4142bb6c07f4d2c83507fd59b5fc468d0e02159376e5add0d36eeeb29918032d

Analysis

max time kernel
143s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe
Size

811KB
MD5

eedaecf0ffea1c2a6c683181bb0983ec
SHA1

a588660bd3a3d0fb84b7dce66606fa90aa05b8b5
SHA256

4142bb6c07f4d2c83507fd59b5fc468d0e02159376e5add0d36eeeb29918032d
SHA512

265614ad915ce396bbad77e2d691bd5f18bbf4057601a356032c1f803d2cdc5582ca15a2e3b8ddf98b97c5faa1fa37ae42838d16f0b55eeb402d18f55be7a5bf
SSDEEP

3072:CYsgk+ruvdasTt9NHhayrHlbGAP1Qm02B545g4FuB3bBo6P6We0VyOjUout:Vr/oS

Score

10^/10

defense_evasion discovery evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 14 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-25932478"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-11090195"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-80167465"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-1810044"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naveng.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavsched.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtvscn95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vshwin32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmlisten.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killprocesssetup161.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\titaninxp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\serv95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guarddog.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapw32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavproxy.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectx.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tauscan.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\connectionmonitor.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\findviru.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npssvc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\routemon.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antigen.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bidserver.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctrl.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fnrb32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mwatch.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portdetective.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rescue32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\syshelp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsisetup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpcc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sharedaccess.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweep95.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonalarm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fact.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapw32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portmonitor.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atwatch.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxw.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bidef.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mghtml.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccclient.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardhlp.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirus.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\flowprotector.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfagent.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nai_vs_stat.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswinntse.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wimmun32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SrchSTS.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alogserv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpf.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msblast.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcontrol.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscanavshadow.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldscan.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fih32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sbserv.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEDFix.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwupd32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	winlogon.exe

Executes dropped EXE 2 IoCs

pid	Process
3060	winlogon.exe
2812	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
2080	eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe
2080	eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2812-78-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2812-75-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2812-71-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2812-74-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2812-138-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2812-254-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2812-1121-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2812-1510-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2812-2626-0x0000000000400000-0x000000000043F000-memory.dmp	upx

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\4505E42555D435A4 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\4505E42555D435A4 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Indicator Removal: Clear Persistence 1 TTPs 42 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OIS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINWORD.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOSYNC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOXMLED.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OUTLOOK.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANOST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WORDCONV .EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ACCICONS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLVIEW.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IE4UINIT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WXP.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANPST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPREVIEW.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DWTRIG20.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCEL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONELEV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DW20.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSACCESS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCELCNV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEXPLORE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\POWERPNT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSQRY32.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTEM.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CNFNOT32.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IELOWUTIL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOHTMED.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEUNATT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\INFOPATH.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORDB.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SELFCERT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXTEXPORT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GOOGLEUPDATE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETLANG.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSHTA.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSPUB.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GRAPH.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GROOVE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSFEEDSSYNC.EXE	winlogon.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3060 set thread context of 2812	3060	winlogon.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433045710"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://3qx9u8dv902dg9a.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://d7h79xd2axm4g8o.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "121"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://60915j2l94l0v8b.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "282"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "8537"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000ee95bb43b176260ffae8efe8c57d2300a769d1f74ceaf0f69aa1790f548357ee000000000e80000000020000200000006594fa15dbd613ea0443a46bd6d0362b812f2d7d628aec545725ac046b827415200000008ccc4afd5d40c757129b462679ee33af0efdf75c162b2102f6c8eaae0b5b89c940000000ede1836265f06867a08ba464978d0c3c6ee6a8545d97182fd9243dca2004d73d63bda4a96e43fd30b3b7641487b36dc0911e32ae090c279ea86eafd1da86cafe	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "8537"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://2ckh60gz6m45s80.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "197"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://ghy1548v683se55.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "282"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "2368"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://yp1zggqqk569g5f.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://4ez9sylo3u0o93z.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "115"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://roesw7xy9mbu2j2.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "200"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8537"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2368"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB94C3C1-77BC-11EF-A5CD-E699F793024F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9058d6a2c90bdb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000f39200cb723fbc70330a23e6510db55ec2cdd21fd6a51bfc35762d537712b4d4000000000e8000000002000020000000ed957d5c33775c9894afdbc0e878c45b75d3d16f996bb7aafdb3fc79a6e514ef90000000cac6c71f411f70b1763739e136d2b8d35d02d628c3f51946a818f3b6dd7ed7a222dc6c7520f5c6662bd9ea3a3f0bc02f38a3c67ac772cc8aa167665ddea7d3c95347f83ddc47d1c1a800911892cb44d32850db98e25292c13baeb5c66bf750c7d017b7bb9e468073849ce2d2dcc378d61d32aaea557263d6b9dcfbe87300bb3565a53a2a5fec4730d745a04e33524bd74000000067b4e0d1603d3e41f13bc6b7e9784863578d03c4a7277c17fd4dc8276006447347113827698547a9ae5d2bed76ffdf6e337314db23eca944300f80af4e8a3c30	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://3lk2a06x281g260.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://w4i24zila8x2kt6.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe
2812	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	2812	winlogon.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2080	eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe
3060	winlogon.exe
2812	winlogon.exe
2072	iexplore.exe
2072	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 3060	2080	eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe	28
PID 2080 wrote to memory of 3060	2080	eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe	28
PID 2080 wrote to memory of 3060	2080	eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe	28
PID 2080 wrote to memory of 3060	2080	eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe	28
PID 3060 wrote to memory of 2812	3060	winlogon.exe	30
PID 3060 wrote to memory of 2812	3060	winlogon.exe	30
PID 3060 wrote to memory of 2812	3060	winlogon.exe	30
PID 3060 wrote to memory of 2812	3060	winlogon.exe	30
PID 3060 wrote to memory of 2812	3060	winlogon.exe	30
PID 3060 wrote to memory of 2812	3060	winlogon.exe	30
PID 3060 wrote to memory of 2812	3060	winlogon.exe	30
PID 3060 wrote to memory of 2812	3060	winlogon.exe	30
PID 3060 wrote to memory of 2812	3060	winlogon.exe	30
PID 2072 wrote to memory of 2388	2072	iexplore.exe	33
PID 2072 wrote to memory of 2388	2072	iexplore.exe	33
PID 2072 wrote to memory of 2388	2072	iexplore.exe	33
PID 2072 wrote to memory of 2388	2072	iexplore.exe	33

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\E696D64614\winlogon.exe
  "C:\Users\Admin\E696D64614\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Modifies firewall policy service
    - Modifies security service
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Event Triggered Execution: Image File Execution Options Injection
    - Drops startup file
    - Executes dropped EXE
    - Windows security modification
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:2812

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9a46da079202a968a87d79ed74cd6bc

SHA1
73fca0d138220e2ef6b451c9e4054d12733d8ecd

SHA256
7baca17ec7676b9b57623871e653f0833703e38d4142f592e0f566005188d9c9

SHA512
e7c5adf5d4a87ff8976ec4be871d0fb3bfea8996582245b8bc4857ffec62b9cf807341a93af6a0ebc4510dfd73007bc9dda1a7bf24e93c3be641316419fd0f14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4bed2cb60aa1e15632b300a8786e699

SHA1
b68ef9a51f18b11b947b6e8c87ec3e64b2248ba7

SHA256
9c29b0f090e45fb9e9a42613ec385272e3d98d2e66ed1786bd114025635b7fbb

SHA512
a063b97facd61a35491ab9505bbdb3901dc3d8a335ee866669faca19f1740d2c30b21974cfa07565518383ed2ade987e1f25fb84218036120328e50210bfc31a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaddac15c1bdc96bac33dbf157f9f378

SHA1
dafacbf5e54731eed4c14f7bb86687ce52af0bd7

SHA256
b164731f4bb1f274ea1191c60fd907cd5b6212885abfee3faeb6051df6b62bdd

SHA512
83b05a38c37ab2feb431173182483eefb2dec7ba0dba8cf6afa93b7c9f3bfd6735a1873b8292714caf12b0abac3d7bb92d7c199d00ca3487adda1bf8c0e0c027

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a171e899a416bdab467ae1a52cad755

SHA1
8088c22aed2938b1bc22eea71f12122abd4757c7

SHA256
0efae95bd73d5643af48e9a4613af14da2b7cd693ab1299840e95e75c1c5cbaa

SHA512
8dd1b344adc0f4781b296b4dbab3ca2f88a7e185e4824bc8cc0748d3239e4ed43aebf1f1ed3d4682cc60f928a93791acc21534dbd4c95d939d8e2072c96bcd7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04b008f19b3722804eb7ab4f24b95cad

SHA1
8f3d3ac56f17545bf0de5bf5a5ec3f19cd98b6aa

SHA256
60ecd37b2340619edc60ea25816dac31d66388181f6f47d91c580268f5ca8a25

SHA512
bbab3998f2b0050c2d93ea0a739fb0743bb4ae40bf2404cb4d66c1c8340e5deffd78419a38e4d12c34fa11a0808bc7506b9f4ae4917c6576121083046548b6b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8eaf5408e7c7c41219682f83e2e18e22

SHA1
7e696cc9a60aa4414ae8333244b3e12edc9e0f25

SHA256
7fded798a9950908129aeb309242ea4eb0b35f1e2a38a93e03175560faafd18e

SHA512
14da60f77d1bfab221654ed00a4d567882dba9420c80977a723c7ccbe561fc9adaebc8735252c1098fbd2185d05f3b327ba93c20bc49b36c1a138ac77e559b6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7051fa75be4a8ec804097b88cf3f26a9

SHA1
ce9c34bdeeb81ad502799b4ba9f69cba94ec845a

SHA256
c359a1ca065a06c02a89171fcce4e271243a56f67017d10fe7c6ca72d72b20a2

SHA512
3a6e96d09f93ce617f752d97ca827956bc4039098d7d2790dcb9f816cfda00514e216cd4a2790f4556e4cb64a5e921d5d462f664ea02a7237c96d5d07a9d4690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2692183d3fed5059874003775afa710

SHA1
23ab37a243768a2058ab2c7ad5100f34136ca0dd

SHA256
d5f1b876ab155b441da14190f336ccc02f30528169ab657d3d1686a9d131e075

SHA512
721dd45fee360884e25b9686843c73c96586aef5574540e3786d6fdaa0ea80b09169d16a93cc00c674a4018401bbcafbe8b6b5c29ea242226517b2e05e649310

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f97a1809e7411f0ee1d585d7a818c0e5

SHA1
201a33b6b53f25db9c88ff76ffcc80a7bf25bf7e

SHA256
eb9570fc8b93da75bfd4a115022631de38ee5d976237a7ea636fa306c5fc090a

SHA512
3b674f4d0b9fdac2c62d4b2705373bd93b1f413c1f7cd53201161a56945c23bf8bf179e7b52b5adb18ea470f6f0abcfe016c6a73fda9914a4fcbf9b9ae3063cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6519c4e91167e47d00edc84cc3fe5169

SHA1
182b137b42f6f1d8425f54c7611b04c75eb69b71

SHA256
0c2b3766d92b760f27310a33b4d8e2ca5b99d03493531273a06b59d27f2d8e3e

SHA512
f86a145735253755fb320587464d1bc926baa0f95ad68387078c993cbb77872231eb7ef002f535cdc0bf80412cbcbbae2cc2d43b58ec28535b4fea7f07333a6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a0c2ad3aea1669fe953e1f120c281b7

SHA1
ddcf8dffd6207f021850ffc000315eef7d2cf5f2

SHA256
1d8a1bb3e9ca3adb604fbdd2225e25a86f384eceded49cce9edad5189bdff5d1

SHA512
2762d2850803358ee53da6903aaf585d0e31039330b1442613a959fbc82eeac2a36aaf25f518e1d4e5fa7e60a40b6aac77d7f1d6c223c1dbe1e1d0f7dddfb683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85edf084af114d131663251211db0bd8

SHA1
e2801f4df5bc2b678b0bf7b38a72b3ce055a1597

SHA256
cb9c2a7ac62cda0e9a018a8814742c84440a255f7e55f7d952f2aa5112352525

SHA512
8f941c584d6a44bf85c67d5e17a7310491e5d3aa98eb61cd0db9a1bce787141d080c5ead07d59ff0f1b7ae7b95a075c354d8ed5d1e6b3783c3cab6299f71c01a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4718fab96f45ddeb558a236fe94b73e

SHA1
9504d77593ad884b897b35f526ec035ac715b146

SHA256
bc6a9cded00e0a4d4e9e29faf63fea104b2e88cb65120051a0723b39814c8213

SHA512
12ec235673de0bb08de366018d2c7bbab9583195dee2ce41840f00f6cafe6157451877f0eb88e3ed856ea691e9ffb320d18eeddf36be5cd84d6f1d43f7c368c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f6050bce2d8cf10f8c8e6b6c340c5c5

SHA1
f99202c6ded2b13b2b8f0a665263371a0f6fb868

SHA256
187686ef7d35a9facabe7095a088a0cfcc431f736c04aa9386678e8cd5938964

SHA512
2594e33442d31372951e6eb3ef9b37c490b53fc078fc639924834b12bda01101524a4e94b0a8dfb0bf4192e6af71b76178e02df66e2405fcc5b822fb2a7d2261

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4bfbc6bb0246b708bf76b5d7c159ad9

SHA1
b3ee03f66112bdaf54aac91debde9d1cff3624ac

SHA256
2e427c5dac99cc13c550f96580f50622be296ee4c7cecef10a474462408fb152

SHA512
13ec015e6919241f3720756ce69f5af8aab3ac68e3258381206ef4d95e1757dbde36ce9f6f3f846e1d76fabef919892059e5b4114838bbc4d734db59dbd01a9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cc72f2c1e17d85091f3a57c126d3e50

SHA1
ea558a104d9220880dcf66519dfbdd148cd84115

SHA256
962c4c06159820232679d7fe536fdd1f5c2f9fc3cd1dfe7b9037285ba5c35f72

SHA512
dc72073843e6ab780d2df852ee7b90fb963c6934bf5bededcda25fea61d3661a65eb27d81c8ff28050f64e6a9ae9ce998ae0f810152e9d9b78f94cc4bbb4fb43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17cc756d0742c1859921f8317623118f

SHA1
f3b7d9c64d1d7cd0d9a4a17b3fb9f05653419bc9

SHA256
7b519fab41db946526bee4af122add2eb40e228d13b7dd8b11eea0c5b88ee23c

SHA512
7c99821e3f1311c7a51604c3a9e2bb343f2de891680bccd505ea6e4fa5d5adc73d734232099de98e7cbb205ad92dd7160c6c9d4c6fe6c0ccfc330f4bc71617e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
779d96c80ed9be16351a99f5c13d8d2f

SHA1
c41ebcb1173666c573ba7cda42ae648f1ab7f527

SHA256
fcd3b389d290a4ae157318f474586c9aae18ba577af66091ab78298d4d8904c4

SHA512
38d8b0805da1212d8ec88d4070851d9b2137b3447e92538b81487878a371a716f2ca2a62264565aa7838dbdb8cd827ee734a162f2b5d50945f3afa5b30379c14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
224222307e6539959da26dfbe0651b64

SHA1
362d83012f2630a8e42d16cb1bae525276460d8b

SHA256
1db2b76a9d2475d9defe6fe468bf6517290a261411b6b0e7e1d31e1fd71fc816

SHA512
2f720b6f2de38a8956f087161569bf61d466a6ea797a26ceccbadc7a68506993c24e918d1577124d182da765017ef5f16183d97e2fa265b7baeef2d3b05fea3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f6a2ef4c8b4755a57a280de659b7efc

SHA1
9d0d3c7cfdceaf4867ffdd783c7371762f2807f0

SHA256
d025ebca08a11d0d3840a0edc3d061bcfadb04573d3478029b05b2c9a018b84a

SHA512
92ee774bcd1d45fffc7fec7588fe7a33686995802d67a7d064b015b5424effc288b6c17a6bd060d76d4ec642d0bc7979d63216d51a91f18976bc54881b264d3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1336113e3d9b698f19c02af52ffc4a3e

SHA1
24cf7026a25d71cd3c0e99151ad27b9a8354dbdf

SHA256
660ec3c103f7e2855c1528cc2ec46d639f97fc880696a34b9800838a51e2a681

SHA512
4c8ea4b02f64fdad810beb1ca8163a15d90a2495ec326eef4ba1b06e28f267d3dd0d8aa9d593ab2fd1093dc3738068e30bfe43eb3172e5dea7a91fbe96a33d79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b11e22856e51618c0c6d7d6e6e827ac3

SHA1
b2027d7cb02f500e432ebe42c4655f2b3949ee18

SHA256
b29037f28a70a69e9e24bf053727962190ac4562cbd8e994a601d4c5e6f93a26

SHA512
9516b489142bffe84cea05ef6683b860f267f8b234b43f1fba2d627688f6cff6ee8ad95a409ef57880994d1cdad31390efed59f536d111c69ec343f34213a48e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e013ce1376df388291b023e6f118e4d

SHA1
5ad4affcd62f7253c449587e255ab901eac6af7d

SHA256
4205b34d52985d1fef1e44180cdec907db5ebc8d1b0b8889c75713bfabf068ba

SHA512
b99d568d4116c9414eac27f459ac28899cf25cc36b450b751152a629769fabb1f600bf796dc4e4a7380d264a2643026719688ea812826182d320f215fff2070f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8af6d50ec74ee6d7130a075ef21339cf

SHA1
722a503548c0f07d016c9ed02c226bcd2b60de21

SHA256
44a34717ca7eaf7676fda8b0ae9d908faf7314b41e58d7473d0504f9ff0f1271

SHA512
b9473e268ccfa39741d5fc55f37f7859b2a60c0fd9f2055ee8f45bfb418ba43fd32a45bd86f29c1fc029db2d1de4dea2ff0d83fd53817e4adc8f2f8e3234d49a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f5d71278340d271f5d99c366e944642

SHA1
0e5c87e9a4a0da502fd20b71d672f6cdfee5706a

SHA256
374e76aa00874b348f4d14e62ab383ebdafe17645e16cd390ca808794014bc55

SHA512
263a068391d731427cf1f0a02ccfdc2b1ea4d7c3d2ca2a1eb80099483bd0820a1fd7fa28c4df895f21dca2fd4e2a186ca11a2933071bf7f47f6ecf62f0a06415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1946a402351661091b3b88a0ed8d5625

SHA1
9bb0a1b5512c0c557920ae4e55a56e997ad6e7c4

SHA256
2bded211feabe0e594b1400ddebfe7c97b0b58f65bca95c554fc94aa04d6648f

SHA512
c2c1fce33cb7da475d9e0c2886ee759733e21fc7ba2c6ca535523a848f8ae5bd22449b8fcf3da4a564add455debe1f2630d74066e2ffc05734ac85f46fabfc0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbb1c1adfe68ef7ef1cfd6c7a3636895

SHA1
7312debf59622b5327db0261fcaa9240e582d8e7

SHA256
3ab0ba8603ba9126888bb7136f1caa88f46e44f1fa642b6f9f007db619e5c473

SHA512
cb20477ee1c7cdb3470e48ed5703f2218b315660d6f29cc38a4a783d84ea94e1bb279c2a7a7f6799757dc78d941fa618585d29fd3c565d1047425346f0a17054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf6ad1e26bbc4ff01022ef6f74d6f054

SHA1
b2c3409203719990bc4e9d8a48ad6f63af543f4e

SHA256
cb32f4d4a1746f23dcc48a9363c9ea7af72808032ec26769618fc3f0dc3942b4

SHA512
cc49324ff36f3b83e3e880c86a97d25130c778add074406c4f5929b0ee10b8d0e6b0cf3e9f0a6b74c5dcaaab228793ff65342392f1fe5c854b73ab9871e7555c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf685d88f0dfce6ead8796293d7cbdb1

SHA1
080229e7d430677c17d94f03e47f25c2ddc35970

SHA256
960c0355d019f5d10ed6bde59b619835007286dfa05a29d9ad4dd686096898e0

SHA512
067a091d25981087d56cb541c4975717f59913d373a1d1e1ac4a508790338ad417a116b6b48ac85673a387328ea22dce60c8eb53d2023fcddfad00d87c32b5bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0d341eff1c0c1374caa0b117456f526

SHA1
67326b32cfa2594181d7c45177e069e4f13f5570

SHA256
277f8d5988a7da95dab278e9ddaf384a5042e479937c0eec60fad69d3acb3382

SHA512
c96e35cc55622a0768f62546498582c4c0fba36187da9892b6feabfcda05394c36589c986ba5eacab91ac9e4e7e7091a2762f41b433ade2256b81798360068a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0da8d8bcd0650f78ea2ab4251a2cabc8

SHA1
1b0e7a1effa98124e27cf7cda297a57ac3061ad6

SHA256
36a89064e0963c9fdce1cff1bd6a104ba051fd8a3b62d248bf457ec40aaccd39

SHA512
c69db6aeba46d81cafad46496c7c6790ed6165e7f0f0b6713bd7d93bd22029a6a2b92d46f4a39d6aed5b27e92ad55077f79d5d2a84bf0cc7410e20c8f67ec366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
332536c1476f3b0920c9a76a4fbb2c96

SHA1
8a4019b1924ac8b4c0c5f167cfab62ed45ca4e7d

SHA256
73534b527442d022e05aa7f258554cf13efa25e90705780354a0e15f2799b463

SHA512
1df92bd620dcdb94748558902bc9316931653cbca587973f58d03184630163639c321a9b8a67aaf9e51aefa1fa17ff0907f4d0301ffe430317de3bc910a960a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ad67bf1be01aaaaf5a3dc5b9bbf90f3

SHA1
a2eaafc50436851f6200dcc7aafd9f24eef25cf4

SHA256
d4e4148d20b3bb2f4a38c2a0afc9363c3cde013e61395848a28171cd13266206

SHA512
379fab960e698b0231e50617312ccc5274734509a7ce4d3bb60da3be9c35a6865eded309f6babea7d9daf4ceff8d3581d337fbc9d12884eaa321eeb7686731c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
328c16334344720835de89a00c382f63

SHA1
827a7f284d19144bc50527f00300f6d0b0203ab1

SHA256
9a265d9796155206ff03e41ea4f470a6ca89b421dbde59932fe58c96e78b9ad5

SHA512
543e0dd31286097bb4f3719b220fb196c894d4005c8795513beb197db9400972e47023e8efc50e006b0267edaff24f95450c651edf5558a653e0d2097285cc39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a07dbcfafe5d485b18608490dd00ad6f

SHA1
c8bddada14a2be12cef02f4bc37d6447fa03013f

SHA256
41e2aa9b81d18879683c65f53a23f796e4bf16322ce59d1270e3aa0f3c26d2ee

SHA512
da2d8e25bde6ce90824bd300fbecd93f1d688f0f0819d76688ed5df6da9fa5a00bb0b8e0bf9fee310f99bec340a324ff3ac4782fb12f4ba550136f0e0147afa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db0a70de3cb1706921ac3063153a7bc1

SHA1
e521aa8304d7b1d6b84f66598647983236504a45

SHA256
4c5af1933c31d56314d9d0aa11d50749f35967f2e99049720c0144d28f6ecec7

SHA512
4a7ed426895521ed73cd9cf0c96c48b3d7456364fa5b248f8309c67c4cd13385695b4e948eaf8106824bbcda4c06166f4ca676d9c881f70dfbf02d259bb0ccb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ef5e2f550f1633d7ed27c89d4d4b0c9

SHA1
1051aab59bde6b61c33fc6533d8e689edca68b53

SHA256
c09f8cf462b6f8fef94cfd7ebf3c97ce7b756c07b7448be0cba4e5bab01aeb6f

SHA512
3bb58197906feff4b3701520687a4d3b348924ffd73b2baa112985f477ab848aee89d33e793e52c53331c21951bc8132f16fd938a90db0123e26e640ab548766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1febd49a9666940350f18d9d37fca35

SHA1
4377b5fdbb8fe2936661e95238e6b69735082560

SHA256
8b1f0e07b98a4552cdc5fa4ecf21ce419852644c2ecee6fe6a4e2dc3b09be359

SHA512
bf75fa58c8900e6b3cff366efd00ff6568acf30b78ac5687524ad3c5fb3ead5edd3ab9a063eacf0c84236c6b2faee2da02bd53b197e7cf50ed2f3af2a64cbea5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b03cc1685963b0c9444838857558faf

SHA1
292643e1053780535830214498663e12286e8903

SHA256
335f3ffe32563350370b1ab3b994f07a933b6332503ad5e7cea583f39028f356

SHA512
408984063cad4b84eadc2a350da7528abe34166f6345e9ae0ab504707a0c94f5ef86999e5c1bef4e4c4d891f9cbafea88e857c9c1742d499645a194ab54e8d42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d24fbf688d5776f496fe5681256b7a05

SHA1
5becaebf5376d072e2d83a56f66e7b26623c9825

SHA256
3a2152f1d04107801cf078bc37fa11297829b416907155ac5500edebcc2b4a01

SHA512
a0831b69f156a781fc9ef59e944c200dea725716ad0ae1af4b9835c3d26b56eb0e165ecd20f410ed558d7096b4c823a8ab468c56673edb712b7b78dd0b2d2ae3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2add3aa1aefdbe3c837ecd5774b90e4

SHA1
27019e04f9c985bcd87264386aa40bc600a31983

SHA256
0cdff215b4bb3261e66adfa720b6df36c92ea69bb23ab0f7749a55143f34e563

SHA512
06ca66061d6a0404e46d8f258b1dc847b62c23be628b58ca6fd03383cf9489dfbc0632f0db0ec1747e65c9ed8d21b596763c965b60c90032e25010541bab0ab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52514464c0ac7fb1d872b7bdeab7b32d

SHA1
400b89571abf81ae9220e83d5cea5ba2db4988c5

SHA256
a252cbe27a3d10c82eb74444abbb0c6a84ea2e2bcd5f1d1ab04a6b86efd40e97

SHA512
a1ab8330419b1861722c90943c5a0cc747589302b35c1dbe40eafcf273353e3acb19526eacd74935a404040ced0603516adbd99a7848b71b4d938870742aff02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f34dabc483c38ca67f7656b0d4cba188

SHA1
9606f806eadf793a7dbfb404f2d52f1c36423a60

SHA256
5329ffa84b26206bea989e0cc71d812253d6b5cefe21e500514e7cc95b167355

SHA512
0c515d871cafa24179d527ed57f8015eb8344eb2db3d1403b4a8afd2a13aa5e2938ca0163c32b7be523168ddb16b77eb4dbe36429dacd48e57170a634e724660

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66fad3569c15ba1aaf1998a544317cc3

SHA1
06a1f5767a28a49f14a5f0d0b492aeaf2cd831f6

SHA256
730f6c814a01e4807a18bca9e54911c37b8d547a564857ba8de1a1242b589f55

SHA512
2fd7889d1248f773443f9f9f8106697dc611e28d86c77dbf2d045d5223be27d8ee3abc7b3fe4032b156b6d2243c6ce5f2b3cd13c0f104c2ea82360f382795945

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02adbd9f181422a2b6aa155b27c3075a

SHA1
31cb01b2ac1fc1f80bab254944e582a093f58781

SHA256
fb136b4dcc4ef759385b0d13b7e365ebad24e5fd954670eaabec01130097a56f

SHA512
1a1f03cd41352f467d2ff70a06e38cbbb8aa29c276af06fd8a9474bfea917b093f26561e94ec09768edecf1b7957b6f8997a09cb5b485d4f5b0d4b53276cd411

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6668d9910707127798cc5c694fedb06

SHA1
8ed35a5d55daa877e98d22aaed96c20740b26d99

SHA256
b43e843a8982e63b46ace55af50902663d4e5c63f011d3543c09c22380bf07aa

SHA512
37920602ebe6fa195b3179d3a77bd483f9904fa4879d0dd911083f5393698f38ed6d74860d24194df19ba796693f456a3ab58430e3509e9a558da876902b1ada

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d8af2549af2a875b74a77f1f9b88a87

SHA1
b32b4feb0770fc94bb25a77048a33e5b238965bc

SHA256
5edf5edd0e3abb81a81cc38e52d9cf55c42e443e5c3d0351e2d234576520885d

SHA512
c4ccfe98ef5e284ea77a0fefbe0632c77690edaf3536bd46fa03260480eb83bbc8a57c8b05762f2c47dfce01c6ec6eadb618bf9af7e67efb9b9113e0257650f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a81c33404848e129ade1c7a2e6ee3006

SHA1
9a0426b4a534d7605f6b0cb3d4a719abd3c61151

SHA256
42e2dcd2d27f3615fd1816ad68f58a12f9a7398783fd658c767824185b9d357c

SHA512
5dee97990d02bd98002d406ed3d62bfff3bddfd875985bb3b6eeea13d9ccd8048be59db35a570e3e419d2681d3d256f50cb6e84649a275bbcbe93849328a8ce8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dd5fe89c8f2f6dbd66a96e924660d35

SHA1
3f99d1449254b6fe0a4dcfae736636876a21f0e5

SHA256
1287af9e85c2a7d01cc2ae33b25a4c8042f098c35873145de9f6d3fc95201eb0

SHA512
2019d05fc47cb7a7edc2913bbf0460e2472bee93f6f70acbe81295d40260d33e00978c55697f1d376d336e786ce49900e280ed0ca78d0972ff2582ead3c86194

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7bb8342aa55fdb307e427bb3dfea48c

SHA1
a1b5f47e49765271c969685e2d0597d6c7ab320e

SHA256
e31291c11119266f013021169b2112a01c2f989b38e37852f53240f476928ef5

SHA512
4b502abe238af8b4b6822d71140d1d051f9c3ac6bde3a40b4d1a0eab2a25e8f851ccad9b132c76cd94a706c1447eea5c2b80e9e7ccffe72f62ec11c7248c0b5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bf912e2d7206ba99da412df5a36f71f

SHA1
bd3eb964b934d051255745a12b794cba712807df

SHA256
ea847991cacaa43c541df2ec9c44fc7a914034ac2156dddda3e6dab748e35fb1

SHA512
7ac2ddc86bbc7e8af727b5f7676a9a8ed9b11c2f20edb7d3929a21f7b5c2671c73e1b695647364afd89b586ca90b03190aa1505c7aa4a8003c7e00d80c63eae3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07ab122fba4d176ffe28d5f23d9d452e

SHA1
f151bd0948c7347355b9ee8bf5613c7795407fb4

SHA256
b74e9f3aa60a0aa126cf820ddd8f598f97fc8f30440efb1ccf2ab16d7c6aae7f

SHA512
57be01e9cee95c2076b5e7f165efe8d92caf011cf0264cc78d6a0d176cc8ab7525c32df5c5c9b6442e5983a5ad78b24d1708fe686ea53e64a7e9101c10ad0fdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2d1ea87ab4fc7684bf117cb7a8b5b0f

SHA1
89483e048592c35cc96063d38f65ad79cdc4ff09

SHA256
03591d41afe6704221a08ec8eb633bee6f04ec5fcf47870ffd15cce9813c1853

SHA512
069ee446b4b11da7fe4ec4289fa1fe6c71f5eccfade33d2df643129085a03ee02a2ccab97efe4c5184280e8c453eac1d29e1228f79ae528153438ac6df104bba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32a4aa13b2ab3a3cb7d24e4f91a481b5

SHA1
b5dd94489451cb80c97f46db47db7affa056a051

SHA256
74174ebebb0c369796997ade1e841edaa064f401552f5e725b870d625dd0e2ef

SHA512
8963751e516b7cc4c09e62727700c9b94bbbb52ad4db23204268316a4ff0fbf0d9812c6a5f97001cc9b2586544c191398a517394d9fbd4287fc2d9c7f5a8d57e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d537a68c0a233a964a2e081df149c96d

SHA1
f6b6fe778d4e5c10dbbc8c87d132af11952e47f3

SHA256
b4413ec58cd166460912a535768a687c3fdbaeaec591f607bb9dcd0358fc8a55

SHA512
3c4dac6616361ea7ac3c6c6053e00d4fef816ad972782220f474dd4b907735544b2033dcf6679022b56d7cd54609d4f9f44854a40e669ba52d4096c48ee4a62c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
8b419484905406158ddd717d8b84b3a8

SHA1
519bdb35da0fb0a754c325ba98f93e5b771c9cb3

SHA256
9b1693cbdf7f605dcbd77e10c1ded466b593cb1d2cb9453af714e15d5124c1d7

SHA512
5979dac865c8b16c62f9900f99926adc92f8276eb5cf89cd8304f91ce78e71cb04fee0b4b5752381501255c08bc4fd1c3a325a54a6aa01b5a0f1ef5026150ea0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\J32RKVFT\www.youtube[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\J32RKVFT\www.youtube[1].xml

Filesize
13KB

MD5
a44254f584943bfd5f62dad31b9d7d07

SHA1
bd809219cd71aada3f720a0ea0cb8d51700bdaf1

SHA256
0e1a6d7e6da314a62ef9967a6e70fe2b4d3070b21bfda5cf6723638c84bd8a8a

SHA512
f599660899ef12c005aec844c225620ff785bbcd257b9f4b9b1e749920152c6ce4c48903158d276660287ba97451eb0a153f4c2b49bbd5b9e5345887253fda6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\J32RKVFT\www.youtube[1].xml

Filesize
578B

MD5
bded01eca487d5a58c27eaa26b7905ca

SHA1
7ea02de7567da27eb5c083baffaebbd7f18ae3f7

SHA256
c03f49729361c6b006896cd4bd8dd46d2af28800c66ef14e1061b703ad4ab99a

SHA512
08cc083a2b3c45786b25dc85f7eb571cb4899d227861ea1791be6388a7f751f240a8eb3c60926ee6245e3b6916e92add819466a574f520fdddcf8e99b9446303

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\J32RKVFT\www.youtube[1].xml

Filesize
578B

MD5
5ab472118e214cf794bd148f7c03bc7b

SHA1
84a2ed7feace805e9e1b6cc9e12a46853256585e

SHA256
8c8a0e9a19304d9cdbabd60d0b8652578b064339a95d5775a153d412ae35e99a

SHA512
22647be6cb9cd85466371e4c4cf38a5ba84664a15f4238559b6d321d8fd848eb0107f2b1e1bfac9fa385b468e6537db262f621bffbf39ace25e9606f48736ef9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\J32RKVFT\www.youtube[1].xml

Filesize
578B

MD5
ff05c3adc69b8786761cdcc309d8d2ea

SHA1
a5f14dd6ee181b4f65d53242d01690da1ecc6735

SHA256
e0b79e129d756442ad5bff8219025bc9163bbb14bab538b9fbe0b16f904c2063

SHA512
e4f45d9df4ce286dfdbed2cfab3cf8b5b892c26ac537ddfb1ad6c8dfb59a22ac8ba081b0ea74ae0ddbd2abee8ff4d3514366f010a7e6aad635b802536c4abc3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\J32RKVFT\www.youtube[1].xml

Filesize
3KB

MD5
f00a002f1aa7f28d4fef233834a3dc2b

SHA1
e5401ad6d9def81a215b6e7863569c348b553178

SHA256
1ee7b3afac76c024b22911c597d246c64cb8ae5f61894689bbd50ff69689f573

SHA512
84d4df8c8e9e4d19b9e1175d24c73c89f59281898de21f0346e56e57284b1b16a94753d138bbfb1f998558e93423c18d8c1755ba6c24bb85afa11a50a1644e89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\J32RKVFT\www.youtube[1].xml

Filesize
578B

MD5
86b982ceb37ae7de05f037c60d81f137

SHA1
d36c914c41bd46cb737048fcbac41db564c491a0

SHA256
8ff38cbcfd50f17e2b1eb7d26149937343ef3be8745703ddfe75f9360b2fdb4a

SHA512
927aa1ca1d428f10fbbf039d4850dc26518b919fceae587f04588f46a3326f614fa03b2bdc43fc3fd202ffaed2afa236267c89039044931f452e38838f61cf58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\J32RKVFT\www.youtube[1].xml

Filesize
578B

MD5
fef69dceaca3b8c872c936f66c53180b

SHA1
0560e5a6a5b87ec79fec4337ac9b9718342aa808

SHA256
59d8e47dd48d8a071920bf638ce453bcf79b073a4666f27d8e3706217ea52ef2

SHA512
ce74f716cbde4d9a4a4f862a2c8082678b27cad5ab7c8f857ee261e69f4a09fc6e0485c5dc8bfff1d0552b419a1f9aa1f3f70b1eb17c18235ed221c181cb89c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\J32RKVFT\www.youtube[1].xml

Filesize
578B

MD5
c0d404a5c885be2a2d9473866721d6dd

SHA1
14346dfe4a5a683f492f61cc034d37d2b02e66a7

SHA256
d3fda4e867eedcfcf9bee39faeb302f20375c738b14bba6856216f05fdb40d41

SHA512
372f1905c4d8118bdde906f4c599ff99d49881d6fc7725e9deb5069f44b1f6706f57956959b64519421c8ede09299f5c5a4d3bcaa15a4dc78943075d02f5f817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D6V88JEY\banner[1].js

Filesize
100KB

MD5
4cd248450931bf118d5bffae2777dca3

SHA1
4f4fe0db06f3168f71bc0b40f9de4814931542ae

SHA256
d743530c678c3add15f37b5245cb441a9ba579e73b9b6af086fd5bfcbdf15e54

SHA512
4ba3caf2ec7c15d76d9acf686b09fc7466767dd5fd0b86a0298b4f4397275319b307166b59a6bb9ea8244b64347c2cfc95213293a1963443bbf19588189c4853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\script[1].js

Filesize
96KB

MD5
28becf0e5ce8d65f6f9e33e5954a1a79

SHA1
69d67a8f41d803b62218f02a28ebaf53f32e072e

SHA256
c59fa2847d6798cd7b5ebbd9b7832eb95e6b8aeffff195d3312ac7094049ac50

SHA512
3d6734183f99b73e5bf6097f2f388ca83ca7d20a849b77c871e28c2cd3e65d9fc0a020fbd349b08bbd916493089396386623d695af964a6a1f273429cca1ad6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9704.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9716.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
811KB

MD5
eedaecf0ffea1c2a6c683181bb0983ec

SHA1
a588660bd3a3d0fb84b7dce66606fa90aa05b8b5

SHA256
4142bb6c07f4d2c83507fd59b5fc468d0e02159376e5add0d36eeeb29918032d

SHA512
265614ad915ce396bbad77e2d691bd5f18bbf4057601a356032c1f803d2cdc5582ca15a2e3b8ddf98b97c5faa1fa37ae42838d16f0b55eeb402d18f55be7a5bf

Download Submit
memory/2080-12-0x0000000002650000-0x0000000002698000-memory.dmp

Filesize
288KB

Download
memory/2080-17-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2080-0-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2812-74-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2812-71-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2812-75-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2812-78-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2812-1121-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2812-138-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2812-254-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2812-1510-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2812-2626-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3060-16-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download