4142bb6c07f4d2c83507fd59b5fc468d0e02159376e5add0d36eeeb29918032d

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe
Size

811KB
MD5

eedaecf0ffea1c2a6c683181bb0983ec
SHA1

a588660bd3a3d0fb84b7dce66606fa90aa05b8b5
SHA256

4142bb6c07f4d2c83507fd59b5fc468d0e02159376e5add0d36eeeb29918032d
SHA512

265614ad915ce396bbad77e2d691bd5f18bbf4057601a356032c1f803d2cdc5582ca15a2e3b8ddf98b97c5faa1fa37ae42838d16f0b55eeb402d18f55be7a5bf
SSDEEP

3072:CYsgk+ruvdasTt9NHhayrHlbGAP1Qm02B545g4FuB3bBo6P6We0VyOjUout:Vr/oS

Score

10^/10

defense_evasion discovery evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 18 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-95767377"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-25118332"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-96040694"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-95585738"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csinject.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EHttpSrv.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fwenc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbpoll.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lockdown.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\amon9x.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwin95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spyxx.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwinntw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HiJackThis.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defscangui.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\neowatchlog.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panixk.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwebloader.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HelpPane.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-agnt95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldpromenu.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcscan.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\offguard.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweep.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tftpd.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ants.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mdll.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navsched.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfiadmin.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamstats.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanhnt.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvlaunch.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppvstop.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\processmonitor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpexec.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmgrdian.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavproxy.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccmain.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trojantrap3.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bipcp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clean.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icmoon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet98.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumphive.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mxtask.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbust.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FirewallSettings.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fwinstall.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnt.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deputy.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnlan300.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapro.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530stbyb.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnpc3000.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapro.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avupgsvc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkwcl9.exe	winlogon.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	winlogon.exe

Executes dropped EXE 2 IoCs

pid	Process
4020	winlogon.exe
1224	winlogon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1224-29-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1224-26-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1224-25-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1224-21-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1224-38-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1224-39-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1224-40-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1224-48-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1224-109-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1224-332-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1224-479-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1224-543-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1224-705-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1224-927-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1224-1118-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/1224-1233-0x0000000000400000-0x000000000043F000-memory.dmp	upx

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9425250525D48555 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9425250525D48555 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Indicator Removal: Clear Persistence 1 TTPs 46 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\EXCEL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\EXCELCNV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IEXPLORE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\NGEN.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ONENOTE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\POWERPNT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SPLWOW64.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GRAPH.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IE4UINIT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOSREC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSQRY32.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PRESENTATIONHOST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SELFCERT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IELOWUTIL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IEUNATT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOXMLED.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PRINTDIALOG.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WINWORD.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IEINSTAL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSFEEDSSYNC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOASB.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOSYNC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RDRCEF.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SETLANG.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SVCHOST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACRORD32.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MRT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOHTMED.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SPOOLSV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MICROSOFTEDGEUPDATE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSCORSVW.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOADFSB.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PRINTISOLATIONHOST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RDRSERVICESUPDATER.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACRORD32INFO.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CLVIEW.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\EXTEXPORT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ONENOTEM.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ORGCHART.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNTIMEBROKER.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SDXHELPER.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSHTA.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\NGENTASK.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SYSTEMSETTINGS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WORDCONV.EXE	winlogon.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4020 set thread context of 1224	4020	winlogon.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "4576"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "255"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "5889"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6046"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6046"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://v5eshewx3dzgc1h.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2627353528"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "6014"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "17105"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 605368cdc90bdb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "11249"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "3082"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "15644"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.hugedomains.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "12682"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "4607"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "4486"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C70C62D6-77BC-11EF-939B-62A6B307388A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "3221"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c0289cc90bdb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "282"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "3164"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1693"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "12739"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "5957"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "5889"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1724"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "4602"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "140"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "146"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1781"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Local Page = "http://3870z691f79urdu.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "11249"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "3070"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "6097"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003d1c6f3067c0c84abb3839afa92ebb0f00000000020000000000106600000001000020000000760d5fe22782e03486561f388099bae35849ac1e5a450cb9f2bbafd408e47915000000000e8000000002000020000000643cff3fcb3bfc551a748c5594f4fa25eaf5577548ba5c88c9b75f222b97836b20000000671cfd9c98bf66ae1f3b506d01962e5f7acef4abd71b45fa588aaab6f3fb2b85400000003d34fd7943ec6bf611be9761a5745254aa03b3d3d9949910b2cc0bba1a3d4be3167eb8c8cb68abd5651755c8f38fc76bbd19f36cbebd3b6bee8fc19b61c71a64	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "198"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "6103"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "11306"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "14124"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6040"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 101373cbc90bdb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\hugedomains.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1603"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://3jargzpqe7550py.directorio-w.com"	winlogon.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://9ggf4h3pm0q009v.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://n2f1w2b12a402z3.directorio-w.com"	winlogon.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{C812BCED-B0C6-4A3B-9D94-55220A113EA6}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{F8E3A74C-820B-428A-A57D-A0CE1A3B30F5}	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{D836555A-C417-4F07-8EF5-44FF2C5C2F6C}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{BDFAE672-A4C2-454C-B0BB-2A81AFCA6B49}	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{2820A78E-E31A-4427-8B3F-C25F8685CFCE}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe
1224	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	1224	winlogon.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3736	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1556	eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe
4020	winlogon.exe
1224	winlogon.exe
3736	iexplore.exe
3736	iexplore.exe
1392	IEXPLORE.EXE
1392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 4020	1556	eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe	83
PID 1556 wrote to memory of 4020	1556	eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe	83
PID 1556 wrote to memory of 4020	1556	eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe	83
PID 4020 wrote to memory of 1224	4020	winlogon.exe	84
PID 4020 wrote to memory of 1224	4020	winlogon.exe	84
PID 4020 wrote to memory of 1224	4020	winlogon.exe	84
PID 4020 wrote to memory of 1224	4020	winlogon.exe	84
PID 4020 wrote to memory of 1224	4020	winlogon.exe	84
PID 4020 wrote to memory of 1224	4020	winlogon.exe	84
PID 4020 wrote to memory of 1224	4020	winlogon.exe	84
PID 4020 wrote to memory of 1224	4020	winlogon.exe	84
PID 3736 wrote to memory of 1392	3736	iexplore.exe	87
PID 3736 wrote to memory of 1392	3736	iexplore.exe	87
PID 3736 wrote to memory of 1392	3736	iexplore.exe	87

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eedaecf0ffea1c2a6c683181bb0983ec_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Users\Admin\E696D64614\winlogon.exe
  "C:\Users\Admin\E696D64614\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Modifies firewall policy service
    - Modifies security service
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Event Triggered Execution: Image File Execution Options Injection
    - Drops startup file
    - Executes dropped EXE
    - Windows security modification
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:1224

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2032

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3736 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
112838e0d8b0b59781266668c5f843ae

SHA1
e029321ccae1c5ae4a90358b2b3c42d00d6ec8a0

SHA256
6ff93af78b39b637ec1cdf905740240cb154303baafc58e8c2e394b45e17abfd

SHA512
bf78e54c90c2f9610a40d3ff514b9c5b00091e6ce9c9860842ebd4ec9620f55bd97095a318d654fc2ab4f1d449471495f638872ff7e409adc26648a10e5bc992

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
f64a8823be397c35c13fb0eccc285c5c

SHA1
b9ee9c12f9dcc2e56a956a2d3c07ca8dbec5ae0f

SHA256
d1f1c8ad9cdf6bc5c61bdd35b2fb240127dce6706ec2e9746322a9be0da7eb69

SHA512
aa952039ee6e65bcf5ce9c3c40232aac83bb8698ebfe5b02de5658017c808d2750a872de7c701622a630919c099a5385b7c246450d7f567a2ea75f345bfc47ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\C17PNN4C\www.google[1].xml

Filesize
99B

MD5
96889cbedd95ebd332b070c7e01c342c

SHA1
ae74846d9bc0949d2dbf02291bf7d19019a295fe

SHA256
7a5d299a4d1185c35b389e213e61d97e1ef698e7f19d6cd36d8ae6b9f7f3264d

SHA512
97976f82cf2f7ac42a5ed3a90c4a1d7aed0cec9194f0fb54c7efd646ab92f9cf9ef56be8377744ce7477cc429c83b14d0399ffc7738c7ab6e14727d54b75ab68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
6KB

MD5
54566866b6c0ac9aba14ce500bfccb0b

SHA1
4d61bc6db066009df352d0e01099537f1fedce4d

SHA256
9e0d4488b52b8ab16693fdf1dd8d4c06f441255782f5c8ceb27e30cd683889a1

SHA512
80ccf6434cf45bc4ebf6a07fc00b887416fbbc750ecf57357b60cfea63b50631af6ef0ab0c907d71e55a49a9c82ef954b9297c24db9d2768b2fe5b86b2760e1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
6KB

MD5
793baac1fb995b8e40943a9b5423a27a

SHA1
cfd8436fe0f3832aee41d24c18e9aaa42dc3392f

SHA256
20530afeadd92bb8c4dfca2fec61935029036b8be6b2b56998de49afe75f6b1b

SHA512
ef8d54e18beb6571b66d1e9f90db8e0407ba4199f6a50a44b7c991828acd586c602ea56c71a1a5bb153678e86e5cb9f5b2245d643ef4e81fdb4d3c0be5c504a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
20KB

MD5
acf0d25d9316e1096757afc2355dfd1f

SHA1
ee0828b836efad45fa6e087dad3ad5756ce6bf5a

SHA256
4a72e2cf4ed9c2c4f7c977becba67fe4ca6ea71cf756fa6ac1733524d748ea83

SHA512
66ace474dd68a3bf47884ab6e2a22b9c3df0d00eb3c4a2df376ea8c0752eb5f00746b2a5330aa3867b86befb397f8aa3958e9932b84e1893906c34b8788c53a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
6KB

MD5
5874761d4308d01d48202964a3f4c8bb

SHA1
366e2c6291722e16bc52c433ad7a39bbb9731ba2

SHA256
fc386328128d323dee080fc410cc76a9c9d78a08ecc858098fe9420aabeeff07

SHA512
eed582cf74a914df118598e8190c3b4566f1de9035686100c24dc31ea14c3e4be60e94de1d7c69636d29bae19599c7074b19e49bab2c9e42b0932015b2175f13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
7KB

MD5
c4d9e30d17936ccef60fdf1d9bc9b470

SHA1
8d7ed908c8931f7c85fb90cc2fede6d2a02be043

SHA256
d0afed038940ccd70d9eac5b99fafe0cb154d560069dd9364359bba7c465fee3

SHA512
2d14b9a15040c5bd75610a6847690db8f035c1f7870b2ee506b13887eb9829a74980d3a3278b5ef07830689c7a6c6e388828d7b359feaa0b1e30011c7ef03ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
8KB

MD5
f5c3012e524817e9af3b3e8bfdea07f8

SHA1
8dda016fc43811e731ec4fa5e4b93ee9e08ede6a

SHA256
a8548734d4389f7c55b9fcbc4cb17fa220d9f69d3d3b1886bd84193b1540ecfe

SHA512
7bea1c427ece0b92b3df4744990626c787ec1c41293ddea5eefb9e43b4adb002d1f80c0fa4bbd976ddf5d4ad0e5a754c46d4978d798362be95285930af29dd03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
8KB

MD5
cbc77277b2f7959cde3ceb895cb3e708

SHA1
c9ee89f907b1f2da875adc1c1928b781c7acb8b8

SHA256
b75becdb8454ba66e7de8985e369fb0c94cb71b46939b413956431ab0812f2c6

SHA512
f8ae2ba2c9e93466166968ba77c2c46c466a44f81f50614cd7aed59a8466ab4097f4622147f3b48ab0617b0324693ddf8610de745e3f53061a14df2ad49ba6ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
22KB

MD5
c4b0bcb7822aff3544521366d88abb75

SHA1
ac9e8bcd41c4be64b9891769d5942f21fd16dd9b

SHA256
932ba496fbd340b2bf4183ba740d59d9ae7aa83306d1d230935cc36ec0a2df15

SHA512
c3a4a002f32b4b4e251c019c70c8d4a7cd161bf2c38ce9802d830f9c683dfa68541e1020fe616d9ef1dc06f35a73ae767109c86bc7e2dd80f91df6736e43e1a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
24KB

MD5
af34b41b9a56d3d1585d084d322652ba

SHA1
618a8b3ad70e7dfbd73c4c1aee8fd501b616b05e

SHA256
78dd9780f277a28ea5c1c05101625ec97ba4db2d84d283ca0c6b52fa513a0708

SHA512
0c501e4950f5cbbb2267c264542c69e8b2897f1cd89815764c8dff69d3f7027aed193a28a1b2f8ab03929f40e425501fd15a8fa230ec82884d9951cf0f188d77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
229B

MD5
b839572ae24f31c67cac983ee8a2dc61

SHA1
e040257a1bb4913646277a75e58fcd31d924b975

SHA256
de93e0e93b39ef0f53012cc3aebdbaf6f81a93fa57d79c7f59591bd19f162797

SHA512
5e3bbea5bcd89f2ad496450f6bd1563410d5b78755c20a7a980abbf1f056a656a3b097bb31a1617d1df9d4c1cdbd4e720d12ca3193ba723056e0e0401a6998cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
2KB

MD5
d09e19f27e1ed648eb04c2526f832c03

SHA1
96122a4ad500ff8704715ea51d0014430fe7cd56

SHA256
09adb721bb059d0b84f863bafc6ff9309f4655bb3198fc1c354e63d805ccf3a4

SHA512
51f2980a023afa3558e8ab2b6932455796d0754313562fd914033365cf50521871500a32172fdd3336508947d8d9745125a8bba2ad144ec56529f3ee0b50e49d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
2KB

MD5
7fab3a82a9c56f4fa12b8d47607d9d0f

SHA1
028ff6b511b7d9627e9e32cebc3187e8a782ba58

SHA256
0b34e342844ea641879747ca75004d0894224e6da5e7671818e63247288b6f67

SHA512
58e2eaaf438d604fd41c74a2d4706541b52fe16b050d95ed4c3fc3d7570f0d3900b6db75f26a390f6686a2fed973d020384dd7ebd59f8d58e7c31ad14d828509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
2KB

MD5
cf663149866e10c662dac763cf1bfc46

SHA1
46cb3e4f84ec942e32b0498d6b579a83dbb92d76

SHA256
e497e7dea3b1259e54d3126c8f4df62636aa50ddad8470c188649e56deccb4c2

SHA512
ceea7111b0fdef7134b2466a2596aee6693167ab3bc9cfa447bb0564292f12f330ceae51c286448cd2f236d594cb0abf67725971685cdf8d9e84dcd7962257b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
17KB

MD5
4cc329bcd1efe398254647a44218dfdf

SHA1
ddaa1efc44bbc141b459120335155f066be1ddce

SHA256
f835acb98e384761389050b7cc9ab538a5cd5b639529a61a9b7490ab3e087bad

SHA512
8d45efd15ca98d2334e127aa802bd82f89d9572cf42197b3e0002a521f33335f50e4c2d5bb6841305b552e7d4730f3499e5951536d7ae5f062af599348cab4b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
2KB

MD5
41611e05699482158c30a4bc0545d794

SHA1
f3003b5a9da9998942202588bd7fa67c2d1c2e5d

SHA256
8659cac7b712b5485179c44157fed988bced6bd15ff71ccee153c3e48b62ff19

SHA512
7b0552d425d01b7970022d603c47cb5fcfc5546bc66a552815740aee58533725888dec6895d56eb53fbb48b1cf958f0fdee85ba8e9ed3ea76c92b479e2846a39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
2KB

MD5
5ac71a71ecb447c5ff3952f57dcc13d6

SHA1
faf06b0feecbafa8cf1b5c6c99a3a4fb668d15d3

SHA256
9e4fccdd85b1395656652618270107f7015f23c958f0659b73a9cd8c1226d523

SHA512
9df1962e446d1ffac0532dd58e7cf64870edd72e004eba86d09534644d7f78da1ba69f5d08bf1339fd33448d2690975b9bd3746e62181d89aa104a5fa74a58d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
2KB

MD5
8421d18713992d99956b321be753a34d

SHA1
f3b528a5a62d9ab36e271c6eed0d9c4a13749881

SHA256
0f9d25d86b1ebbff8058b3120385365710a31c1ecc3b2e26097b288f1daf93b3

SHA512
8c549b52f117ba6ee1334dc9808c07b7ff3493d4e54084fa50292ea8a05090fccdadc4669130f7ad5cc94505b3a96bd6e4d55d303b0f133302ae01dc52fcf3c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
4KB

MD5
ff0f19209e749d7f877a8df01f00b334

SHA1
63dd3696a01caef4547c3122dbc4aec689613eba

SHA256
8a883a81b3f7c4e032f283dce91c3720bf3f3b174fcbbcce3ed5a08b3bb5030e

SHA512
c45734eb27ea3b910e13ff9749fb0d3206b9cdc341350615cf5f1a9e5186d46e34619c6a694deb4cd6dfa153a0e492ab38cb6d6d5af0ac4d48aeb11a5962a580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
2KB

MD5
626350d593158ad5b7db481419c32bff

SHA1
1a43fd4c92c686451aeb7c2257e5635c177d7a0f

SHA256
ebc3dde1a9e98c2420d0d1184a6a58d7510fa98d9a87d053b2b2308d71aa2f96

SHA512
4a929c0884544f646afb73ad5d350e125c6e2781eb8e6d47765fb20650a34069e0cb3bb46c96f7aaa806158f7653b4d6104c420e70eebf657621b22c31dbe754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
4KB

MD5
2b21ec0269ab54c82796928593bad03c

SHA1
a3262080e3300160164f4b7e97bcfeb9698f69a0

SHA256
6f0cba89531d0b570333d1ca932f8d1a5f97d2de339204ab425856e1768542f2

SHA512
89908b8f61954861272180f35b414a11187895ad1947e3f0ecd935052bc4689b4b14b8e00d29a44d0330326aa76d34186e475a4f9bd7e4f8f01618be72dbbe88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
4KB

MD5
f58fa835ad745eaa23cb3bdbd1a09447

SHA1
2be62f9494e08f854328e681019f65ec71ee3754

SHA256
32816812deaf574f609249ad16ad181a58a8618a650e007ce57d4ea56f485006

SHA512
405e12fd0758a4d1d788c388548a03a1df82285d4b67f8ad296d599a3a959cad4f564c5798acf7cc4b4c07865c4e161c81424d65d7a458f7b8179e420f610b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
18KB

MD5
646d65731a2b189f3c841494f1fd0e96

SHA1
839f902f4eacfac856c16c0e00ea67314245db3d

SHA256
f6afb83a7a9dfad910e244b7fe777c95552e0cbe38d8fd647a17ea0756b78b21

SHA512
6988e60d22c13ee3fb65a072a146001b7aa91ee7480291203c4f28b03b2e1d9d283652bc207080e7cb86e1533c63acd7fb37d8068bb4af47edcf25c196a7dc6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
438B

MD5
bc9a889355d9751e7dc3b7a786d383f3

SHA1
3f4fb9dd007526252197842fecf12693ba9fb13a

SHA256
527a572dc0d8cb92806dc451d660b4641f99de9f79f3d7085cd1b3b99eeb7cd4

SHA512
e7788455f48a3cb521e1d41a0a2a1946dfeb491332b7d53717bba1c21645baaa8105c7783f3768b4bb5dcce10ea7811496bd1a2be3c68ecbab242573ef247d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\N1AIUVB8\www.youtube[1].xml

Filesize
5KB

MD5
76492cfe9493d5d7012254605bf59ffb

SHA1
85dc5c0dfbc9dd076625e18698d0f08acce90ce1

SHA256
d00f1423524e1f513015b691d75c5c19965818dad5cca017d0d04445d9733ea6

SHA512
c8e8cffab4ed10ae490acd7ce09ee67090b2303dcc81b29425aca4c5a6fe5dc289bff3be89fefa0c9477c5ab6373d1343f855805fa1ee599b18527810c42b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver4E88.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VX66VOV\KFOlCnqEu92Fr1MmEU9fBBc-[1].woff

Filesize
19KB

MD5
de8b7431b74642e830af4d4f4b513ec9

SHA1
f549f1fe8a0b86ef3fbdcb8d508440aff84c385c

SHA256
3bfe46bb1ca35b205306c5ec664e99e4a816f48a417b6b42e77a1f43f0bc4e7a

SHA512
57d3d4de3816307ed954b796c13bfa34af22a46a2fea310df90e966301350ae8adac62bcd2abf7d7768e6bdcbb3dfc5069378a728436173d07abfa483c1025ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VX66VOV\KFOmCnqEu92Fr1Mu4mxM[1].woff

Filesize
19KB

MD5
bafb105baeb22d965c70fe52ba6b49d9

SHA1
934014cc9bbe5883542be756b3146c05844b254f

SHA256
1570f866bf6eae82041e407280894a86ad2b8b275e01908ae156914dc693a4ed

SHA512
85a91773b0283e3b2400c773527542228478cc1b9e8ad8ea62435d705e98702a40bedf26cb5b0900dd8fecc79f802b8c1839184e787d9416886dbc73dff22a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VX66VOV\banner[1].js

Filesize
100KB

MD5
4cd248450931bf118d5bffae2777dca3

SHA1
4f4fe0db06f3168f71bc0b40f9de4814931542ae

SHA256
d743530c678c3add15f37b5245cb441a9ba579e73b9b6af086fd5bfcbdf15e54

SHA512
4ba3caf2ec7c15d76d9acf686b09fc7466767dd5fd0b86a0298b4f4397275319b307166b59a6bb9ea8244b64347c2cfc95213293a1963443bbf19588189c4853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VX66VOV\base[1].js

Filesize
2.3MB

MD5
9f5bf11cd4068cab63057ed99069fed9

SHA1
7a6329b5dde6cc10a6b6753a18d1178f46ea4d3c

SHA256
89e1ad6ead4278ad4bba8ea5501ca5c79b066c61cfe38b70169181520fb5b0f7

SHA512
768fa98c09d02d0b72cbcb9701ad0547c72c401854f251445fbb5d446da2d7b24a66059cd1e55ecff318a064bf9fe69356b4ae18f4273c13d4c14a7f9dae0d47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VX66VOV\common[1].js

Filesize
8KB

MD5
56b21f24437bfc88afae189f4c9a40ff

SHA1
a9d3acad3d4c35da454e4a654bdd38f8d2c4e9d0

SHA256
cfece1b609f896c5cd5e6dbe86be3ba30a444426a139aec7490305ebf4753ed4

SHA512
53d4718e60a47526be027c7829f9ad48f381e22765790f20db35ff646bd994f8085b12b8fbeefd5b29ecda8f71f4c6c62b64652bc9a7256e001b5e4047c21651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VX66VOV\counter[1].js

Filesize
35KB

MD5
b5af8efecbad3bca820a36e59dde6817

SHA1
59995d077486017c84d475206eba1d5e909800b1

SHA256
a6b293451a19dfb0f68649e5ceabac93b2d4155e64fe7f3e3af21a19984e2368

SHA512
aac377f6094dc0411b8ef94a08174d12cbb25f6d6279e10ffb325d5215c40d7b61617186a03db7084d827e7310dc38e2bd8d67cf591e6fb0a46f8191d715de7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VX66VOV\hd-header-logo-v3[1].svg

Filesize
3KB

MD5
d4e44251f8e9314a0dec5eddd6b1c64e

SHA1
1c6a1a884585b80b3b623c92164b9d8742e5fc1b

SHA256
097a98eccd043b5df15a66409d32ef16f7570776625d0e0b4d1054be26a31a00

SHA512
1aa924657ab4043a27523e8cc1673314a037b063f8b6f530d5661917d30b893744d90223e5df38f2c97bf2ebb1e82ec21f91720dc27918ff853277ad5023612e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VX66VOV\hd-style-print[1].css

Filesize
1KB

MD5
7878fda89f8e725fa06880d1890f9c00

SHA1
3f8e8aa44d26d3cff13159830cf50aa651299043

SHA256
6d17b244f2b4b8a93886dbe5cffad1cbe8fc9079495fb972a10fac1eda0a16ce

SHA512
392d457f4c54088abef2b4deeb042220ab318d00d1157fc27386a5faac821c70c78c8452c99bc75758fa36643932938274c171589307919ec01e293010ea35fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VX66VOV\hd-style[1].css

Filesize
41KB

MD5
2ea4a69df5283a1cfd0a1160203ebfe8

SHA1
1c454fb9cac7ac0b1f65cd5c93bc2c9a0da8479a

SHA256
908a427dd11cc624f78bf96e4f775ba708e1bb1fbaaa8566977f3ec54416126b

SHA512
197333dc17a36ff127e6e001a898583322ad7ffa76e24003378f462b041e215194a2529eedd5f93e7e35a0e21dcd88db49c5afd18a0f7cff4cb00f50700c884d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VX66VOV\jquery.min[1].js

Filesize
84KB

MD5
c9f5aeeca3ad37bf2aa006139b935f0a

SHA1
1055018c28ab41087ef9ccefe411606893dabea2

SHA256
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

SHA512
dcff2b5c2b8625d3593a7531ff4ddcd633939cc9f7acfeb79c18a9e6038fdaa99487960075502f159d44f902d965b0b5aed32b41bfa66a1dc07d85b5d5152b58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VX66VOV\reboot.min[1].css

Filesize
3KB

MD5
51b8b71098eeed2c55a4534e48579a16

SHA1
2ec1922d2bfaf67bf3ffabe43a11e3bf481dc5d7

SHA256
bd78e3bcc569d029e7c709144e4038dede4d92a143e77bc46e4f15913769758b

SHA512
2597223e603e095bf405998aacd8585f85e66de8d992a9078951dd85f462217305e215b4828188bf7840368d8116ed8fb5d95f3bfab00240b4a8ddab71ac760d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VX66VOV\responsive[1].css

Filesize
66KB

MD5
4998fe22f90eacce5aa2ec3b3b37bd81

SHA1
f871e53836d5049ef2dafa26c3e20acab38a9155

SHA256
93fcbfca018780a8af6e48a2c4cd6f7ad314730440236c787d581e2cef1ab8f8

SHA512
822158dac2694341f6cf5c8f14f017ac877c00143194d3cd0a67ffd4d97f9bf8f2305e33b99fa12f62eee53ba18029541c0601ea5496ff50279d1200cfa03232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VX66VOV\script[1].js

Filesize
9KB

MD5
defee0a43f53c0bd24b5420db2325418

SHA1
55e3fdbced6fb04f1a2a664209f6117110b206f3

SHA256
c1f8e55b298dc653477b557d4d9ef04951b3b8ba8362a836c54e2db10cda4d09

SHA512
33d1a6753a32ec06dcfc07637e9654af9321fe9fa2590efc70893eb58c8603505f2be69084fb2bcbf929218c4e7df9f7a8bc3f17a5b41ed38c4d8645296ebab5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VX66VOV\sddefault[1].jpg

Filesize
22KB

MD5
aa005bab01a96cc8ada465b145645867

SHA1
3f34e409c60819b76eb988076545b69d0c3d7273

SHA256
e80a2f33030dbe31f5f1e8be2c38e0ed8cf1b97c657dc08f16f48424a19f6fe9

SHA512
4d2e0103ca3472107fe20e797d916963df98a0e8ab3d30bcfaa97f231ad43daa58f8c6155884a4191bcd1d81a2654bf282aaffbcf72d3596f617cceb2a5ccaa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VX66VOV\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VX66VOV\vRC03XtE[1].json

Filesize
31KB

MD5
4cbb1fbfe910b3c3f1f558d8d559b2cf

SHA1
297983d7d345026c6acc45aedbe3fa837d8356b9

SHA256
e39a65b65cb9a9dafc792c4b23b290bfb8ef2a188ce57f9f3fbdc89fb4c20cab

SHA512
2eed66e5588394fd5edd4162bb465fc76773d0d3f0b960316433e190aaa6f5dedf48676bac0018fd6016b408a1519f8937bd4ceb69624feefd3a505c138a06dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VX66VOV\www-embed-player[1].js

Filesize
331KB

MD5
e05ae65e7290835392021a7595916b92

SHA1
f1a340473bc52f98f2e73ee422b5b10d246b2fa4

SHA256
7a0c22ec1c43c774664255605c026a3025992bee2a2e1441d391e58b30cabbc9

SHA512
c40fe5dba0e7209ede7845892a3a5c92085d88263efdb3b6b9929d1bc269aaa517d1dd218a449ffc0aa3b82903ee5a840e021d6ceddefd57aff6d0419a0e3d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\68XY2BI1\7LtMhDD92Ma00lBiTiqZa9x8Yqf0prCAroDQalmaDn4[1].js

Filesize
55KB

MD5
d447710deffb5eaa88df7082d90976a3

SHA1
b6e97e02b255c2b5c89281429afb7470ea4f5b9e

SHA256
ecbb4c8430fdd8c6b4d250624e2a996bdc7c62a7f4a6b080ae80d06a599a0e7e

SHA512
2b6888491cd37c24c06df89f33da4e43d6cf4d5aed7358ce0382a59ded99731c95b0e3f1f2011a10797abadb97899f8a23bfd405a46604b030e80cf591344fc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\68XY2BI1\KFOmCnqEu92Fr1Mu4mxP[1].ttf

Filesize
34KB

MD5
372d0cc3288fe8e97df49742baefce90

SHA1
754d9eaa4a009c42e8d6d40c632a1dad6d44ec21

SHA256
466989fd178ca6ed13641893b7003e5d6ec36e42c2a816dee71f87b775ea097f

SHA512
8447bc59795b16877974cd77c52729f6ff08a1e741f68ff445c087ecc09c8c4822b83e8907d156a00be81cb2c0259081926e758c12b3aea023ac574e4a6c9885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\68XY2BI1\css[1].css

Filesize
530B

MD5
1e7cca7a1b89ea2980669f4adb65becd

SHA1
62da7767f3bb769a9b31e400df446a4698e4db63

SHA256
598ad75d6e2e244b759b3f376b510f0ba560b77cc74f48351dcf2abdb7df474f

SHA512
206b90eab94f9ce7260ec624ec9a8afd70bba96d4dc5d8a545a29cd73e55832196e509523da1123c2279eb4cb63fef429e28a3438a268dd3fabd1fd949caf1c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\68XY2BI1\embed[1].js

Filesize
66KB

MD5
266940708e18b768536a35ff3018fe34

SHA1
bdc725b2d6f8442260d996146e0aac75275af468

SHA256
3c27b6e9d3d30224a589131e2aae5370d19b32038e292e2d92198a73a8e5147a

SHA512
f22e4c43013a4024b5bf2289d69d24f8089d56562dd6987c9cf8474a8b352f0af359c2b5ff6aa9a9370835a46411dc3523144e6043d393eb17cbf339c157ab17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\68XY2BI1\jquery.fancybox.min[1].css

Filesize
12KB

MD5
a2d42584292f64c5827e8b67b1b38726

SHA1
1be9b79be02a1cfc5d96c4a5e0feb8f472babd95

SHA256
5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0

SHA512
1fd8eb6628a8a5476c2e983de00df7dc47ee9a0501a4ef4c75bc52b5d7884e8f8a10831a35f1cdbf0ca38c325bf8444f6914ba0e9c9194a6ef3d46ac348b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\68XY2BI1\main[2].js

Filesize
7KB

MD5
faec3cb464c51c9dd72fc71611fd762a

SHA1
2a275fe2cb1053fc2d009a125cfc2a238436d733

SHA256
012bddafc1f79b576c1e8fd540512a5ffdbfa1bbd839384b9b9938a7387849f2

SHA512
66ce929c3942e093a9e7995de874f810d20056ce4fc4a82257e0185752dada03122ff68a35307f34ae8617f131c8ffffba803bb230b3bffbcfa7f0a329418b10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\68XY2BI1\o-0mIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjcz6L1SoM-jCpoiyD9A-9a6VQ[1].woff

Filesize
16KB

MD5
642d45886c2e7112f37bd5c1b320bab1

SHA1
f4af9715c8bdbad8344db3b9184640c36ce52fa3

SHA256
5ac87e4cb313416a44152e9a8340cb374877bb5cb0028837178e542c03008055

SHA512
acda4fedd74f98bcee7cf0b58e7208bdb6c799d05fa43b3fb1cd472e22626322f149d690fe5f2cdc8953244f2899bebe55513b6f766a1f4511d213985a660c3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\68XY2BI1\recaptcha__en[1].js

Filesize
537KB

MD5
c7be68088b0a823f1a4c1f77c702d1b4

SHA1
05d42d754afd21681c0e815799b88fbe1fbabf4e

SHA256
4943e91f7f53318d481ca07297395abbc52541c2be55d7276ecda152cd7ad9c3

SHA512
cb76505845e7fc0988ade0598e6ea80636713e20209e1260ee4413423b45235f57cb0a33fca7baf223e829835cb76a52244c3197e4c0c166dad9b946b9285222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\68XY2BI1\style[1].css

Filesize
165KB

MD5
65760e3b3b198746b7e73e4de28efea1

SHA1
1d1a2cce09b28cffc89378b0a60cbb1aa8a08c4f

SHA256
10e40ea3a2ad69c08d13e194cf13eb4a28a093c939758a17a6a775ef603ac4fc

SHA512
fbcb91f26b7bd874d6a6a3b1d4d6f7277ded091cdae5706c285b4d5d17446a1bf58572c224af38393ce49b310a51d5c5d60711c7094e5d32abbaaf10d1107e1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\68XY2BI1\www-player[1].css

Filesize
378KB

MD5
2e4117c51e897b0cbaeed1dd321eff5d

SHA1
d6010be53e4e0f1cc5b951663c14619e00b9d519

SHA256
462d837d5eb151ebc17aefb77ded3dc9bf3edf7a43e0183800a54a1de3a58caf

SHA512
5684c70d9a7e1e6bdaafe80cc35fdbfe9024a3f3bb8899116c301b3023b3818f93ca64f6f42aecb99fca6c8c45aeed946bbf5a8db8fcdb16ea0f58373179c58d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\68XY2BI1\zyw6mds[1].css

Filesize
1KB

MD5
a5bb75d5bd1b19def25c1dd4f3d4e09c

SHA1
d0c1457e8f357c964b9d4b6c0788e89717fe651f

SHA256
ff0689879c72300a01eae0c05c3205e2ca57c4bc1a6bfa0718fa6fea4a51627e

SHA512
b9fc57f7ade8f34cb02ece2935acb30757ed846e4bcf81d3fcf5bfcb45611d386bd337a6337e9945c5654cf044dce4dd3fafd60a2b42ed5bdc857ef96d077a69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F1EZZCYM\06yJzDef[1].json

Filesize
1KB

MD5
22c967d69f0d5054cdf0c3725cb8b2cf

SHA1
5578de8e9b2adfedec93b3483096d6b39c400678

SHA256
de059be36fa3924307eead3cde43546467f695181804528945151ebe0e5a0c51

SHA512
d1cbc0ebb7a8e0c1337d4844fb717ff17f5e6d155b1c3e95c547e56d3c33de9470d0c2be99908d0adf2fff5e389f9742c8f445b76a5fe4f71a60f4626744bce3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F1EZZCYM\KFOlCnqEu92Fr1MmEU9fBBc9[1].ttf

Filesize
34KB

MD5
4d88404f733741eaacfda2e318840a98

SHA1
49e0f3d32666ac36205f84ac7457030ca0a9d95f

SHA256
b464107219af95400af44c949574d9617de760e100712d4dec8f51a76c50dda1

SHA512
2e5d3280d5f7e70ca3ea29e7c01f47feb57fe93fc55fd0ea63641e99e5d699bb4b1f1f686da25c91ba4f64833f9946070f7546558cbd68249b0d853949ff85c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F1EZZCYM\enterprise[1].js

Filesize
1KB

MD5
713a9b6c79e3c306b3a3d87c2fc39dd6

SHA1
5f76a6d5b1d747f3842afe6fa77bf544c2a6dc88

SHA256
bcf7ab6c79db06e42e9a9ccb23264cb20230850b5947bff3d2ebe57e1566e3b7

SHA512
34d74fcaac2eb971da023ff6619fab65915755c987eb319febb6566721e1e3e71f96d22b21c3eef61a747b14e2f153120eb0b9f673f40fc1a9175c9ad19d6cce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F1EZZCYM\hd-js[1].js

Filesize
23KB

MD5
6761faa022e0371e84e74a5916ebaa44

SHA1
5320c3d53d5447bad2a02c63208deca7fb94b655

SHA256
da17fb5b54c0fcd77c7358ff274823cb6a02ba0c4b6fcdf347c1ef611818bd9e

SHA512
a8cdba92942f299b648e87109d193a1f7eeb8f243eb2bbe4224423b512c400fccf930d81cd403a925fdf99220fdffcf89da69305cdc054963a64da470072d019

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F1EZZCYM\hd-js[2].js

Filesize
337B

MD5
3646bb11d5a2e842a0ea18721385bbac

SHA1
d0d1337d603df0e7c9fdea533690bc6e19a7a232

SHA256
c6a9f9f6560a1545aa8dc8d7e3b6603a3c269a4f4e3f6b7952b849025cb4f769

SHA512
2f9bea6f3124767d9314ef4fc07011fdb3e31a1a7bc866c6c3d6b736148e590dea45bb5961759c0829f3d7b84c9297683ffc5ccecafa7e7e8db765f61e00bba1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F1EZZCYM\o-0mIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjcz6L1SoM-jCpoiyAaBO9a6VQ[1].woff

Filesize
16KB

MD5
adda182c554df680e53ea425e49cdf0d

SHA1
9bcac358bdab12b66d8f6c2b3a55d318abe8e3ae

SHA256
d653648b9d6467b7729f0cea0c02e4e9f47323c92a9fcdbcb12475c95ac024df

SHA512
7de2140ee3859b04c59a9473129c3acad91022962d46ffc63529bff278661f0e106a16dde90e8db523f826f82e7c20ad9b23f45a25e81932fd2d8708b616fba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F1EZZCYM\p[1].css

Filesize
5B

MD5
83d24d4b43cc7eef2b61e66c95f3d158

SHA1
f0cafc285ee23bb6c28c5166f305493c4331c84d

SHA256
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

SHA512
e6e84563d3a55767f8e5f36c4e217a0768120d6e15ce4d01aa63d36af7ec8d20b600ce96dcc56de91ec7e55e83a8267baddd68b61447069b82abdb2e92c6acb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F1EZZCYM\styles__ltr[1].css

Filesize
55KB

MD5
4adccf70587477c74e2fcd636e4ec895

SHA1
af63034901c98e2d93faa7737f9c8f52e302d88b

SHA256
0e04cd9eec042868e190cbdabf2f8f0c7172dcc54ab87eb616eca14258307b4d

SHA512
d3f071c0a0aa7f2d3b8e584c67d4a1adf1a9a99595cffc204bf43b99f5b19c4b98cec8b31e65a46c01509fc7af8787bd7839299a683d028e388fdc4ded678cb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F1EZZCYM\unnamed[1].jpg

Filesize
1KB

MD5
9562333de0510b42f9cf9f316967d903

SHA1
cf044643a23946f7a1b63e4c5a506ac99a90a66c

SHA256
7c71aeb28c43250d69e9d02571ce233ed30791bb4e1a391eb8c70f84f8e36d08

SHA512
edb342fa84c8a27cb22554b97dd4b2567bd13d5f40f687139848de21f52116be301f75e695637dbda385f6dc979bdd901456f4b0c324ae83b105e4d34b3162c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F1EZZCYM\webworker[1].js

Filesize
102B

MD5
ad5e6a567d064cba36f2a56caab2d866

SHA1
a3b46ea0ca5df5a6b6ab6bb228cf805065523cd1

SHA256
e70942d2b905910af2538c685c2223c25e5068bfbccb9742cfa5ffa48150d291

SHA512
ba45b3d74c0d2e0ac22bc97bacb6df549d7a4eae8d64050af41167376926f4379ccb6be84a666ba615caa7c5ee6838f98020c530f5c2ce51f71dad369d130681

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T1CTRFUW\1LL1UCX0[1].json

Filesize
5KB

MD5
97251dedbfd112d65e103edc1ae5a7a7

SHA1
bc09e25832a266bd15f20b94684594adbf4793de

SHA256
e2f0ef97b6eca62245eaf2621087c243219c6c8fb00d82b272302aded86e64fc

SHA512
51be8f46544a3bedc804524cff7a83ce8837d61781ee21f5bfa5a10f4fdf6e389bd2776bb847601c0e862d39fbe8394168c22a61d4da232171fdd27045a2437a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T1CTRFUW\6QS9yUPc[1].json

Filesize
43B

MD5
70e8813660407811c62eba5acca1f1ad

SHA1
e93c5488b0a718254320e33561a30a45f00472d2

SHA256
54721369b6cd68e91c6b07a6f6737fa8458103ebb911647a7cd52475ab35ca56

SHA512
10830df949aee4f742cde8ebf80d3ec963c0e9af2c764edf383e4d5a09ba7b127daab533f4ca0a9884e74df6dda61e4ad64f9c22648377923995d6e3d03ea739

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T1CTRFUW\KFOlCnqEu92Fr1MmYUtfBBc9[1].ttf

Filesize
34KB

MD5
4d99b85fa964307056c1410f78f51439

SHA1
f8e30a1a61011f1ee42435d7e18ba7e21d4ee894

SHA256
01027695832f4a3850663c9e798eb03eadfd1462d0b76e7c5ac6465d2d77dbd0

SHA512
13d93544b16453fe9ac9fc025c3d4320c1c83a2eca4cd01132ce5c68b12e150bc7d96341f10cbaa2777526cf72b2ca0cd64458b3df1875a184bbb907c5e3d731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T1CTRFUW\ad_status[1].js

Filesize
29B

MD5
1fa71744db23d0f8df9cce6719defcb7

SHA1
e4be9b7136697942a036f97cf26ebaf703ad2067

SHA256
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

SHA512
17fa262901b608368eb4b70910da67e1f11b9cfb2c9dc81844f55bee1db3ec11f704d81ab20f2dda973378f9c0df56eaad8111f34b92e4161a4d194ba902f82f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T1CTRFUW\api[1].js

Filesize
870B

MD5
db3f5a748364d84b2b5f75e3d4e851d0

SHA1
17b34ff20d429abee726b4b74530e5af2819f7bc

SHA256
343ed5ecd144d781de67aa8638b1ca4fce5772faedbb72720daacb250884f4e1

SHA512
3ee552fff8e93097120367c7f5f6aed88145150d706349542e8800e65722f4e6507bc0802e41a305cda56aaf4bcd40c036ad7a4d2aabea9dc70f908bf400dd90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T1CTRFUW\d[1]

Filesize
23KB

MD5
ef76c804c0bc0cb9a96e9b3200b50da5

SHA1
efadb4f24bc5ba2d66c9bf4d76ef71b1b0fde954

SHA256
30024e76936a08c73e918f80e327fff82ee1bd1a25f31f9fce88b4b4d546055d

SHA512
735b6470e4639e2d13d6b8247e948dbd6082650902a9441b439ceacc4dfce12cd6c9840ee4c4dcb8a8f1e22adb80968f63ace0c0051811a8d6d1afb2b3c68d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T1CTRFUW\domain_profile[1].htm

Filesize
41KB

MD5
1f4492f23151d9b3ca2fc6e40338fd65

SHA1
3b46a09474323eb54cd211ea0bc29d7d689c3c24

SHA256
2c71f757d5d5a40fd1661c27d557968f4ad2efdf89f877a228a6770c15e0b7ea

SHA512
1efb9428c92e9292eedde3b143d32dccf5f872b73a0eba4b57ce74a67f782059073dd43206f0d14de8f598ad912145b03fc6b9e5aa1f4f4ff4bb99f40e43665a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T1CTRFUW\hd-header-logo-2c[1].svg

Filesize
3KB

MD5
fa6d73cc465daa5f584857aa004f4729

SHA1
952d364499d87d7bea937c15ccaca7eb8a75579d

SHA256
af0f4612dcae6b4292585288e5507f20bf891a710ba8490aaf8e4906307217e9

SHA512
4ff491c7449383da9f3855109a562bf72f569c820696437af5b29c110aa6fed6948d7af62c3ef7a6a548411b1346961d2a604c104955c115b75b715fef44fa32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T1CTRFUW\js[1].js

Filesize
211KB

MD5
c9e66db1bf259d648a0ca7303f472c1c

SHA1
a3f24c9dfa49b7deacf6f10758a66cf8ee497310

SHA256
2382faf384fbd8d7e89890d9d6a33ec95426e9789a71653b5f0d9f72661b792f

SHA512
82db447cb988a37d2bd1ced1e766c10d93ef08d36b04f0708cb241287422dd4c4edc4e41901ea869e5b9d001b137b3742815750cbd3d5fcf1e89a15b598debfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T1CTRFUW\s4ZKec0ldEsS-2MDx0qlDG7a5lj7SG-kbfY9viat0F8[1].js

Filesize
25KB

MD5
44bc76a05f222d01afadbf232937a634

SHA1
0e5594d2ab92cc94f3de04485d3632a2fda7ce81

SHA256
b3864a79cd25744b12fb6303c74aa50c6edae658fb486fa46df63dbe26add05f

SHA512
a1dc6c361e481c8a086d66cfca556966754269300f415fa701746c551c85153d4830c26575a77fe68120dbe9039bd78b0f3a59608a6c93d79a9cc7b438f96b01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T1CTRFUW\script[1].js

Filesize
96KB

MD5
28becf0e5ce8d65f6f9e33e5954a1a79

SHA1
69d67a8f41d803b62218f02a28ebaf53f32e072e

SHA256
c59fa2847d6798cd7b5ebbd9b7832eb95e6b8aeffff195d3312ac7094049ac50

SHA512
3d6734183f99b73e5bf6097f2f388ca83ca7d20a849b77c871e28c2cd3e65d9fc0a020fbd349b08bbd916493089396386623d695af964a6a1f273429cca1ad6b

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
811KB

MD5
eedaecf0ffea1c2a6c683181bb0983ec

SHA1
a588660bd3a3d0fb84b7dce66606fa90aa05b8b5

SHA256
4142bb6c07f4d2c83507fd59b5fc468d0e02159376e5add0d36eeeb29918032d

SHA512
265614ad915ce396bbad77e2d691bd5f18bbf4057601a356032c1f803d2cdc5582ca15a2e3b8ddf98b97c5faa1fa37ae42838d16f0b55eeb402d18f55be7a5bf

Download Submit
memory/1224-21-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1224-26-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1224-38-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1224-40-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1224-1118-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1224-332-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1224-25-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1224-39-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1224-29-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1224-1233-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1224-927-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1224-48-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1224-109-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1224-543-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1224-479-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1224-705-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1556-14-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1556-0-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1556-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/4020-15-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4020-20-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4020-24-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download