8a7cf4befa9a37eec8875e0d1fd0591713e0bb336a68dc1deaf11d94e69d0e1f

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe
Size

465KB
MD5

062acd5f4ae15614f95b3e7bbd77a5b7
SHA1

5ffdc1bd056b5d4848213c42c5671c95719dcbd3
SHA256

8a7cf4befa9a37eec8875e0d1fd0591713e0bb336a68dc1deaf11d94e69d0e1f
SHA512

1cd8b791a1deb76466d467a108356913d957fc0fd50867bb13f19f8350a4edbbc19557470de96251d4c8a28cb787eb87e9c1a64f3b4e45b848ce6921a1f5c689
SSDEEP

3072:DvF9Qh6G2J9yfe3GTOOZrgNElvPshN+WZjZfg6cibA3:Dd9XKW3kOcU4pWvbi

Score

10^/10

defense_evasion discovery evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 14 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctrl.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portmon.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navrunr.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webtrap.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drvins32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\evpn.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\n32scanw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav7win.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xscan.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cclaw.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsched32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfiadmin.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HelpPane.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdoc32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nav80try.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srwatch.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\titanin.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet98.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Netscape.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibmasn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naveng.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscenu6.02d30.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vvstat.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmias.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firewall.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsshld.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwebloader.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashWebSv.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOHTMED.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csinsm32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ecls.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iris.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bs120.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\claw95ct.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dv95.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netspyhunter-1.2.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswinperse.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Opera_964_int_Setup.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aupdate.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clean.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HelpPane.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\espwatch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SandboxieRpcSs.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscenu6.02d30.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winsfcm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VACFix.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Safari.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv9.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweep95.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmain.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdclt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\watchdog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrecon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnotify.exe	winlogon.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Executes dropped EXE 3 IoCs

pid	Process
2108	winlogon.exe
2312	winlogon.exe
2404	winlogon.exe

Loads dropped DLL 4 IoCs

pid	Process
3012	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe
3012	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe
2108	winlogon.exe
2312	winlogon.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Indicator Removal: Clear Persistence 1 TTPs 42 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXTEXPORT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANOST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETLANG.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WORDCONV .EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINWORD.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GOOGLEUPDATE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IELOWUTIL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEXPLORE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOSYNC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOXMLED.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPREVIEW.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSHTA.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DW20.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DWTRIG20.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IE4UINIT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEUNATT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\INFOPATH.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSACCESS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORDB.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SELFCERT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WXP.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSQRY32.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTEM.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GROOVE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OIS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONELEV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLVIEW.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCEL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSPUB.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\POWERPNT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCELCNV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GRAPH.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSFEEDSSYNC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ACCICONS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CNFNOT32.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOHTMED.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OUTLOOK.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANPST.EXE	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2896 set thread context of 3012	2896	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe	29
PID 2108 set thread context of 2312	2108	winlogon.exe	32
PID 2312 set thread context of 2404	2312	winlogon.exe	33

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2896-0-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/3012-1-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2896-2-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/3012-4-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3012-5-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3012-6-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/files/0x0009000000015d6e-11.dat	upx
behavioral1/memory/3012-21-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2108-29-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/2312-32-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2404-36-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2404-41-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2404-44-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2404-40-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2312-53-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2404-73-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2404-666-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2404-2521-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2404-2582-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2404-2677-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2404-2773-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2404-3309-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2404-3485-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2404-3582-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2404-3681-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2404-3771-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2404-3867-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2404-3945-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2404-4026-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\Sound\Beep = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\Sound	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 50 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433953997"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://v9rkqd52v4x1zo1.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://fotry86r7hh770c.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://16ytnbe30t8k658.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d907000000000200000000001066000000010000200000002eac6343f74d7af6006815593f08bd44023c271d761635326a2be609bdc2acd2000000000e800000000200002000000006a4b3b099b81f54a7bb2af19a6244ae141473bfee7176eb22f10758930e81369000000092295f321755208ecd71925ab86816bced1166c2599548dfa4a5169e181c1facc97686ed45d13078f2e8113ab895651dc13f49a44b5640fd2acbd8dae1b6733625eecab368b42518a2066438c4cbf059a8bb421bb71c1dd0d07a67bb3b64139aad86a8e4a77823650ba7651b6ec8b3592278284d1f0b9d5d88efbbef312fd90ec549a94ec6459e893c5d95cace52baa440000000518a7558116362efc50b6e14e00a9afa2064634f0ebcf2f5eefdc1b97c2d0c10b962235dc5fdbf7cd713d034cd5f72b624f431cd6d3a9ca7d5532d47470e27f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C9EBEE1-7FFF-11EF-923A-F2DF7204BD4F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://wde0lw0156za08a.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://ld05p7aw2k46262.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://zy3cv13s8u9198x.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://j0d5r8pupmxrxob.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d907000000000200000000001066000000010000200000008400cfc49a8e595af20507106ae121fa3c943db8beb627ef43538210e1308b3c000000000e8000000002000020000000798b9b640a3056e96b9f4ac1a0dbe8527365cc6a7debca0fc07a82e14dcede392000000047ae4d819d86218af3d8ceae5b1bc19821623c8188893cd90d91547e9cd9364040000000406f7871a200a7e0036136429404b128ef56f0ea08bf1292f6228e8a1f2b594121fefadeb5f6077bd4084ff180460873c23be5baa704681a650827b6b4556365	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://5ndah8dqwz4766r.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0fb7b610c14db01	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://91l132ho8118em8.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://9104bq7l03f6juv.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2404	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	2404	winlogon.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2488	iexplore.exe
2488	iexplore.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3012	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe
2312	winlogon.exe
2404	winlogon.exe
2488	iexplore.exe
2488	iexplore.exe
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2488	iexplore.exe
2488	iexplore.exe
544	IEXPLORE.EXE
544	IEXPLORE.EXE
2404	winlogon.exe
2404	winlogon.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2916	2896	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe	28
PID 2896 wrote to memory of 2916	2896	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe	28
PID 2896 wrote to memory of 2916	2896	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe	28
PID 2896 wrote to memory of 2916	2896	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe	28
PID 2896 wrote to memory of 3012	2896	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe	29
PID 2896 wrote to memory of 3012	2896	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe	29
PID 2896 wrote to memory of 3012	2896	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe	29
PID 2896 wrote to memory of 3012	2896	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe	29
PID 2896 wrote to memory of 3012	2896	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe	29
PID 2896 wrote to memory of 3012	2896	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe	29
PID 2896 wrote to memory of 3012	2896	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe	29
PID 2896 wrote to memory of 3012	2896	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe	29
PID 2896 wrote to memory of 3012	2896	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe	29
PID 3012 wrote to memory of 2108	3012	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe	30
PID 3012 wrote to memory of 2108	3012	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe	30
PID 3012 wrote to memory of 2108	3012	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe	30
PID 3012 wrote to memory of 2108	3012	062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe	30
PID 2108 wrote to memory of 2180	2108	winlogon.exe	31
PID 2108 wrote to memory of 2180	2108	winlogon.exe	31
PID 2108 wrote to memory of 2180	2108	winlogon.exe	31
PID 2108 wrote to memory of 2180	2108	winlogon.exe	31
PID 2108 wrote to memory of 2312	2108	winlogon.exe	32
PID 2108 wrote to memory of 2312	2108	winlogon.exe	32
PID 2108 wrote to memory of 2312	2108	winlogon.exe	32
PID 2108 wrote to memory of 2312	2108	winlogon.exe	32
PID 2108 wrote to memory of 2312	2108	winlogon.exe	32
PID 2108 wrote to memory of 2312	2108	winlogon.exe	32
PID 2108 wrote to memory of 2312	2108	winlogon.exe	32
PID 2108 wrote to memory of 2312	2108	winlogon.exe	32
PID 2108 wrote to memory of 2312	2108	winlogon.exe	32
PID 2312 wrote to memory of 2404	2312	winlogon.exe	33
PID 2312 wrote to memory of 2404	2312	winlogon.exe	33
PID 2312 wrote to memory of 2404	2312	winlogon.exe	33
PID 2312 wrote to memory of 2404	2312	winlogon.exe	33
PID 2312 wrote to memory of 2404	2312	winlogon.exe	33
PID 2312 wrote to memory of 2404	2312	winlogon.exe	33
PID 2312 wrote to memory of 2404	2312	winlogon.exe	33
PID 2312 wrote to memory of 2404	2312	winlogon.exe	33
PID 2312 wrote to memory of 2404	2312	winlogon.exe	33
PID 2488 wrote to memory of 2424	2488	iexplore.exe	38
PID 2488 wrote to memory of 2424	2488	iexplore.exe	38
PID 2488 wrote to memory of 2424	2488	iexplore.exe	38
PID 2488 wrote to memory of 2424	2488	iexplore.exe	38
PID 2488 wrote to memory of 544	2488	iexplore.exe	41
PID 2488 wrote to memory of 544	2488	iexplore.exe	41
PID 2488 wrote to memory of 544	2488	iexplore.exe	41
PID 2488 wrote to memory of 544	2488	iexplore.exe	41

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:2916
- C:\Users\Admin\AppData\Local\Temp\062acd5f4ae15614f95b3e7bbd77a5b7_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      PID:2180
  - - C:\Users\Admin\E696D64614\winlogon.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2312
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Modifies firewall policy service
        Modifies security service
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Windows security bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Event Triggered Execution: Image File Execution Options Injection
        Drops startup file
        Executes dropped EXE
        Windows security modification
        Adds Run key to start application
        Checks whether UAC is enabled
        Indicator Removal: Clear Persistence
        System Location Discovery: System Language Discovery
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2404

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2808

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2424
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:930835 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
fc55823a96a15ff5065131aef9afa4f6

SHA1
e977654dda843e6809750f6a1008c2407df3b47f

SHA256
982431701c6caa9cf58418d846d903b2be003833200e73918e1facb915a126b3

SHA512
f656776f3749fd353b64c473e0c79aa045c7de0ffab167eec3fe0d26e328cba9caca4d961bc3988cb3b737ffdae06039d73332831d00eacdcaf83a46c3bc3f0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
2KB

MD5
3a3d4fe41a2b315354c233da53d56019

SHA1
1e5c1038af89ef2817ec9b2e2f1a4fe356414cf3

SHA256
a6c7242684e72de27f67bcb2fc46268be7007b999217cf35c1e7de3024792f6e

SHA512
fbe2f2652dd66aa87179f67419f9b6dcc02d79bd8dee6f699abd01589d4ae2d4822c3d6e2f904c56eb838a9f407970e9abf914cfbeb48a10e48a52e01509e43c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
7fb5fa1534dcf77f2125b2403b30a0ee

SHA1
365d96812a69ac0a4611ea4b70a3f306576cc3ea

SHA256
33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

SHA512
a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
2KB

MD5
2dbc8523544d6bdcea46d6d9fd53f3e4

SHA1
589889c5465e77cfff3cb9f629728cdece1564bf

SHA256
b81f47aa130a42cdef7f1639f83c11d5409440987d2f14a9934123fcc4c547db

SHA512
96881179f7cc3ce1e40691f732f1b00710e34e17b33cf8e63aa7ecf0a21f92430a679ada4d41d24b734b2a1639e60dd8dcb5e76ef7ea754e4bf2be257b2eb8ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_71D00F0D3698C81F2158FA9703C4EFA3

Filesize
471B

MD5
bbf63482d6b9bdbe010dabafb13c8ef7

SHA1
530670e8d51eeb3063d6bf0f85ef47eb5a5fe459

SHA256
d02b3f4326f1bdc64ce7938dbe454ab62bea4b1896955d1451e5046dc2674f1b

SHA512
0f0fba74765b99f6d8eeb4bd4a275c651bfa78727ba2a5df0e37a3a7f4bda675c3a19eef353d2fee9c2f65f8ebea9a2f7f05c8cb08a5ffec25237ccf485b232b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
c995521fa71fe8e5dfbf056670348ba1

SHA1
6e01dd35c6504bbb97f887b937c32d90f9650e5e

SHA256
cfd07a57e6b46377f5e76e9d74a39fc800f16ec30003f58997adec82330afb7c

SHA512
20a78f1135ccc30d29cc6b5c724eef796c8a7e05cc900d631d3a4903a448ea90e2cc1537ad4007237f7e9346ec68ddb7e12c6064475bf553a4b55877cf4f8e55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
a3f54fad158c538b36f5020e524b9126

SHA1
e0fa76b75c77e47aadb88699b82de568b39ba1aa

SHA256
5feb52181150cf878ad0ee76db1c6f1641fb24adbad53b2e6e086b5db6982eaf

SHA512
7a309e4f400f256ad91667febc313103991cad88b665f53ba87467a3fc9490f07397d8bf62c6875806b155b32eea7de8c0ca8c6c1d0ca135e08c6d9aa78806f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
aac4083b583358dc8e6124df491984b9

SHA1
b7a7fe2c06ebf0790c5c0aa60cc97dd0db97870a

SHA256
6d6129fa70c1bc3881c7fb987277af484f9631c50fd7eb465d388464ef3f2321

SHA512
98bde033ca4c5866001f83f8013ab489c44a520204bdb05e635cb27a4f7be39e7794121752f81aad45d2f351bddc9c8b005cec351f22a1fa9566bb41ee76c0e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
466B

MD5
4306501ee8cf2f443952aced95f459ca

SHA1
fad61fe0e030d63619c023b9214c2e0106eeaad8

SHA256
1682a8833704678fecad0071ef53cd2ac00c6e2bab87d84aab107afa66823afe

SHA512
94fac89e6a0c1290691defb47f3b93e5c564ecd89fae8d291e287314c9d2d7c51da39daae74a9015da22d89e4c846118be69de98d3925810dfaf7f3780ec6bde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
d59a7a4f3fb454816fef3bc15dd925c0

SHA1
7e4c07f2a1b01af0f053ee4ef9509e97c1722c26

SHA256
012dad6f5a054d6174a8350e48dda6b31080a22f68e0787425aa981b23ea0385

SHA512
6f91dacaeb0b735c38481d100ed97fc83dfd6cce09c81cc830115c4ebf7a8d8dceffdfad7d20a686ee8100ef297efa9383aeebd415a3d3af05e0e786a461504b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6905f76d5bc3eeabcfbd03825d1fe09

SHA1
3368a068c906f55d5854d2e9794835b031d2ba86

SHA256
2699c4f5b42e59e07a6c25a0b6e2ba631b780a275e686cb14f9566ca236cd683

SHA512
27248556a16507f81f9515e0b29be91697465cf6bcae500bdd0300f844358ab79bc78454962b9c8f7f76a13c05a8e9a49f285b6dfa92ad06ac1d472491c71018

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21592c397e85b4f3e1dc6835d167f3bb

SHA1
b3ad4da88faf076b2b8172fdf6b0c7754ab61951

SHA256
cafffc49f4519012f33a7ce2c79beca65ef5b5bb589b1db5756e86523212d987

SHA512
9a7c89bb88d19a44c6cf702bf3ec982ee185f561dde87b4a224c2af5d45e445023b084dfba8e65fe6d71022c7d542e6346f570a4a423a241bdead9c2abfaca1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f468b29225d9b80182c23edb272f372

SHA1
b89339ae389c0520f80c541f798b4b6f542377a2

SHA256
36fe556ba1966edc1653618a343a7933a7be8476d174fe39b447191abbc70b76

SHA512
3d3f18543ce08c1f629bd6a89864d5040ce8b27193e2b5e3a92520a89bd003d4b181bad5636956278ea6ef5019f54b8b30205f61ca55ad5c98b1f8150acef84d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6bec5a00ee8a05b7fc5609f779063c2

SHA1
9e21eb318a132a43f3dd7928718f7a5b92df49fd

SHA256
15c5c843ebc7dc7eaadf12a7b9f2a7932888a1afde9896c04ed16c70ca5c89f4

SHA512
e05ffbc970631919ee2356a4cc42c7e8fe9a6817d23bd34608e1183842e6ec859c7b1696e2a5b6b8da6e665c143d47644d66df87354b152684e0f369f3246c5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48a43005a3d41ac516c9a28c0d27c256

SHA1
23f3d225388b7c0bd9c06002cb11b4b0d47e97b5

SHA256
f8760cbfe98d04a0074fcd63ec8a2388d858652bbf954084d3778888be0cdf80

SHA512
f98ed25e0357c02d738646caff78a5a2721259a80f8064f336181dff48d5f68e55c92acd34b38804c318c6ec071f00aa26ac58840803401b922d928598bfcb9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5dd8b51a619ccc7fdf53163ee9a89528

SHA1
8d842fcf9193129b649f9d25529415484c04adb9

SHA256
d9340f046ad334c7413c6b1f18a04e1c18a1ca53abd7ee56a72acc1be9d1fa29

SHA512
3d5f11f6f16825b51a68a7b00d2ed80ad4f55a05245e929184f50dd865d3c2a3c5f1cb2b418c06edc8d0669c5fd8c723e03e304dbcc2dfb5faac81a68e590f2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e76ae7e3e670dfdee4f07289720077ad

SHA1
846ec0d9353b66300048339c6eae2693a8e0b5f2

SHA256
2459ef15caa83917e02d52c52c1d23cd250b23fc49ac10c1473f8ffbc6136cbb

SHA512
05506ad5715694e3adcb91d5530eccac63f6086dbe4bfdd9f243f189de196e767c8a680768d5799f069cc27233ea32e0bd659b92672e78c692e52296bcdba920

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
158507e5b880d32950cc726d4b2d5d3d

SHA1
726c8bca1c9f3b4f38b526e1aaf9b0705ec655f8

SHA256
6b7d6dcfa240738a7bf7a0574fab2d33b59e160c012d2c4fdcf001e4ed5eb1a1

SHA512
b8c199105ef806ef22f98e2fb323f67daae4b9427dcc801e7e41b4934ccd434a919019239229b2021010ebd5198c723127604c9f2aefd55c20ce9c1d2aa76717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bed59d3c2bf1fa72159db01a536a3f1

SHA1
69c6e2dc65404eb3bc02d7e790e53e6ba6016971

SHA256
de17203fbc4191f8ee96e75493d21c462e9979ce24433f8bdce289d780d06d81

SHA512
8d6eb1b511361593aeccfe13b61e6288b3d040ba477c24b5ac8b5f5ae1a826221c85751c6ae14f32c0b45ed9572045d42185b82b61731843aef46213fb4bd731

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af8d655e1ad0fe46c8e51e17c57343f1

SHA1
ced32e743ccaa40cb9a827f1a423cdec9d3bfb35

SHA256
ef0377bf100787cd31d9a010365434a04c99bad92ab8fd33205e72a06e5144b5

SHA512
a1d266b42d5eb1e7961a1bc271b18a84588a4f1cd46a0b8a5d4a98f47bfb568d65746ea06dc471c2e68376cdbfaa28c51858ba2e6b8fb56ee5b246f449c76fe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59ca35cdd26f1a0c17134638e0f18bbe

SHA1
fcc483665488859643b6c34cd1cc73d3bfab89b0

SHA256
3676080bbe23db43deb3bb6e4442ec2b0e0a276f6faab404196a6f3807a7342d

SHA512
fdb4e72a965dc2371b20d66ef263326918ec7d14160afcf3597f1ce2737d414deeca02e54160eee3eefc2f7787ddcf1af51fe92f85ceb6a6c8d1e24290a53473

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43c9929c52c2467362933b33b426f4bb

SHA1
8accd96f60a5c3a36cdc5687b6065a7619be023c

SHA256
d3db777917bd2f55dc5192328431c8e6eda5109c2f1e8061469f8d5c02f517a1

SHA512
5f49f964d50273dbf07dc4c7bd9483e7ab2fff61ee517980a2d779bfa8c26a46a68098de99b289f31036964186c0ab33c9f35e4a59402d579a48b52dc30827a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09b0cb116b01f719793abd1f83edfcec

SHA1
d8e56f741fda1bc5b10d8992d1eb44700b819c62

SHA256
6fd0ef62356e2695ec36062352906bdea280b11954b2bf2cb3a8f76d04d8d480

SHA512
953149b93cdef2b157a3f64c40692d558702b300e703e66a048c7819b71969567f4757b9b9906af742092d242e9c802a447f5ee562d8b80791384d5705658bb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
997eca7bfbe6b58fd8c4edd248a23874

SHA1
8d922aa14dccbf37c2a2ac241f7f781be068b546

SHA256
115f731cab550f2bc8018aa75ceb2f43510a7dd69d283b8c9227c3186fa39dee

SHA512
e3c49f163302cca29f74f421e256c7e0978a17dd167b9fec08ccc4056ffd1240a94cce61b06db7bd9eb4338e8ddf2a81606602e554e808e0a2c8197ff2d25a93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
667161186a1c8ba58fc1f4694651a417

SHA1
4540576afb2f426aaa04a3a5a35c8cedca1dd14d

SHA256
c99b8e209043de24867f19d3a37e14f0acd97d44304bcf39c32314a6508e8617

SHA512
6958c924aad47d3d5ceee27e95e7f7b209815937289337f6348a28d10217b89efe648cc44d55e582d4a20eefb42f84fb1c39b4c7f317b8d1b80f4a951347b8ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afeaa83b713b7cd45f85b764ac3696b9

SHA1
7232ff56dcd02d38d93c912e4a4f22e933ea1ebe

SHA256
89f5474112502d4ce6fa0964ecdbc6b905a1c42c0e60ec9a5d0d07eb28bc869e

SHA512
032abe2567483fb3bca302581332d8c2925ad990a81adafdfdcd5a5a6c172f7ca600cd2be2e8db8a3308217d74db059993fe8b00f4a1f934e3c5cff3ef254835

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e122b0179e1259995a26996fd19b06e

SHA1
88639ba20f8fdea22f179b1c784485ac76a78252

SHA256
f96a568fd96d8313ceefc59a5b6f065212b268c6a3bdb66f4b2ecdc790b50ac4

SHA512
f8c652dbf249003180128070f1a045a8e0bebf2f5095167e82b21e91bad7de77f8d18773128c5c6ceef6a1a4851ceb45805cf93ce550fc82dcfdafd88f3029cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ff66edf47ee2d61ab955f7a457b1351

SHA1
3cc7d9410d43f572a0b83e8f1fa348aa554676cc

SHA256
87c21b0d8dc4c5f6566c08d3df7aeda0d693ff369a6abcc24617dfc7ed190626

SHA512
571349b29a635fee0404bce5c7eb3a8b2cb3e10c2f83a110f3854480e4a969fee53f7ed64497bcf40a91e4d1bba30a58072134bc5d97b89e31c12222ff0f264d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d87d63d032b7f46c405e8b4f8c4fdfe0

SHA1
4954afd061b6554b69685ed315c1a123c9521f87

SHA256
cdd93a2ebeb151233f3a53e5e503515cb0ebd3d7f4e55d587948dccbfe8e9b1b

SHA512
87b76e9712bb11db03d4add383ccd3a73969b06c6fdd4f5afd447b4a1d33e1357527e5f804b66088863a4b8d0ca4116248dbddfc38af0784d957a52f83430d53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd70d138e8979808e0dd75f57860300f

SHA1
b5f834eb13aea62632a1a94f404e62ce55803efc

SHA256
0912ff093df5819f7892efe8b3265f1a96e8e1802c259b900eacfdc096bdd10b

SHA512
0f2989a08a6be60518da53d32267d6dc8cb58e535a941bdce8d074315683afbfcea73305bc3a6bedf1319a10a7fae31203fcd46b9f177475537aa8835e67bc65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fe8f857bef4b126931f22781dd1194d

SHA1
a1ce589eea32ded8835d274b0b2bdee0f097daa2

SHA256
43af3e7ade8f30c460f61a58ddc81b3e9592a5ba58b306e4226898def1066c81

SHA512
0afbd6317618df68d8f9a83d7a78a834ff3527721447315af0fea199707d649351309498968b5385a7ebc2b0192222f431b327696898be3b38f22c6b5cc86736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efaa1d880a7b11882a9408a13c1a70e1

SHA1
4220515843a36bdf4777c1bb3cfad6d4cacc8af8

SHA256
e6182b40ab7356ba520ae1837702f0195fff816463b951af589b5347b7a2a928

SHA512
80d5f5e420f921b830fbe26f2295e6ab380ee3fdfc7c5c3486ef4ddc5d722a2bb262979a8dfe6d0d104c128c58d1c28102998d555cbcb71289ac46a64da6b034

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9fd91db1caa3020f2139185f1d606c1

SHA1
9b7cad6929a0a8b36a02e9f15d7b8641475de547

SHA256
2982f0df2e8bee33318cc939c5bd1a2f177d9253468d1cca70bde137af3f8f8b

SHA512
ef870b9b3d3b946563c3f4fd01a16ecc15396d162ed6297f7ec94225f269051572a4ffd56bcc6edf7ab341ecb8b3260964bcaeea13e665548c9288f3d6427e85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
c936451164eaa4bdd44efa8c346586c4

SHA1
79e24eb7b2cea8b562e73737fd0358fc39f07ddb

SHA256
98b67494c7c4eadcdf4ddd7170b69bac415325ce131efb9d37c38b8cf00eda0a

SHA512
ac404fb0279621379b8ef8e9b2d90fa840fc2c15f2cfb43fe9ed46887142d76d642dc5408d7c7c696f360da296b5c2203fc1b996f1b92d42f534eabb31cbf99a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
470B

MD5
c89d3af5af0f9e6965bbfbed2e045e36

SHA1
b512cd39a574a62a9a672c25f2db5ee85a4a53e0

SHA256
c53d0a80f2c68abe2b752f92a2b50c0bcde664707ace481bc35b4e6f8c943065

SHA512
8b63aa85b828424515e5891673669557a0e67ab9db52225dd1d6872ff256fc2ff4c357ecb038b7d4fea825594f59f72343a78297ab4241a83cdffdc47198d276

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_71D00F0D3698C81F2158FA9703C4EFA3

Filesize
406B

MD5
51efce153d5211690cda96df8cdd48ef

SHA1
5f55fe3874cae0de7be27bc38248de6c646dbae5

SHA256
de856c0ffce0b7e8aa9a4568f6f2b1644f167672cfb78957c908aa38a63f69e7

SHA512
aa0fb014407047c0e97a9a163ba2c5661acc0a19124855e2d1c64c80c324ab069643fad0488d56fd43b1a539c2bae95145a14f31fc66ef658f404749a1da31df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
20991a6d47822ce9e20d6b523ed864af

SHA1
ef19a451fcf490b93a2520f7a13a44f22234a9f4

SHA256
cbf75febfb788245d0c1778ae415a7423daa9e33020e57ea5511da68ece9883e

SHA512
fecb41fb065bcd65e2210e44ed610dc4b49593ac854740e65477793cd990577658548a5d73cb704f60b68fbec61508b9474cc278a872484d066cb2c018adc387

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\01LB6K3J\httpErrorPagesScripts[1]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\01LB6K3J\main.36e19f48[1].js

Filesize
674KB

MD5
449b102f3891baa1b7e19c676a443066

SHA1
09fc9b6b47f792e96339121fe61a7b1c53c8481e

SHA256
81a5900839e1bb0d7504909e489997d1dac54fd473face4168d9377d73cfa46f

SHA512
06162c2a757dab2dc244e22d1f022f2f65e6fb9cac72b2bbf5a7e266ac80a1392ea04c9651fd6a3535d22c59410588659331f869e56aff395cf72f3ef1321610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\01LB6K3J\tag[1].js

Filesize
58KB

MD5
c12136cba2fe1c0fe21d1ed2111e327c

SHA1
b19f45e611ed088a922038815ab769166be10830

SHA256
ae7b6a565832e2f85e1d88e4a01794b6614e1f44d076bc2e63326367f0b4b40f

SHA512
76ae101d47ad16df08c94f948a5241fc4dd998003435794f94a8012737b925b118e7490d28463b0fdfa730688988a5f970074ee9293c34ce3efac16519af7cf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0I0VVMWQ\errorPageStrings[1]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CXRG2YQS\main.ef90a627[1].css

Filesize
3KB

MD5
3f821ada778691e677aef2cea8c4b4f6

SHA1
643e7b729b25c2f800469623191dc837798e9d50

SHA256
7510035d553a99fbf93eb67737b2df057ce096fa1ed7aad83cfd559e11f2320d

SHA512
8993a8ad28ed4035a022d1b7274c77a97b8235b2ddcd5e6d29f7230d375851539900d4ace652c94c4be8a8284ffd86501df420385a6e680df4222c162deff4d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q0WBLVJY\ErrorPageTemplate[1]

Filesize
2KB

MD5
f4fe1cb77e758e1ba56b8a8ec20417c5

SHA1
f4eda06901edb98633a686b11d02f4925f827bf0

SHA256
8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f

SHA512
62514ab345b6648c5442200a8e9530dfb88a0355e262069e0a694289c39a4a1c06c6143e5961074bfac219949102a416c09733f24e8468984b96843dc222b436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q0WBLVJY\http_404_webOC[1]

Filesize
6KB

MD5
92ab50175c4b03970f264c637c78febe

SHA1
b00fbe1169da972ba4a4a84871af9eca7479000a

SHA256
3926c545ae82fc264c98d6c229a8a0999e2b59ed2bb736f1bda9e2f89e0eeac8

SHA512
3311f118963ad1eaf1b9c7fb10b67280aae1ab38358aed77c10f2587100427af58c7d008abb46ad0f59880ac51e50b5a53fc2c2a96d70f5ece4578ab72382b7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC44B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC4BB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
465KB

MD5
062acd5f4ae15614f95b3e7bbd77a5b7

SHA1
5ffdc1bd056b5d4848213c42c5671c95719dcbd3

SHA256
8a7cf4befa9a37eec8875e0d1fd0591713e0bb336a68dc1deaf11d94e69d0e1f

SHA512
1cd8b791a1deb76466d467a108356913d957fc0fd50867bb13f19f8350a4edbbc19557470de96251d4c8a28cb787eb87e9c1a64f3b4e45b848ce6921a1f5c689

Download Submit
memory/2108-29-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2108-27-0x0000000000220000-0x000000000025C000-memory.dmp

Filesize
240KB

Download
memory/2312-56-0x00000000005B0000-0x00000000005EC000-memory.dmp

Filesize
240KB

Download
memory/2312-53-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2312-37-0x00000000005B0000-0x00000000005EC000-memory.dmp

Filesize
240KB

Download
memory/2312-32-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2404-40-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-41-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-2582-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-2677-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-2773-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-3309-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-2521-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-3681-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-667-0x00000000041D0000-0x0000000004C8A000-memory.dmp

Filesize
10.7MB

Download
memory/2404-666-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-36-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-3771-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-44-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-3485-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-3867-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-4026-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-3582-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-3945-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-73-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2896-2-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2896-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3012-4-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3012-1-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3012-6-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3012-17-0x0000000002AF0000-0x0000000002B2C000-memory.dmp

Filesize
240KB

Download
memory/3012-18-0x0000000002AF0000-0x0000000002B2C000-memory.dmp

Filesize
240KB

Download
memory/3012-21-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3012-5-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download