b964784a350f7f07daa0e8ea12f1f361d7f10bf36ab52232c34c2dd86297e17a

Analysis

max time kernel
146s
max time network
156s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06/10/2024, 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe
Size

1.3MB
MD5

185198a888f2556b1535a0076cbf67df
SHA1

7622352dd5c86ea18c622a6b950209088d295562
SHA256

b964784a350f7f07daa0e8ea12f1f361d7f10bf36ab52232c34c2dd86297e17a
SHA512

289fe8deadbd437db6094b196b37ef8e7c8fc58286120f3107dc2d9970ef591d66376e9225e6f9d08eab5a153247e652c513ce87375fc540d74abae142b85429
SSDEEP

3072:GwcClHImXEPAVSNhdsqf+wfzuO0ARvAZ:ffImXEPAsNz7ruOPO

Score

10^/10

defense_evasion discovery evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 14 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccguide.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tca.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alerter.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\amon9x.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspatch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tftpd.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Process.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfeann.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gibe.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\htlog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapsetup3001.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtvscn95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vettray.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bootwarn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panixk.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppinupdt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc42.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscenu6.02d30.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w9x.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WerFault.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esafe.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fwenc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\htlog.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monitor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonalarm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autotrace.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\claw95.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fact.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rrguard.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdoc32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpfw30s.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navex15.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppvstop.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qconsole.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcons.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpdclnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luinit.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monwow.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvlaunch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcc2002s902.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rescue.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcons.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\virusmdpersonalfirewall.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\callmsi.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcupdate.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rulaunch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setupvameeval.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCEL.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npscheck.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\titaninxp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgctrl.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak5.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-nt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prckiller.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guarddog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Executes dropped EXE 3 IoCs

pid	Process
2888	winlogon.exe
2696	winlogon.exe
2684	winlogon.exe

Loads dropped DLL 4 IoCs

pid	Process
1340	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe
1340	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe
2888	winlogon.exe
2696	winlogon.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Indicator Removal: Clear Persistence 1 TTPs 42 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GOOGLEUPDATE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSFEEDSSYNC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETLANG.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLVIEW.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IE4UINIT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEXPLORE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\INFOPATH.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OIS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\POWERPNT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANPST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINWORD.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSACCESS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORDB.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONELEV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTEM.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OUTLOOK.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SELFCERT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCELCNV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSPUB.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WXP.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOHTMED.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXTEXPORT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GRAPH.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEUNATT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSQRY32.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ACCICONS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCEL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSHTA.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WORDCONV .EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CNFNOT32.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DWTRIG20.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GROOVE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IELOWUTIL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOSYNC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOXMLED.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANOST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DW20.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPREVIEW.EXE	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2296 set thread context of 1340	2296	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe	31
PID 2888 set thread context of 2696	2888	winlogon.exe	34
PID 2696 set thread context of 2684	2696	winlogon.exe	35

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1340-2-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1340-4-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1340-12-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1340-10-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1340-13-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1340-14-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1340-15-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1340-29-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/2684-53-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2684-50-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2684-54-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2684-55-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2684-56-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2696-203-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/2684-633-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2684-692-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2696-766-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/2684-767-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2684-791-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2684-816-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2684-870-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2684-1318-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2684-1344-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2684-1364-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2684-1391-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2684-1442-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2684-1444-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2684-1459-0x0000000000400000-0x0000000000441000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 54 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://0x7z8q43c7jv348.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://j1g3rv911u65lsk.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434384019"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D5FE0AF1-83E8-11EF-A5E9-FE7389BE724D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000ac56e445176b0e4b8b5c2ce020c0339e57f6c11184c06d4f44613c06222dcbae000000000e8000000002000020000000199fd1b286813188697cede3ad1d97dd86d1922e2a4a7e498ec146603549e87f90000000edff2ec987478a5ecb8d499feb3c8df457c0f88cc9dc15593e643932759209cb55b1d14710a24921859851bef3dadd0e6ff4c3f0cfb993b74787da502a1fbb70ee4cbdec66692d7c3a756facdea3b351dc7cfaacb2950069475a79e4bdcb0f0dd85f63bbd223c1042ac4e8fa711d022c70fdd5dbfdbb5704a6bb5730a16603f7da15eeae5ff2732b48768e38e428eaf8400000000d553290efa0121fe7c80eacaaff5889b54aebca2bef9434255197763b5f95b534bfb8541f8077777c778cab0980a261575c854bde2f37cd452c80fd07b0f0cc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://73pr4w807vng810.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://a2znqxda138x431.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://g0x7mh9xs0fjiwf.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://32vfpen9c15s8l9.directorio-w.com"	winlogon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 505f2c99f517db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://504wh03qg150pdv.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://m6tz8ouzj3l1y8j.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000000d56ce34e4dea61241e0a74478f4e5bbd54c3e2bd14d2c7cba702357b9519e9b000000000e8000000002000020000000a01be358316fe47d2c01d88bbaea2b813a4d8cceb4bcfb8b3694724ecf01b17f20000000fca7e4de4272d25c859229f348d80030473dca337c0848b07f6d7f11b5bbccb7400000007b99839c4b01946c7904de5bfed9787057d4c1766da686fc69a60b3b55e16508bf0bf2bab6883a2f84531ef142d3fbdf6866d1713a37bd8b1c7f5b801eab90c1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://vm5qjt21k7bg12g.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://31iw9y6z2azx397.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2684	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	2684	winlogon.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
2032	iexplore.exe
2032	iexplore.exe
2032	iexplore.exe
2032	iexplore.exe
2032	iexplore.exe
2032	iexplore.exe
2032	iexplore.exe
2032	iexplore.exe
2032	iexplore.exe
2032	iexplore.exe
2032	iexplore.exe
2032	iexplore.exe
2032	iexplore.exe

Suspicious use of SetWindowsHookEx 63 IoCs

pid	Process
1340	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe
2696	winlogon.exe
2684	winlogon.exe
2032	iexplore.exe
2032	iexplore.exe
572	IEXPLORE.EXE
572	IEXPLORE.EXE
2032	iexplore.exe
2032	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2032	iexplore.exe
2032	iexplore.exe
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2032	iexplore.exe
2032	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2032	iexplore.exe
2032	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2032	iexplore.exe
2032	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2032	iexplore.exe
2032	iexplore.exe
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2032	iexplore.exe
2032	iexplore.exe
1224	IEXPLORE.EXE
1224	IEXPLORE.EXE
2032	iexplore.exe
2032	iexplore.exe
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2032	iexplore.exe
2032	iexplore.exe
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2032	iexplore.exe
2032	iexplore.exe
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2032	iexplore.exe
2032	iexplore.exe
1224	IEXPLORE.EXE
1224	IEXPLORE.EXE
2032	iexplore.exe
2032	iexplore.exe
1224	IEXPLORE.EXE
1224	IEXPLORE.EXE
2032	iexplore.exe
2032	iexplore.exe
1224	IEXPLORE.EXE
1224	IEXPLORE.EXE
2032	iexplore.exe
2032	iexplore.exe
1224	IEXPLORE.EXE
1224	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2628	2296	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe	30
PID 2296 wrote to memory of 2628	2296	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe	30
PID 2296 wrote to memory of 2628	2296	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe	30
PID 2296 wrote to memory of 2628	2296	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe	30
PID 2296 wrote to memory of 1340	2296	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe	31
PID 2296 wrote to memory of 1340	2296	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe	31
PID 2296 wrote to memory of 1340	2296	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe	31
PID 2296 wrote to memory of 1340	2296	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe	31
PID 2296 wrote to memory of 1340	2296	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe	31
PID 2296 wrote to memory of 1340	2296	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe	31
PID 2296 wrote to memory of 1340	2296	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe	31
PID 2296 wrote to memory of 1340	2296	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe	31
PID 1340 wrote to memory of 2888	1340	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe	32
PID 1340 wrote to memory of 2888	1340	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe	32
PID 1340 wrote to memory of 2888	1340	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe	32
PID 1340 wrote to memory of 2888	1340	185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe	32
PID 2888 wrote to memory of 2824	2888	winlogon.exe	33
PID 2888 wrote to memory of 2824	2888	winlogon.exe	33
PID 2888 wrote to memory of 2824	2888	winlogon.exe	33
PID 2888 wrote to memory of 2824	2888	winlogon.exe	33
PID 2888 wrote to memory of 2696	2888	winlogon.exe	34
PID 2888 wrote to memory of 2696	2888	winlogon.exe	34
PID 2888 wrote to memory of 2696	2888	winlogon.exe	34
PID 2888 wrote to memory of 2696	2888	winlogon.exe	34
PID 2888 wrote to memory of 2696	2888	winlogon.exe	34
PID 2888 wrote to memory of 2696	2888	winlogon.exe	34
PID 2888 wrote to memory of 2696	2888	winlogon.exe	34
PID 2888 wrote to memory of 2696	2888	winlogon.exe	34
PID 2696 wrote to memory of 2684	2696	winlogon.exe	35
PID 2696 wrote to memory of 2684	2696	winlogon.exe	35
PID 2696 wrote to memory of 2684	2696	winlogon.exe	35
PID 2696 wrote to memory of 2684	2696	winlogon.exe	35
PID 2696 wrote to memory of 2684	2696	winlogon.exe	35
PID 2696 wrote to memory of 2684	2696	winlogon.exe	35
PID 2696 wrote to memory of 2684	2696	winlogon.exe	35
PID 2696 wrote to memory of 2684	2696	winlogon.exe	35
PID 2696 wrote to memory of 2684	2696	winlogon.exe	35
PID 2032 wrote to memory of 572	2032	iexplore.exe	39
PID 2032 wrote to memory of 572	2032	iexplore.exe	39
PID 2032 wrote to memory of 572	2032	iexplore.exe	39
PID 2032 wrote to memory of 572	2032	iexplore.exe	39
PID 2032 wrote to memory of 2640	2032	iexplore.exe	42
PID 2032 wrote to memory of 2640	2032	iexplore.exe	42
PID 2032 wrote to memory of 2640	2032	iexplore.exe	42
PID 2032 wrote to memory of 2640	2032	iexplore.exe	42
PID 2032 wrote to memory of 2452	2032	iexplore.exe	44
PID 2032 wrote to memory of 2452	2032	iexplore.exe	44
PID 2032 wrote to memory of 2452	2032	iexplore.exe	44
PID 2032 wrote to memory of 2452	2032	iexplore.exe	44
PID 2032 wrote to memory of 1224	2032	iexplore.exe	49
PID 2032 wrote to memory of 1224	2032	iexplore.exe	49
PID 2032 wrote to memory of 1224	2032	iexplore.exe	49
PID 2032 wrote to memory of 1224	2032	iexplore.exe	49

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\\svchost.exe
  2⤵
  PID:2628
- C:\Users\Admin\AppData\Local\Temp\185198a888f2556b1535a0076cbf67df_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\\svchost.exe
      4⤵
      PID:2824
  - - C:\Users\Admin\E696D64614\winlogon.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Modifies firewall policy service
        Modifies security service
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Windows security bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Event Triggered Execution: Image File Execution Options Injection
        Drops startup file
        Executes dropped EXE
        Windows security modification
        Adds Run key to start application
        Checks whether UAC is enabled
        Indicator Removal: Clear Persistence
        System Location Discovery: System Language Discovery
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2684

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1160

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:572
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275468 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:1061901 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2452
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:537656 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
ebb26f8d95662d19fce047056e90b97c

SHA1
91d590eaf1a3ee9475a688191354993a544d9a29

SHA256
db9f12eecc8735bf7b838a915b96ce2a4f598f3ebeb384a007a47121b5a36749

SHA512
796fbc20decb34428dfb35a7dadba754f695ae194695b6ba8d09485366935892901747eb167a24bf4d47a399494ae1414b7f27b6e1351a1eea71eeed71bf8467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
2KB

MD5
96f7e8388052576ed565a61fa03b1342

SHA1
5cf01c38db4c967f21a1ffe40d0100efeeb14c6f

SHA256
3fcd6cd12c46c67cf932801ca44dc7f939a8d103ba7d1e8a0fa38766a3cc3993

SHA512
6fc0814a752b91feb4beed2b19c79f3e522f3c1551a81d6b89d52a9b8a571c2ad3b6e2a41fbea5855c7d7928319e020c0e4b12961a25ee627f69fe52e65733d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
7fb5fa1534dcf77f2125b2403b30a0ee

SHA1
365d96812a69ac0a4611ea4b70a3f306576cc3ea

SHA256
33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

SHA512
a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_78E9BA377D96268BAF8E57FEF7614CD5

Filesize
472B

MD5
85d3132f5726868a91187fd9aefa4611

SHA1
bd5ad48ed2b6d3c855a939db8d81358170013e7e

SHA256
3e82564b1af6e767d6737efaf3b16fa6e89cc3dfeee2e6c429a6580473ceda11

SHA512
3fff047e716c6b3fa7d40ef6302305a0b8811bd5948d34c8ec2d06082eb2c52f952769b27c302a96088300d0ad74994256dcedfe6bc198b02b573676e6d9a290

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
2KB

MD5
f5268c914e2698aa6af7e627ed8f8c36

SHA1
950a0b451ae7431498a2c65ca6c7a7befd8f4d61

SHA256
9d03e877bda5c7a2bbe93f04837d3b05d93a4de9193920504a1948e6f745fbff

SHA512
bbd679ef5664735ac34ece21e9995cdb8daa00e2cf6939c6cba3ebd1a00941756a4285452a1ba3d1cf75cfbc2ec6341268c712a8b016999c9d661a2e3a8c8976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
8feb2cdd7caa1b38b30cc99ce7722918

SHA1
add6e4a269ae8df96eb4d9fe6bb036436d069f43

SHA256
380caff0ddb1b9b4bca3aa3ab1a6ac02d6362e6586068f1147b73ae97a25598d

SHA512
afca92cb08e5c2d523625ce1f74be54ddb5028879e0b89dd22ec48350c36fd55e208c5cca2a660b4d6b463d831e899650f24bd3ee8cad7c82ed34d05c3c4bead

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
4739d007c01e72aa4d8c07b05210d583

SHA1
cc7037c62d5138103da496a91277f512c29f5de1

SHA256
52cbf95fd3a25249d5fa30292a84782d3eb1efd14e79c7d4e32d3b0f21b94a67

SHA512
c8193de290b0fbd2286b16763bd6a173abdc99e1550135f05627c313ef80a6768bfa3fd0bff59de0a4d2c9f821a39a81b92f2224bed6774dd1fbb933d4e6dfa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
331b63f6de816e6eb8c028a21688fc2f

SHA1
119dc89dc46a2f261941bb1195d77127c62a1c88

SHA256
cc233a78d2a6140ed29c6bd0c4f0c5b3bd70a5af170b652f62b6c1d5c4c302ee

SHA512
499b77e859007f784fb74265d86755aa783cb170d892bbe85c09e2ffd47817e0b2bec4ba30c9443a944eea8336bc68ca5a2c8e6b1f9343543bc4574f5647cb72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
466B

MD5
bcf3ac940364b2cb47998c42c421d955

SHA1
e9823485633c3a87e2018f7204254be2924332ff

SHA256
d007fda0f11f98ffa0e2cb0bec3ef2cd492d4d9d8deaf43069c2c729e3564bd4

SHA512
5edfdd334e2f474f134d0edaebfbafab9042b420a4b41709aa0a043fda85bfabbb8f4e55460b54c9efd12d064431dd08a3acfc34c08e25ba843a3422d17f9b93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
20326766fccc3f196928ceb7bae2de32

SHA1
24a1b7d27b2e45d96998b9761135de0735ffaf11

SHA256
080c8e8103ce7626212996100fe53e9800de7063a3ca8fb1e8bc5f22d30ef97f

SHA512
023f4abaf62ec444a76f4d4c0d73d85df6c7b30916c544d6a35643177a03bf9769f419ebba136ae2551857729851a122f44628e6dd5fca28cf8b260d000ac4e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72b759b1eae640ee5bae104243d3fb1d

SHA1
1b1ed1f636a13a34a5fce1dd843c30d2006ab394

SHA256
57ecd4508d0f92a86184c8264aaaf2fad49a1cc783a245a73276e9f0db245f75

SHA512
6308ec9a6cee04f8759f3fb34b1e75c9b8ff724a7225c1ca3db5047db84c8b2308f4306fac0bff3daf289a1f11963affd62818d88e775069b91b65c560a67506

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
491cc9aa7dd4d7ecaae93fd29b454e07

SHA1
2bcad6e1f65ba442ccf59880a79fd053c64d2e37

SHA256
a0f25a461197aeecaac724767fc2090905422412ceda49bb960471294afca102

SHA512
6123b988d5c8be8ab2161da097700c413f9c8f19d6d7059061d886ccaae07fc5e8bbaf6d960d15364f8d46e495dd5b7807c3ec076c7c0868473cb3d9913648bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b4d0eb31e19e04bdfd73d08617a32ba

SHA1
5655409d06bb3da3db83a973c53c3b0d151681ee

SHA256
b239937ea013826344420eb77f4958af962504320b5386034ddb7b94294bb06e

SHA512
6665993a1bfbfb045ba0e4a4ab05b0ba30c740562ffc6291b0aae7e8bae197c6bb350aea72557fb5ae2101c10d06a936a28fd75811e9374108a6147fd069aa4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76f580adea4e72d01ccabfb52932c2a5

SHA1
d50fc951b9e84ceca0f2fe62e01854d5db0f61c2

SHA256
ec320bebc28a56f0e0e653935a8c3936461473e8bf67c5e17b06fda4bb559882

SHA512
043b9ddf12b344083696f45f21756304aa3eca9dbdb76f4dfbc66eea469bbddeab9c0b2d39a30a40e20d0d71704b7c8b14205132463b937d069f9786d503aa8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5809533505abb7c2a00715f2fd8f54c

SHA1
5bc82b2c8c26a1c76d43e3152158fc256b045dcc

SHA256
25b0c1ca7c74a198b70a79939b92eaf0f969f26c21af178c18197a4ac1f94f1e

SHA512
4f37b9e669776fc35240cb9f13d4289b4fed6d06c249ac4590b3bea136029811f893074977029e8f4a9e0c3f65100cab8b6abb1d58348f2999524a15c5d256c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2684b817138f8bc9c5a262647bed4a00

SHA1
f59f56bf702dfdaa8878fb4ef39fb6e70ef6d016

SHA256
f846c6c7a157dbf49ea0727b89b8e92645e836d7471cc88dcfaa571ffca3ca3e

SHA512
499441e116e121a2cf3c08158192172cee6ffb7d56b013890b6fe60c59a8e13c648bc01cf89e3ffb83c6df861beb8ca77dee63371342da5f3c872ec73d376df1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99e556ca792e33cf577b0438e305c4b4

SHA1
75ac3b1fd8355e8f65fea9dc54d36155c8796788

SHA256
f89ad819ac3cbb3efc9c6ec0bf040b67c5aa49a4f81071bb6ba7ab1d021b1db8

SHA512
a83a059f778fd63e6e083f420915b6845a8c117cd1a573d0883628b805ba95521531ce3d3f5e681047a1e9ac684e266ade6fb8c7ce690602a8afd0abf1b3eb2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68dd0aaf86fb79b686db62002d86f328

SHA1
a7b55e915c2caa6f6282a919d31ec598b043226e

SHA256
5afd8a32b782a7b6fc1de162d0ded4f1817bef72ed508a5268cd22bea0be891e

SHA512
2a13530a5e0f88e712c238b26f41b128feb82ddd117a1e0cdef333c5b3efcd266127ce975fb47111d05ed906a1e594dcecd1b28705ca1cd7cf62410ef84a52a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f4707abdda5c5ce5db55aa5f2abccb5

SHA1
cb70c3cffdb0e4c583f9949d25964cf70a78047c

SHA256
50ec34e07a37e2920af0002a76f8b4347a0224db1820c6b8c7b592b1fd422573

SHA512
f87769e119b88d3d199848c73e3bae454920812a252edbb16a707573948ff0cd5458aa3fa8fba9866671797d6f64e0bef83787bd6e4c8915f04f15398130ae65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a4a7910663b026ae19f699821c00dea

SHA1
2bf45ab0d6395ccf79c2c563e890ae583b7251a2

SHA256
62bcf74b1582f10377ca8caccc5199f157ff0c49a4cb1bb761d292242fe36bed

SHA512
a62af7bf20daad5d55e5d3abdc032ca4b200d2a2771c39434b3094a2e20b7831631037de2498f5b8caa74327f2afb185e74ab845bf4cbf08387bd611fe6fda4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ce716b91ce7cb283fb5c7d347b274ae

SHA1
e1de014c5af4a1e2b8132e5de102a8464ef32f56

SHA256
8601e5f3c8e6119aa882777bc949a971c4200e3c0cd61712d2f807f94a7af800

SHA512
e8ce4ee97a29cf5e7a71d14ef5d9505da3292356ac6664ecd4f1b75b9fff99d598c7ba5827d896119b13595567dbd16ace862a95ab819e4853034493454ef628

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
859b86c6331d598a84e24f879b2ca4fa

SHA1
a8738cac9b0262c594a32cdcabb4a4c679c74dcf

SHA256
2bce253a5160544a45d2c2f4d4287f1d680c80c50cc146c6750f6e2f4ebe7fd6

SHA512
9689d9e852bb71caf16dce380971a03a43155038526b72ec8835f6301dddd2ae848d79731a99be4980f65731f99f5741ba9526f3ca0457f789f8d7f99b4c280c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6d74c1bbb02057964cf8771540739d4

SHA1
2ee5c58026699e66c16a35ab05c97d13e4c8032c

SHA256
b0b073efa4ead09b0c8fb4e2bcc536b1d1d8f33080adf31fd1db2ca855dc1a63

SHA512
470375982eec9b5d4a1566bcb051c0f31af3ad8a070aee0d64d64afad026731d5cbe52c312df043f25016445438ebe75e8f455772c3366339c8df238ac1ce1d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6251347a85b3ef032c3b6eee9a49786c

SHA1
c8decbd46a54d7008d9c71fa9c9dd6776b7dcc04

SHA256
e4a694357c3ea0a04315556395545fe4785ec31af3d9628682e23b90dbd07943

SHA512
0c94b9a126c380a8c291fb575346c6c4b48b64f66e693abe4a53cbb2ce83626b987f5705dd0e8c7f15579e79ebb64424c1b9eaf5f0fc157ce9d971d3179eb57c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
459cc361676e2d9996cc38e92901e266

SHA1
fd6eeb1894f77a5bd83eecda608e038f8c9e89ca

SHA256
69ae1547bcc5ab6583380c105ba9c1c0ee1d0c4f55aed6ce379b70747812d9f0

SHA512
a61b78d896f025f1a3e3c8bde549e2e805d084c1152b3c2edff6e46bffaed2b9cc4187f0661242255afee9c374d1e062cdfb781bb22b23dd81199519263b023a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94ed64349310f6e27f8924efc5033fb7

SHA1
34d2470ca0fcd4be8554c0ffd6eac29b86704f23

SHA256
1f6b9b73b7b4d947a77923dea4fb8354883c6feb89aa93b0fe03cba605aac71c

SHA512
60dd35af7293310bb3cfa6deae04772871e1dc026f974abcbd543dd06f40a0ba412836a32020d385095d8686781fb84cf9036d420393f15ede8b07b9451c7a02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5e2a322ce9d46c6425670358c740e1b

SHA1
7d946bbb801af2c65d477d0e66fb4525d24f27e7

SHA256
8948070474d0aab9e40b0cc704e77dcdbc8ea76400878340ee3645432ae65c16

SHA512
3223017a8d1d0f4b588187a30264e64f0c3b565d27eae6a8d24b33b7707c3da460c5887165c15d9fcc83ef57c23567d2abec167b9aee55f092d4ac7dd0e13e75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd4435a9b4a325d8cc51d633c2e0ffeb

SHA1
d10c817a8f1c17601e6e4aee7b92c922904d3b02

SHA256
ac2d132544e1f1f81f59ba02d4f9b1df1bbbe083b153aa1e1d5667a644b7680d

SHA512
8bf663a54e6230be3d115fa45525ea72d6150f40c5a877ddad4cad224f3f061a9114a8dd53e4f979fbfaa9ccdee748bed49e25e31930e1c656aabd5cb4a4f0cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a392a59dacb837661442b2b5a3272f7e

SHA1
f92e613bceef48e7ee6fd86670ce751f8cb3d941

SHA256
c55f7d311e200404f33ba8c902fc6d65b2c5b7fb5cc5767d978efbe179cbddac

SHA512
0d5e14c479c8abe5fa3d2d17c54ce80c6a85658a0f2316094ee2dc824677d2e40699b2a0e30280df4c719f20f2794ca17c11984459a6d6ff172a883fe14cd75b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
769834384141ea8d845b8cab2cb969fa

SHA1
d47f7eeae5951fb5a6b3935b3795da05a52ee7bb

SHA256
e003e2721d65cafce3d806db865ce06901dd3039b96f233125883eae338f4ae4

SHA512
a4eb177cc389a9d3366c7aad098fc619b7355b6a47ba297c460334343792b5a9b4304ebeb06a686264f96b433edad07b74f4286f2774ffff06a3b11fe6700d79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8851b6791fe63afdbc38955d0bbe211d

SHA1
c62b16fbed896418ceced727c19bd9a649df7b27

SHA256
ced639ea986c4b82c2f6a62fd3d564d3a9325300b2b49cf6682c49072ee5ff3d

SHA512
4de7605734775487f5a17a12439f2653a142f3120f0bfd9656b90a96969a7b0039be2ccbe041cd06b94fbbf15a1f0d75e697f30ace711344162dd2e748ba028c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4bb5f8d01f106cf6b5541203071e286

SHA1
2d1a7e5131765b845174e5e4a922b34e4ae50f3b

SHA256
b598c39eebf1ce15ef4bb44868ed5ef40d1e2518d719f47a64c51e89091b3e40

SHA512
47a58030ad70051a12fc5565a785a6ece773cb5d4a8fa9cd9ae3650978ddd5acc1624d71b1c7de3812251564494372a75bc72c54820071c563afec872bf4ba9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92908c94557cfb97f82f3bb2fb8eebac

SHA1
19f6549f0db36c08d6397ecc7d231168082d21e4

SHA256
6e900779a84d23c3ef043d329442bcad7e8d6c642f6db19c1c3c2e51c0dd5007

SHA512
44b999c8761341fed7cbce906402f67a948e1933b04ad56119ab4fadb2517c1a513ef57d2669797473ad7609f8c6f0a490be528bdfac50fd15caecff8026f3c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_78E9BA377D96268BAF8E57FEF7614CD5

Filesize
398B

MD5
4284b5d6c522c5d92b91f44dff091d38

SHA1
3f4102e967e805ff4097462fbff7ba67faad231e

SHA256
161d0cc06c4616ec2aa73b9c32767026b905562794b26f85fea73900a7490d0e

SHA512
d75e67be2d7353e13e29dfdeed09e14434c36b244c2fd8269d423d49e38db15b08b44d468d4620536254a04b5622bd7ef3c53df041f5032f47d196890a8fd513

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
2f15864e4dd99f5e185ad209c28f59af

SHA1
046c05da1d990c3b7869b1cda88beeef018500dd

SHA256
33a07cbd9b178ff3b30545fc307fcac4fe29197447a3d2cb25ec31a14993980a

SHA512
1215c332ef78f90f3d5d48168583730d1971cdcb9616bf65a9e6367ed7bb260b5ada4168a1c05909e968e7ce97a24f6a690e57ef909e690074b1bfba3d4d8052

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
470B

MD5
e52dc28aa2a33b36d6ac6799da85a468

SHA1
c285bfada3223c965a0d38725707b5dc0a4d3d40

SHA256
4fc8e124bf27f5675d6374103a522b3666b859b7969233f61f0a67c0237961a2

SHA512
b6b161d7fc49771dc60828e458b51cc8a71d366f4e0288eb5bd10580351a88ce73825cb485b43df22e4d2cb0d7d96fd5f3a51f68f9d5d09c8d6e8502d71d8873

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d6c0d855330df654a4ea1b2180a21b07

SHA1
e8bace76dec46e43b237bd3bb7c37ec91b2d744a

SHA256
14b4b0db1797bbc671d8e664e59b6905d5a462801c5429075f97d82abfbe9cdf

SHA512
fec90c930ea4ca6f5433ee0537bd146a4ca4ec6509ee2fb5986fb02c98677e7e0cab1587fd5788f8f599b52db38dbbd304f27821d55361b57d4fde4d61d3d7ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8B420DKQ\main.36e19f48[1].js

Filesize
674KB

MD5
449b102f3891baa1b7e19c676a443066

SHA1
09fc9b6b47f792e96339121fe61a7b1c53c8481e

SHA256
81a5900839e1bb0d7504909e489997d1dac54fd473face4168d9377d73cfa46f

SHA512
06162c2a757dab2dc244e22d1f022f2f65e6fb9cac72b2bbf5a7e266ac80a1392ea04c9651fd6a3535d22c59410588659331f869e56aff395cf72f3ef1321610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8B420DKQ\main.ef90a627[1].css

Filesize
3KB

MD5
3f821ada778691e677aef2cea8c4b4f6

SHA1
643e7b729b25c2f800469623191dc837798e9d50

SHA256
7510035d553a99fbf93eb67737b2df057ce096fa1ed7aad83cfd559e11f2320d

SHA512
8993a8ad28ed4035a022d1b7274c77a97b8235b2ddcd5e6d29f7230d375851539900d4ace652c94c4be8a8284ffd86501df420385a6e680df4222c162deff4d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDDDRHWK\SEGY5IR7.htm

Filesize
220B

MD5
6e7b2c8a2f08426a026188d0dabfecfa

SHA1
5650c2f94fd6c22d2d52406684118f9f0211dda9

SHA256
c75d253e08c4aff8b0503a70e436135d8c3ed23377906a951ae50f9229aa32e2

SHA512
8b4832f7d49e0536e340272cd6343b2eb5ac3e9290e0ee57e43ae1b5d010c1359cc18fb8a029669dcab9b1612345587797b882ff2d8c07786ac371f348e08c42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDDDRHWK\caf[1].js

Filesize
149KB

MD5
c23ee12d3aa9d9f61257652e2fdba771

SHA1
a1da8be0b50f8a3c3096e1346fc92a205f7faeb7

SHA256
c6953edacbf87abcd6d9015729e98574fff4111b18742d7ddba70fa47994812d

SHA512
93f6ce48da06e7e3643d7948141534dad4961823c8d338ed3a7af315e146badc35aabd163dfaf1ee16122e813bb6ba6a6ca7c54defcee49f223648952fa82d25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDDDRHWK\caf[1].js

Filesize
149KB

MD5
884af477a3ea6c6c63a0db127be1f3ad

SHA1
35d30c4a349a44fee9bf4f24f06b1b0f3506a488

SHA256
d0b202267959b9bca7cea970d7e18cc5242b34c2058879564acf1e5d67cbe83b

SHA512
53c5aa883ce648654744167a04deebdf0bd872e20e4a0514381d34051b3eeda863882c13e1268af31e7f065ba3c5a3becdd25f89b3054735240568d607dda706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDDDRHWK\tag[1].js

Filesize
58KB

MD5
7378d3ef3bcb274a3fef6a74579f059a

SHA1
e8d6929cee9bbeed6519efff66d2183aa4cc323e

SHA256
076fe7eed544528a51dbcab080a176591e0ab5b5f4dd2f5b2083a142f083c0c6

SHA512
f7f15dfa27558506783687adede1a1a4aa88b6713026a21ecb4b98c8d63a2075d1dd04e3bc36b80a5c19bec491a3281126c7af5b3de92980c2c6a76ffb6f9ee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LW44N8OS\lander[2].htm

Filesize
620B

MD5
b90de8db327e4bbd8578971715c20f6b

SHA1
4a86f6e7979314934775d934d6f00e96a3ca3418

SHA256
5e082d46aa366a8e97c98d5ea3bd3811ffd29373698ec0d22bfc5ebd79721f9b

SHA512
7abf7059fd439c388998dd00bc8093e39fe42bdd05c7a5ed8c0001903ce071bed47f9db649be9d27e657130b59739d63c8f905d1df5f4be6ebce1afb55ed333c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB878.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB8E8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF25680122082071B6.TMP

Filesize
16KB

MD5
ac04b33c2d6c844d5198c7ea8ed2c83b

SHA1
341616cbb2c1afdfb6eede51a7cc99cb04ae5d2a

SHA256
fbc4e7618ef1d56744cc6300532dbe5f5ca33dcb89ea31f39271d84b86f4b41d

SHA512
1daa4ab778045b231abb3bd6dc7b1603354e0387cd8c893bf2c9775b972f97fe41d2e5930743dca7010325a9821775ba3f7341f17b3d9c4492d2a8812ac79114

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms

Filesize
3KB

MD5
aa97331b53a1de962fab50ca40c58769

SHA1
251c47527368155e3f9289a666a1cb5e0c5f965b

SHA256
dbcbe9ae6007a5f1cc3752f8b9f1444a10dc716540e89b91176922edf4cdf8f4

SHA512
cb6a9946af12abdbcdbe143e5388b9329606fa13351b104cef5f8590dc28a7959cb31168b56a7140200999a04e1335b86744421f158b487f0e8515b15d4394f9

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
1.3MB

MD5
185198a888f2556b1535a0076cbf67df

SHA1
7622352dd5c86ea18c622a6b950209088d295562

SHA256
b964784a350f7f07daa0e8ea12f1f361d7f10bf36ab52232c34c2dd86297e17a

SHA512
289fe8deadbd437db6094b196b37ef8e7c8fc58286120f3107dc2d9970ef591d66376e9225e6f9d08eab5a153247e652c513ce87375fc540d74abae142b85429

Download Submit
memory/1340-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1340-12-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1340-15-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1340-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1340-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1340-29-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1340-13-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1340-14-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1340-4-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1340-2-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2296-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2684-791-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-53-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-1459-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-633-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-55-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-816-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-767-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-1444-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-54-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-50-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-870-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-1442-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-1318-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-692-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-1344-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-1364-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-1391-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2696-766-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2696-203-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2888-41-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download