fef08b1e9353e13303cf4aac8f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
11KB

MD5
bc4c01acd76999c9f840ecae74e0ef0b

SHA1
2889e8414d051d486fef4fb110051a17acdb123a

SHA256
f4e9979a6c861d33aeb1006db324c462fc6a0d0b5cf6d368203241edd8adb4ee

SHA512
adcce0ec3cc8dd120b7954749b6642e46f7bee80718f185fce82008b295b51971531120e787d4bf1352d392b1b7ab4a4b1ef90c218535035ff439a9eb46df082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
11KB

MD5
b3c21b1457eb0cffd77004997b7e19d4

SHA1
4801c1c60fced5e23802091dc8d96d9534e61538

SHA256
2fe353443d92503060906fdd7461a3061362ab3869e7df5b92aaa4fd74c4057e

SHA512
084f57c8135481283e81b955beded96696afa68debe3355405f0fcd188d498f5f2a5950239b4b89300c23cbddab24a07e126bcc6604ad3e892810565262788f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
26KB

MD5
01f773102959eccc4712d88401660e60

SHA1
864ee369be1a9474118df94e51f826998290d2cb

SHA256
fe0d2dd465d403431c02ccdc86816e6b654d0526b532a8b54d4951670fe64a7b

SHA512
6cc9d0745112b9cd1b61a60ad7553e82840abafb1266ddce0154c8d6e763bc5e08637a6e40502f36ff582c5e9493ace2a3bca87498d71f8b0429d8aefcf8883f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
9KB

MD5
934c9505386e5dc11b96c2725efdbe56

SHA1
d2bc2afcb22e7d0df1582536003fe7534a9a887b

SHA256
41574e767287acc0532976dbe9979b93d22fca5e2876d855f99b59e434a65f9e

SHA512
7d298952ea4cff8f15d429a4a3686eee844e2650ae8ad4e9373f4a98e05737276e2df0132edc3a273f81f99c28c50f85815c93a9b4a3d27ec935322031ed00ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
11KB

MD5
d4c036255ce67a313be4e78a08a13d50

SHA1
6d3685ef489a007b1dfd7c4fdfacd43d58e925cd

SHA256
671e06949baacae80f1a6e74cd1206bf3db30954e7af515cfd0e17890218851f

SHA512
e11bae3332733b2bd3cc641d43310b20d2f4bcf683261ef9c912873ed6b874fade841fbcbddb9590c0e2a867417e3523622f277184223bcf9bbda2010938dff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
11KB

MD5
26cf6ab2a73fd731ae2c9a3532b9d53b

SHA1
7d7db48348593f32253a2c507b5e624ddd45abbd

SHA256
0feb47fae61a9472fae0c7e86432c08e7de00ba3b02073f5eab55db7a4bae096

SHA512
2bf9e19763ac8d3de13f0414658cd59a0659b4871ff07d5b8798656e5cdc5b93cfb41bc3d52a740db2abecca0d635a60ebbcc4bac4ace099445a006b4d178f86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
11KB

MD5
d8621b3d02fe54efeef7e2742e5730df

SHA1
d51d2dd8210da4f34b67bd2a0e100c3e67a5b98a

SHA256
1e70cc51170eb8aba1bebb41f3c34337332d1b7bf31f095369c5f6df10bc0782

SHA512
e3dabce92122578c6b8af8ed4d7104479223f42aaa8c3b4201a9e939faf338a216e005a067b1be301e0fe636d6d4b73d66c676fd689f60dfabbde89b7c5111fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
11KB

MD5
2394717e2c7b6880fae91c5070c1a837

SHA1
b2577cb457546fae86d8155ec8628ce19a88dba4

SHA256
71a070c45e6c42315f9729080257f6740fb1fc9fb391d32303164cc327252759

SHA512
8221b2c10570cf5aa638cb5ca02091fcdfcbdb2d3e51a003f610a7068f54b4d5f58dfc055107781295a929450634d57f10fca21b909147802c4498149d1d069c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
229B

MD5
ac457fd96e2a1587cccaf64f59005df6

SHA1
5df07126b82598af738ca59df25d90f55f2eaec1

SHA256
f3097ac618aeea3c93c12f94e334bd7e4d9e238e03fc7369df0d334789f1d244

SHA512
7f0a73146c06375c7269a86d218a9f9c782cc5aa391c263ae74668b8dec0629c8c6ea6db888b1b3082d27f7f4acf4bf5a616905e8a8b7a0ccdd5bf7f9f371272

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
2KB

MD5
3254aa3a3e8b3d756cb4076bdc56d5bd

SHA1
30f0d3ea10fe4debc7ca8f2ad196ef7760a4014d

SHA256
b4b974dbf1263d030ec30435d7c29ac2120ef06c24f7d7a0e1945bae369ef0fe

SHA512
c5459708b95ef778552692f1a047d4e39c4e9dc122ecacf199802b1ba640bcef670a6fa01a9e82f6313f73a408630a0d51c22d9e1c81a49e5e80a59c44821c85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
578B

MD5
ebff1f948f5609c9807de6d858dde7a9

SHA1
29fba68c6896d456633d0ed7a0291c4f16c5a248

SHA256
918c3d8afe8b1be8cb7a6dd63cb6af79fab6bb26292dbb9e39f6b49afd55fcfe

SHA512
5edd53ee7d8364fdfce92f5a2f112006a2ca4c940a8590236190ce0838502dcc37835ed27969818c9cd797d394f3ab4491aa340434e5a8a22c08a2527c5cecd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
2KB

MD5
cf0c24f8fe48fcc92f468b130c645bec

SHA1
edbe018f1960ac8b62d3517555cd41f5c424d53d

SHA256
8d735c6260a534bf763465c4a2bc7b0a2dc388be9b9edda375fa87e48e603851

SHA512
8417bda5ddcc2506fd8f9dfcef5c6acd8738330e4faa5f190639ff9c048e3c390d11a8ee2640513d824b360c482776166392dc372efcdb6d6b9e6100c9573836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
2KB

MD5
3a8a23b7866737e3a520955b2173701b

SHA1
b0b7439fe1cbf3df57d0ba7ac3bf10af24ee9d8e

SHA256
f5cac00e79b9ea3c28f42e9e62f799252a2467329efc1a0c009ffaee2ca26782

SHA512
eccdffb1d60c066dd15ce069f1229416cf24d142879280742b700d938b24101dbc6b4fa5b8c8a2a83f742951bf4b102ba91a6a242064a49e2cecd04777ee24c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
16KB

MD5
6275f235c292e9ed895a314430b944f0

SHA1
5d5b851aa53bce64a8d8d193f1871579d7a39fef

SHA256
ce7664405ec5acbb175ff0bb1e0ed2681e51655a1c96af0941be0a42799ac0cc

SHA512
51bd3e41cfd496923cb6d9044607ccd58eed43812d0b8fe1ee929d34c5da34b9fa49083a2210a50cfdd53f70e09004f34ac0a21525399371af6770e126fdcac8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
2KB

MD5
786924a466fba1d494dc65f22e62467c

SHA1
76d41fc1bee41ca93f34b3c793ed21cb054073e3

SHA256
df0cd18ad4ead0524d9e9a303f38d03025e87e9b545aabfb596ae87514a3da8a

SHA512
e5367b907a2bd4d3c23d17c3c9744e6e9c15887d535f38ff1ae62894f89109a57ba1a70bc1d30fa7b8b0fa9a71330f95895fe9b581834720888a87a9f5ea50db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
2KB

MD5
931f9fa697dc5aae5c51a51a8ac3f5f3

SHA1
f5b02d49a48ea172d59ad267125d2188f89fd1a4

SHA256
b909693a1a48667563ad03d1454338f82c8986be045a98129715e6f96f4c7a3d

SHA512
fded6595e55517cf729be5e1411bbe1c660159557dfa438452e869a9317392bd49914d32008fec22dde559675db62e78c5c9843cfd833823128d3b8d1d398747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
2KB

MD5
1055cd762417e7a20ba4cfa2a10ee954

SHA1
56f2bfe46062d3e3808f3fdfb7d37aa07499bd16

SHA256
730845e016264be2f9c253a5f6a77aaa0f9b616bb9190a525e65eb1c8836a3b4

SHA512
95a84c5c907709d72ed38d48e4d6e6b5729b1f55ad2f4bc94c6847a44efe411534074a09ad7b94f4eb42847de8278b57565b860c406229e845091400c94e2687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
3KB

MD5
b41021daf8619442db3ddcbce2e6860d

SHA1
a949c5cabc468fd3714bcf577d16b649ed5acdac

SHA256
3bf772fbdd7c06045a0e25091b30e1d1741d264683f6162b2d6224d58e2577c2

SHA512
970ad163fe2639087ff8eacdc00d84481318e0c1316b3f00bbaa5ec0a99226a1865be62051ff4ad2165b592733673e6ca90d4770e675c06b00d5ecbd9d6a479f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
2KB

MD5
e347fe57f167452dde41b29d9091cdf4

SHA1
c5e54d4716cf1671faa1cda2d3f774d0ddf9b0f9

SHA256
1f8bf416f4e983e92fcc73e1d94ca8376420053e05987bcabef346f1cec564ef

SHA512
c45c5cd18a9b8a38b9a4fbdcfa8afcbfa1816e2d573753f92dfd077a980e5e02874d11ca79bd6d066c5276b47b6debc620aac4dcf54191d331a67176f3c7c9a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
4KB

MD5
cb1532ba120536097bd83add92e58ed8

SHA1
6a2596a874f7d034bf92c474b36af165328a3532

SHA256
1b1821bead663468126a9584f278bccff4a3ef686691e7e77b6e79d093a9d3f9

SHA512
c50fd898946cb3475ed237c0e018c2fed95a9833669856a7aff95cb128b9a22e0e874de10158ea8d6d7af7056f4fb2738e60a718d2cf53a4a36f3b8c05675276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
18KB

MD5
817d357a61217aed2b48381d6cf1415b

SHA1
0819feb8db1e1d1eb8107b12b16cf93c8e85a737

SHA256
b421c9cb001fb35cd5124ae59ba3d3cb6a69dbbe4b4acaed1d150fac9435ffcd

SHA512
5259a94203f21fe2e0a5de5365a4a7d889a20e9e6c5bdd0dd76aeb94092534a87d091f5ddabfffe396d93281bb07499b3cedb7359e5f328126608c86302629d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
5KB

MD5
9557d7b4d82a9eb836348774ed1c431a

SHA1
ee977323e7979d92675c88e0a1ea77e5d9b7da92

SHA256
4a9be74c581ca7b3f567f9916450c524367d7224f0b354b1c8fbf0a2e6ae1cbb

SHA512
4e1918022ff0c62ec6acba17ef9b20228355990ea1cb1c8a9c4d6fdb9c8d6fea626748f0d4042a1515535c61d3777a50f8b2c6706e70dcd2b351459abcbff95b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
5KB

MD5
76e9226fcd3b45807bb2a40b42659daa

SHA1
e100aaeb205ee0f15660c97ad7cea76ba8ea33e9

SHA256
da50f61e2320868889757402cf10ef7de42ff6d13a03de821a83341ec53970a3

SHA512
f1000e2d91ea7ca958463b83eedb036aed28a7e0a62652c24e17fa2be91368f67a19ed34b7a7024592d96fc112ddfaa54c64e8c2182ecb20ea7c516800f7cf16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YIX4TL2M\www.youtube[1].xml

Filesize
5KB

MD5
630ea31936bda4e23c4e049c3421087d

SHA1
be56241177e0925ac6c12c0b94e4a8b6b1765968

SHA256
183a978b2199108b768b5f5c9e97d676a70de75ee72153b09b85555ed8f5b2c4

SHA512
37f86a7ddefce59b63cf29b658c565a8077d18022a0957855a4d8b9f1379745567f16972751c75d954d7515c8ccf8d50bc9ca20507531fdc0bd8f3d598586327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xml

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6809OHQ0\KFOlCnqEu92Fr1MmEU9fBBc9[1].ttf

Filesize
34KB

MD5
4d88404f733741eaacfda2e318840a98

SHA1
49e0f3d32666ac36205f84ac7457030ca0a9d95f

SHA256
b464107219af95400af44c949574d9617de760e100712d4dec8f51a76c50dda1

SHA512
2e5d3280d5f7e70ca3ea29e7c01f47feb57fe93fc55fd0ea63641e99e5d699bb4b1f1f686da25c91ba4f64833f9946070f7546558cbd68249b0d853949ff85c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6809OHQ0\MXo8Lho5[1].json

Filesize
43B

MD5
70e8813660407811c62eba5acca1f1ad

SHA1
e93c5488b0a718254320e33561a30a45f00472d2

SHA256
54721369b6cd68e91c6b07a6f6737fa8458103ebb911647a7cd52475ab35ca56

SHA512
10830df949aee4f742cde8ebf80d3ec963c0e9af2c764edf383e4d5a09ba7b127daab533f4ca0a9884e74df6dda61e4ad64f9c22648377923995d6e3d03ea739

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6809OHQ0\ad_status[1].js

Filesize
29B

MD5
1fa71744db23d0f8df9cce6719defcb7

SHA1
e4be9b7136697942a036f97cf26ebaf703ad2067

SHA256
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

SHA512
17fa262901b608368eb4b70910da67e1f11b9cfb2c9dc81844f55bee1db3ec11f704d81ab20f2dda973378f9c0df56eaad8111f34b92e4161a4d194ba902f82f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6809OHQ0\d[1]

Filesize
23KB

MD5
ef76c804c0bc0cb9a96e9b3200b50da5

SHA1
efadb4f24bc5ba2d66c9bf4d76ef71b1b0fde954

SHA256
30024e76936a08c73e918f80e327fff82ee1bd1a25f31f9fce88b4b4d546055d

SHA512
735b6470e4639e2d13d6b8247e948dbd6082650902a9441b439ceacc4dfce12cd6c9840ee4c4dcb8a8f1e22adb80968f63ace0c0051811a8d6d1afb2b3c68d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6809OHQ0\embed[1].js

Filesize
66KB

MD5
4ae1c04c90e47ef7818562df016dabf0

SHA1
3340f5e33ba006c57fe961e37c31238cf6511cb3

SHA256
cbdbe5e22854f23589e97ff81605befc8e9148cf1facf51e0aa0a57ff090aba7

SHA512
6b9153ddb1a35c0ed58133666260f15c346872d85b00cd6d4d806d7dab079ad2db83b10921f294459e293ae093d4a9b175d7077a4457fb0013c350099f66fe08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6809OHQ0\hd-header-logo-2c[1].svg

Filesize
3KB

MD5
fa6d73cc465daa5f584857aa004f4729

SHA1
952d364499d87d7bea937c15ccaca7eb8a75579d

SHA256
af0f4612dcae6b4292585288e5507f20bf891a710ba8490aaf8e4906307217e9

SHA512
4ff491c7449383da9f3855109a562bf72f569c820696437af5b29c110aa6fed6948d7af62c3ef7a6a548411b1346961d2a604c104955c115b75b715fef44fa32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6809OHQ0\main[1].js

Filesize
7KB

MD5
2ca2811c6f0cdf1e083e03faac2bedc8

SHA1
b24ec2a3d39c221316662a698c240458d461a8cd

SHA256
a398bd5097e025b3588344fb0254bc527956cc2e8ec45b7981da9742ffb80a6f

SHA512
bb9c167b14a3cb94557df2316e3b60f59fbb0c74ddf623832cea2d25631a8140153d269c100bc7a4e995d16cb6932cedf4b45e4c0dbd705ae234ea735223df82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6809OHQ0\responsive[1].css

Filesize
66KB

MD5
4998fe22f90eacce5aa2ec3b3b37bd81

SHA1
f871e53836d5049ef2dafa26c3e20acab38a9155

SHA256
93fcbfca018780a8af6e48a2c4cd6f7ad314730440236c787d581e2cef1ab8f8

SHA512
822158dac2694341f6cf5c8f14f017ac877c00143194d3cd0a67ffd4d97f9bf8f2305e33b99fa12f62eee53ba18029541c0601ea5496ff50279d1200cfa03232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6809OHQ0\revisit[1].svg

Filesize
2KB

MD5
71c20bb07e1387c0fecd7a521af9803d

SHA1
470d91c6500d67e26f2ef4e4d0699ea1b2c8fc03

SHA256
ed7c487f915432d9464e2af0a83002ee93596e86e076f3c917e439e5b844d08b

SHA512
fee5058dae5f928037bec9efec25d8b2c06bda85a31bd99a6df954a75b3a08446158e1441bd3fbf37f40a6efc6cabe4e5037444fd61feea3055d5b19025cd557

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6809OHQ0\script[1].js

Filesize
96KB

MD5
28becf0e5ce8d65f6f9e33e5954a1a79

SHA1
69d67a8f41d803b62218f02a28ebaf53f32e072e

SHA256
c59fa2847d6798cd7b5ebbd9b7832eb95e6b8aeffff195d3312ac7094049ac50

SHA512
3d6734183f99b73e5bf6097f2f388ca83ca7d20a849b77c871e28c2cd3e65d9fc0a020fbd349b08bbd916493089396386623d695af964a6a1f273429cca1ad6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8M42AOWL\HdGEFunN[1].json

Filesize
31KB

MD5
7263bfc8e52dcaaac923b5b3c32be39a

SHA1
7da4cf3fb56aa484da8c2d31821425a211b14380

SHA256
e3613416227942d575ba6762ee7882d0da8be76f58f37f200215d0a5bd025afb

SHA512
8e803c353fcb03be2b6826ea1f15f4e7aa90e251bbe10b4c481030bbb844c05d06c1661e65c68f693812c62e56246dd9f8e1b81b587dd4c08f3d8765f8476765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8M42AOWL\close[1].svg

Filesize
1KB

MD5
463a29230026f25d47804e96c507f787

SHA1
f50e0eac87bb8f5cff8f7d8ccb5d72aedda7e78d

SHA256
a049e1abe441835a2bcf35258936072189a0a52d0000c4ed2094e59d2afd189b

SHA512
83f065b7b10e906ef8bf40dd907da4f0eb0f4c28ee2d8b44e418b15f1c06884a579957b2bc27418fac5759825d394819ff0ac48d784b9f05564b8edab25d9426

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8M42AOWL\common[1].js

Filesize
8KB

MD5
56b21f24437bfc88afae189f4c9a40ff

SHA1
a9d3acad3d4c35da454e4a654bdd38f8d2c4e9d0

SHA256
cfece1b609f896c5cd5e6dbe86be3ba30a444426a139aec7490305ebf4753ed4

SHA512
53d4718e60a47526be027c7829f9ad48f381e22765790f20db35ff646bd994f8085b12b8fbeefd5b29ecda8f71f4c6c62b64652bc9a7256e001b5e4047c21651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8M42AOWL\hd-header-logo-v3[1].svg

Filesize
3KB

MD5
d4e44251f8e9314a0dec5eddd6b1c64e

SHA1
1c6a1a884585b80b3b623c92164b9d8742e5fc1b

SHA256
097a98eccd043b5df15a66409d32ef16f7570776625d0e0b4d1054be26a31a00

SHA512
1aa924657ab4043a27523e8cc1673314a037b063f8b6f530d5661917d30b893744d90223e5df38f2c97bf2ebb1e82ec21f91720dc27918ff853277ad5023612e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8M42AOWL\hd-style[1].css

Filesize
41KB

MD5
2ea4a69df5283a1cfd0a1160203ebfe8

SHA1
1c454fb9cac7ac0b1f65cd5c93bc2c9a0da8479a

SHA256
908a427dd11cc624f78bf96e4f775ba708e1bb1fbaaa8566977f3ec54416126b

SHA512
197333dc17a36ff127e6e001a898583322ad7ffa76e24003378f462b041e215194a2529eedd5f93e7e35a0e21dcd88db49c5afd18a0f7cff4cb00f50700c884d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8M42AOWL\jquery.fancybox.min[1].css

Filesize
12KB

MD5
a2d42584292f64c5827e8b67b1b38726

SHA1
1be9b79be02a1cfc5d96c4a5e0feb8f472babd95

SHA256
5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0

SHA512
1fd8eb6628a8a5476c2e983de00df7dc47ee9a0501a4ef4c75bc52b5d7884e8f8a10831a35f1cdbf0ca38c325bf8444f6914ba0e9c9194a6ef3d46ac348b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8M42AOWL\jquery.min[1].js

Filesize
84KB

MD5
c9f5aeeca3ad37bf2aa006139b935f0a

SHA1
1055018c28ab41087ef9ccefe411606893dabea2

SHA256
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

SHA512
dcff2b5c2b8625d3593a7531ff4ddcd633939cc9f7acfeb79c18a9e6038fdaa99487960075502f159d44f902d965b0b5aed32b41bfa66a1dc07d85b5d5152b58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8M42AOWL\o-0mIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjcz6L1SoM-jCpoiyAaBO9a6VQ[1].woff

Filesize
16KB

MD5
adda182c554df680e53ea425e49cdf0d

SHA1
9bcac358bdab12b66d8f6c2b3a55d318abe8e3ae

SHA256
d653648b9d6467b7729f0cea0c02e4e9f47323c92a9fcdbcb12475c95ac024df

SHA512
7de2140ee3859b04c59a9473129c3acad91022962d46ffc63529bff278661f0e106a16dde90e8db523f826f82e7c20ad9b23f45a25e81932fd2d8708b616fba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8M42AOWL\o-0mIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjcz6L1SoM-jCpoiyD9A-9a6VQ[1].woff

Filesize
16KB

MD5
642d45886c2e7112f37bd5c1b320bab1

SHA1
f4af9715c8bdbad8344db3b9184640c36ce52fa3

SHA256
5ac87e4cb313416a44152e9a8340cb374877bb5cb0028837178e542c03008055

SHA512
acda4fedd74f98bcee7cf0b58e7208bdb6c799d05fa43b3fb1cd472e22626322f149d690fe5f2cdc8953244f2899bebe55513b6f766a1f4511d213985a660c3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8M42AOWL\otHsKJfjPd3_2FAmxNFjsC1JH5zSbWQCFckcgLAtX70[1].js

Filesize
54KB

MD5
c115ed636118266f89521262fc193888

SHA1
96f27b7dec4c78194310f36f2be3d3e76cf80d97

SHA256
a2d1ec2897e33dddffd85026c4d163b02d491f9cd26d640215c91c80b02d5fbd

SHA512
c6fd85e3328c57e88f826ff689b0f22ce1f010428867bb255980db84374c11e3ea918b6f646a3c08cbc9e5e396a2667c73e37c75c185650cf4f151f8c6c3a643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8M42AOWL\recaptcha__en[1].js

Filesize
531KB

MD5
1d96c92a257d170cba9e96057042088e

SHA1
70c323e5d1fc37d0839b3643c0b3825b1fc554f1

SHA256
e96a5e1e04ee3d7ffd8118f853ec2c0bcbf73b571cfa1c710238557baf5dd896

SHA512
a0fe722f29a7794398b315d9b6bec9e19fc478d54f53a2c14dd0d02e6071d6024d55e62bc7cf8543f2267fb96c352917ef4a2fdc5286f7997c8a5dc97519ee99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8M42AOWL\script[1].js

Filesize
9KB

MD5
defee0a43f53c0bd24b5420db2325418

SHA1
55e3fdbced6fb04f1a2a664209f6117110b206f3

SHA256
c1f8e55b298dc653477b557d4d9ef04951b3b8ba8362a836c54e2db10cda4d09

SHA512
33d1a6753a32ec06dcfc07637e9654af9321fe9fa2590efc70893eb58c8603505f2be69084fb2bcbf929218c4e7df9f7a8bc3f17a5b41ed38c4d8645296ebab5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8M42AOWL\style[1].css

Filesize
165KB

MD5
65760e3b3b198746b7e73e4de28efea1

SHA1
1d1a2cce09b28cffc89378b0a60cbb1aa8a08c4f

SHA256
10e40ea3a2ad69c08d13e194cf13eb4a28a093c939758a17a6a775ef603ac4fc

SHA512
fbcb91f26b7bd874d6a6a3b1d4d6f7277ded091cdae5706c285b4d5d17446a1bf58572c224af38393ce49b310a51d5c5d60711c7094e5d32abbaaf10d1107e1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8M42AOWL\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8M42AOWL\unnamed[1].jpg

Filesize
1KB

MD5
9562333de0510b42f9cf9f316967d903

SHA1
cf044643a23946f7a1b63e4c5a506ac99a90a66c

SHA256
7c71aeb28c43250d69e9d02571ce233ed30791bb4e1a391eb8c70f84f8e36d08

SHA512
edb342fa84c8a27cb22554b97dd4b2567bd13d5f40f687139848de21f52116be301f75e695637dbda385f6dc979bdd901456f4b0c324ae83b105e4d34b3162c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8M42AOWL\zyw6mds[1].css

Filesize
1KB

MD5
a5bb75d5bd1b19def25c1dd4f3d4e09c

SHA1
d0c1457e8f357c964b9d4b6c0788e89717fe651f

SHA256
ff0689879c72300a01eae0c05c3205e2ca57c4bc1a6bfa0718fa6fea4a51627e

SHA512
b9fc57f7ade8f34cb02ece2935acb30757ed846e4bcf81d3fcf5bfcb45611d386bd337a6337e9945c5654cf044dce4dd3fafd60a2b42ed5bdc857ef96d077a69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NUB8HZ4Z\KFOmCnqEu92Fr1Mu4mxP[1].ttf

Filesize
34KB

MD5
372d0cc3288fe8e97df49742baefce90

SHA1
754d9eaa4a009c42e8d6d40c632a1dad6d44ec21

SHA256
466989fd178ca6ed13641893b7003e5d6ec36e42c2a816dee71f87b775ea097f

SHA512
8447bc59795b16877974cd77c52729f6ff08a1e741f68ff445c087ecc09c8c4822b83e8907d156a00be81cb2c0259081926e758c12b3aea023ac574e4a6c9885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NUB8HZ4Z\Prnwzcj3[1].json

Filesize
5KB

MD5
97251dedbfd112d65e103edc1ae5a7a7

SHA1
bc09e25832a266bd15f20b94684594adbf4793de

SHA256
e2f0ef97b6eca62245eaf2621087c243219c6c8fb00d82b272302aded86e64fc

SHA512
51be8f46544a3bedc804524cff7a83ce8837d61781ee21f5bfa5a10f4fdf6e389bd2776bb847601c0e862d39fbe8394168c22a61d4da232171fdd27045a2437a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NUB8HZ4Z\css[1].css

Filesize
530B

MD5
1e7cca7a1b89ea2980669f4adb65becd

SHA1
62da7767f3bb769a9b31e400df446a4698e4db63

SHA256
598ad75d6e2e244b759b3f376b510f0ba560b77cc74f48351dcf2abdb7df474f

SHA512
206b90eab94f9ce7260ec624ec9a8afd70bba96d4dc5d8a545a29cd73e55832196e509523da1123c2279eb4cb63fef429e28a3438a268dd3fabd1fd949caf1c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NUB8HZ4Z\domain_profile[1].htm

Filesize
6KB

MD5
bad34787d04e1a8fb7695d80aa55f7e6

SHA1
e373e7e86a001dbbd7d0ce6d64e2b141471c082a

SHA256
53b23e4d63b5c57cc56cc137200f578036c8d8f9c99b62fef3828ff60557141c

SHA512
08656af130591e9a28cab3a1dfff541d04825edaa5b554da38c300f25dacea510fca4f8b6e620d77b3522c6a013e38465b9c2d1fea4e6de16134dab9906ac7b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NUB8HZ4Z\domain_profile[1].htm

Filesize
41KB

MD5
acbef3c1e7d346dcfa1b4910da83dd39

SHA1
4fe80ef0473ac86816f0fe8d30127d8492d8a9d7

SHA256
1a112cd9b3477fa66f9d3f8c00a4b28dcdf36ed1481266d32e90348bfee34e9f

SHA512
1205adc5ebe7738f782b08916710aa1d2eb7f07bda7879687f0cbf7425c76a25ce4cfb49d04c2e27fbd569c520dff4ba727b41ab5bb58dbb2e5f138d5a1e8c78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NUB8HZ4Z\enterprise[1].js

Filesize
1KB

MD5
e5012de816bdbf1ec54255fb1ee90eef

SHA1
91ecd8249332432fddc2d629e44204864f7a3686

SHA256
2b8d4c3232dc1f2c7ff8e1f3e339a9c2a08dcac6f19a11219f424616b83eda7c

SHA512
79ead22917ad07dcb99f870becb07a3eff423621c6fdc5751d1081185b22ef2d1946a66f80b9456117eb249513ffaeefb606978586b92a553bc15a68e59d0aa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NUB8HZ4Z\hd-js[1].js

Filesize
23KB

MD5
6761faa022e0371e84e74a5916ebaa44

SHA1
5320c3d53d5447bad2a02c63208deca7fb94b655

SHA256
da17fb5b54c0fcd77c7358ff274823cb6a02ba0c4b6fcdf347c1ef611818bd9e

SHA512
a8cdba92942f299b648e87109d193a1f7eeb8f243eb2bbe4224423b512c400fccf930d81cd403a925fdf99220fdffcf89da69305cdc054963a64da470072d019

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NUB8HZ4Z\hd-style-print[1].css

Filesize
1KB

MD5
7878fda89f8e725fa06880d1890f9c00

SHA1
3f8e8aa44d26d3cff13159830cf50aa651299043

SHA256
6d17b244f2b4b8a93886dbe5cffad1cbe8fc9079495fb972a10fac1eda0a16ce

SHA512
392d457f4c54088abef2b4deeb042220ab318d00d1157fc27386a5faac821c70c78c8452c99bc75758fa36643932938274c171589307919ec01e293010ea35fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NUB8HZ4Z\p[1].css

Filesize
5B

MD5
83d24d4b43cc7eef2b61e66c95f3d158

SHA1
f0cafc285ee23bb6c28c5166f305493c4331c84d

SHA256
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

SHA512
e6e84563d3a55767f8e5f36c4e217a0768120d6e15ce4d01aa63d36af7ec8d20b600ce96dcc56de91ec7e55e83a8267baddd68b61447069b82abdb2e92c6acb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NUB8HZ4Z\reboot.min[1].css

Filesize
3KB

MD5
51b8b71098eeed2c55a4534e48579a16

SHA1
2ec1922d2bfaf67bf3ffabe43a11e3bf481dc5d7

SHA256
bd78e3bcc569d029e7c709144e4038dede4d92a143e77bc46e4f15913769758b

SHA512
2597223e603e095bf405998aacd8585f85e66de8d992a9078951dd85f462217305e215b4828188bf7840368d8116ed8fb5d95f3bfab00240b4a8ddab71ac760d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NUB8HZ4Z\sddefault[1].jpg

Filesize
22KB

MD5
aa005bab01a96cc8ada465b145645867

SHA1
3f34e409c60819b76eb988076545b69d0c3d7273

SHA256
e80a2f33030dbe31f5f1e8be2c38e0ed8cf1b97c657dc08f16f48424a19f6fe9

SHA512
4d2e0103ca3472107fe20e797d916963df98a0e8ab3d30bcfaa97f231ad43daa58f8c6155884a4191bcd1d81a2654bf282aaffbcf72d3596f617cceb2a5ccaa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NUB8HZ4Z\styles__ltr[1].css

Filesize
55KB

MD5
4adccf70587477c74e2fcd636e4ec895

SHA1
af63034901c98e2d93faa7737f9c8f52e302d88b

SHA256
0e04cd9eec042868e190cbdabf2f8f0c7172dcc54ab87eb616eca14258307b4d

SHA512
d3f071c0a0aa7f2d3b8e584c67d4a1adf1a9a99595cffc204bf43b99f5b19c4b98cec8b31e65a46c01509fc7af8787bd7839299a683d028e388fdc4ded678cb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NUB8HZ4Z\webworker[1].js

Filesize
102B

MD5
cfb75de5b30bf427c44f5a02e8616345

SHA1
25ced704596e89f7a2e50227129d71b0e9bd5da2

SHA256
82d3b76db4d62ac71bfd0abd0528fc3a03a8dc2ce3c65eb90ca4a3b0181122ec

SHA512
8327c6e09830f0c3526c439dbe2213bfae5de2485575ca8b74fa83fcc2d3b1f824a94ef324511c16e8aa2d35a8655da0d5792eff46b9e37ca3202db175802be4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NUB8HZ4Z\www-embed-player[1].js

Filesize
328KB

MD5
c413b3281a67dc8e7ae2790c09d995b4

SHA1
5b9d4818a40b3d05d18a2f2764c4aa71187e4350

SHA256
c2d2926c64e4bee9ea3b14e2b94ea124daddd0422cfc00e2f43e636a0884c5b3

SHA512
6842b997141e6e97ef3c83b2d72f8a4a4be775a3128186064f2176d569a1dcbfed651b7f32fcfc9618571e89d330d97be9af4d669b5f9a33407b584a466e39a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NUB8HZ4Z\www-player[1].css

Filesize
376KB

MD5
f18c457e9084f86ef43c2efbdede8891

SHA1
7449eae7060ca1246651a86d7c5b2f34c1205086

SHA256
bce04b253bdde030d0b43e084a11f694604bd4528c5b81209df71b1a9daa450b

SHA512
31742ec3abb2362ecda4a38c0da10a410db5df0596e5d916f6ed46df4bf997f013773998af54c7f28e592974dc8a53316b95c7cb574006f3220ea4135e19622a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKVWVXN7\KFOlCnqEu92Fr1MmEU9fBBc-[1].woff

Filesize
19KB

MD5
de8b7431b74642e830af4d4f4b513ec9

SHA1
f549f1fe8a0b86ef3fbdcb8d508440aff84c385c

SHA256
3bfe46bb1ca35b205306c5ec664e99e4a816f48a417b6b42e77a1f43f0bc4e7a

SHA512
57d3d4de3816307ed954b796c13bfa34af22a46a2fea310df90e966301350ae8adac62bcd2abf7d7768e6bdcbb3dfc5069378a728436173d07abfa483c1025ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKVWVXN7\KFOlCnqEu92Fr1MmYUtfBBc9[1].ttf

Filesize
34KB

MD5
4d99b85fa964307056c1410f78f51439

SHA1
f8e30a1a61011f1ee42435d7e18ba7e21d4ee894

SHA256
01027695832f4a3850663c9e798eb03eadfd1462d0b76e7c5ac6465d2d77dbd0

SHA512
13d93544b16453fe9ac9fc025c3d4320c1c83a2eca4cd01132ce5c68b12e150bc7d96341f10cbaa2777526cf72b2ca0cd64458b3df1875a184bbb907c5e3d731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKVWVXN7\KFOmCnqEu92Fr1Mu4mxM[1].woff

Filesize
19KB

MD5
bafb105baeb22d965c70fe52ba6b49d9

SHA1
934014cc9bbe5883542be756b3146c05844b254f

SHA256
1570f866bf6eae82041e407280894a86ad2b8b275e01908ae156914dc693a4ed

SHA512
85a91773b0283e3b2400c773527542228478cc1b9e8ad8ea62435d705e98702a40bedf26cb5b0900dd8fecc79f802b8c1839184e787d9416886dbc73dff22a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKVWVXN7\YrhSEqBigngBm13P72zv5BqzMvKqyJnkT3jMiVTjS9g[1].js

Filesize
24KB

MD5
31515f0619dac58993216970a715b49a

SHA1
9a09dd56e972cbaea27a96528516a82b83128ae5

SHA256
62b85212a0628278019b5dcfef6cefe41ab332f2aac899e44f78cc8954e34bd8

SHA512
94b7353315cc5b0ceeb9dacaa04679e77608c1c481c8bcc42c5fcbeba2d072557a9ed553d407434fe9b51b1a6716c5227fb9e9601036bb9fbed3cced5f0686b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKVWVXN7\api[1].js

Filesize
870B

MD5
aa2728d09997079c4292657aabe3e50f

SHA1
12deb1b28ea79952fb582cb6840e5e53e3d01667

SHA256
1bd9d97ca6363b413d3721647ec0cb1cf6d0639221e47c91b62ce31b63862d50

SHA512
4d758d4197335f8d703a69802180adf7d75e3cfd6446301597736875dcabdde0a15ebaa4f177a39ea22f8082e1ec3bd705b66c7563be0c5b41b59f7225d8a3d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKVWVXN7\banner[1].js

Filesize
99KB

MD5
6b1506e94ef140bcda65924f33eb2d4d

SHA1
e9ad74fb7d2a1b761b992bc58cfd4d46a26db690

SHA256
ef8916e10719b5acae506568cf90b13afa248522bee92df20056935ad553ae8d

SHA512
ba9552eeb78a57aec1a62616a0326cd8746d5e1e29c2a5730e6081839118126cded62856755742d03cb752140ebfe1eb7d078427a2cf4a48fe83c8f63ba55c4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKVWVXN7\base[1].js

Filesize
2.3MB

MD5
e4a63293ee078b289b4981156ce276c1

SHA1
1337e7901a6c842f7924a6d0d2de7dac13b2658e

SHA256
878fefe3cdaddd2091aac6c036344402139bc01fcace36b2744178aef995240e

SHA512
8c52fc1664f524f1efa55af8f6d7a008005c65531575cd7cfc88bdff4c983117b2c65b5e7df9a7623c0b992c3d16034ead58021e109a73c17e408ab9ecad510d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKVWVXN7\cky-placeholder[1].svg

Filesize
826B

MD5
562ee65ece16ae115cf62b68220610c3

SHA1
e9121ff79ad28c34522657f3652578b80a943816

SHA256
f644815843a31ecb96ea8c3e85d3de355a8cd0a3d9a795075be056e6fbaca5e4

SHA512
7630d3603c8beaefc1be877922d0ef275690910492867e0c512112a3870ea3a26c4acc0b90a483e1cb1fbc9e0c6510b33800fe9af5e9fbaca980516a63a56dd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKVWVXN7\counter[1].js

Filesize
35KB

MD5
b5af8efecbad3bca820a36e59dde6817

SHA1
59995d077486017c84d475206eba1d5e909800b1

SHA256
a6b293451a19dfb0f68649e5ceabac93b2d4155e64fe7f3e3af21a19984e2368

SHA512
aac377f6094dc0411b8ef94a08174d12cbb25f6d6279e10ffb325d5215c40d7b61617186a03db7084d827e7310dc38e2bd8d67cf591e6fb0a46f8191d715de7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKVWVXN7\hd-js[1].js

Filesize
337B

MD5
62a779a47d0eb6ffe2d30d2382edef8e

SHA1
28a42e4831ce5bc64cc500cefa1fdadcdb6e4f68

SHA256
a420f0392e392e0c8c897c434ffd4929be48da23607d189ad1caed94f708c689

SHA512
1c0db6e76eef65bbc7684dadd47b62ba15009e51591c619ef651e8812bf95e653b81168c8461f15562a1f4f45c25752189fd0762678f4d63cfd4daac81f35acd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKVWVXN7\js[1].js

Filesize
212KB

MD5
cc25d8a47584175a38d2a9872320d67d

SHA1
3bb2ef6992ac549e8c25d090a08b3baf342b5b16

SHA256
18307977ed33bbc56e9fc41e937d998531cd0e4500cd75ab9fd85c55eaebff72

SHA512
eb09f1792389aee529afcad0b25447905d7530671fe0fe2d8617a9e9207e5ae0ca17e0bb7d9958792a2a93c87482a86bd00e44f1f18926026c91a2406dbff0d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKVWVXN7\nu-JYdgw[1].json

Filesize
1KB

MD5
22c967d69f0d5054cdf0c3725cb8b2cf

SHA1
5578de8e9b2adfedec93b3483096d6b39c400678

SHA256
de059be36fa3924307eead3cde43546467f695181804528945151ebe0e5a0c51

SHA512
d1cbc0ebb7a8e0c1337d4844fb717ff17f5e6d155b1c3e95c547e56d3c33de9470d0c2be99908d0adf2fff5e389f9742c8f445b76a5fe4f71a60f4626744bce3

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
865KB

MD5
ad999f2b63db4c871be322239547600c

SHA1
76d4b2d45aafc3471dbe56ac3ab1adaaa8b563bd

SHA256
e1fa0b0ad452c245b20ff059b9c80b780c1994b14fc9661d23da0310fda17364

SHA512
31d1929c27cd1d0168bb9ad0fd2842f2545ad1f4234debea99d015cee727e08c1dc95f0ecf7c1ac708328406abe364b78aa66f2febc4a7c38ea705aa27abc6af

Download Submit
memory/1940-37-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1940-13-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2748-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2748-15-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2748-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/4316-1262-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4316-1049-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4316-156-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4316-39-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4316-748-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4316-25-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4316-24-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4316-23-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4316-19-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4316-559-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4316-364-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4316-1715-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4316-1392-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download