f71bfea2e40f694a2f83fb99568632b04b7ac154ab0b46aa2ea92d32b21a8fa7

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe
Size

929KB
MD5

3a263feb4cfd5e232ccbadc3cec739f5
SHA1

6e1312546cb23ce0c970640c592bcb9c1cfe9bc2
SHA256

f71bfea2e40f694a2f83fb99568632b04b7ac154ab0b46aa2ea92d32b21a8fa7
SHA512

5fd37927241db61a7c6bf3b04ea4f1ff9014b55f087435fd277183596c6a6eeacbaacfeaf1d8899d493f162da408ddf6598c5019bc267135f59e71cbbb8da59d
SSDEEP

3072:1TDRyxF376K115CIAk+yRQUr02D1f0nZzBbQpSl:1TDRkFL6w5tYyRQT2pMZBmSl

Score

10^/10

defense_evasion discovery evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 14 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmlisten.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guard.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spf.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsetup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wradmin.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pview95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\connectionmonitor.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\htlog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netspyhunter-1.2.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\processmonitor.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapsetup3001.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTE.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winsfcm.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleToolbarInstaller_download_signed.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmsrvc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpinst.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symproxysvc.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\watchdog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccguide.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perswf.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pingscan.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\routemon.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\anti-trojan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpm.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldpromenu.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nc2000.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tauscan.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vccmserv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wink.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ndntspst.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcc32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\callmsi.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\offguard.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explored.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavcl.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpf202en.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmlisten.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navauto-protect.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan40.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Safari.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\titaninxp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webtrap.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctrl.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deputy.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\purge.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmiav.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\claw95ct.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\flowprotector.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsched.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Restart.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsched32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\purge.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Executes dropped EXE 3 IoCs

pid	Process
2984	winlogon.exe
2344	winlogon.exe
2760	winlogon.exe

Loads dropped DLL 4 IoCs

pid	Process
1736	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe
1736	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe
2984	winlogon.exe
2344	winlogon.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Indicator Removal: Clear Persistence 1 TTPs 42 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GROOVE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONELEV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORDB.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\POWERPNT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSQRY32.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CNFNOT32.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DWTRIG20.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCELCNV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXTEXPORT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IE4UINIT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSHTA.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOSYNC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OIS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTEM.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETLANG.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINWORD.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLVIEW.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GOOGLEUPDATE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSACCESS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANPST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DW20.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SELFCERT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPREVIEW.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WXP.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GRAPH.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOXMLED.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSPUB.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OUTLOOK.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ACCICONS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IELOWUTIL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEUNATT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\INFOPATH.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSFEEDSSYNC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOHTMED.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCEL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEXPLORE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANOST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WORDCONV .EXE	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3044 set thread context of 1736	3044	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe	31
PID 2984 set thread context of 2344	2984	winlogon.exe	34
PID 2344 set thread context of 2760	2344	winlogon.exe	35

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1736-1-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1736-5-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1736-6-0x0000000000E10000-0x0000000000E4C000-memory.dmp	upx
behavioral1/memory/3044-4-0x0000000000E10000-0x0000000000E4C000-memory.dmp	upx
behavioral1/memory/3044-0-0x0000000000E10000-0x0000000000E4C000-memory.dmp	upx
behavioral1/memory/1736-7-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2984-20-0x0000000000A90000-0x0000000000ACC000-memory.dmp	upx
behavioral1/files/0x00080000000162e4-12.dat	upx
behavioral1/memory/2344-30-0x0000000000A90000-0x0000000000ACC000-memory.dmp	upx
behavioral1/memory/2984-26-0x0000000000A90000-0x0000000000ACC000-memory.dmp	upx
behavioral1/memory/1736-23-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2344-32-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2760-36-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2760-42-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2760-39-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2344-188-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2760-189-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 54 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434899930"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://o709x7y31s8mr8v.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e6d8cba61cdb01	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://208p08j19lu198d.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://xqh26p9p9z37ra7.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000007bfbf15f5c5f75d925c79af2511b60c7c3da18b251280c1a1f5a41359d63dcb5000000000e8000000002000020000000134c08a0dddeeec2ceb31fb1ce20fcfe2d280b324dd1eb9d9169e5f2c3985916200000002d3727025404673c1e74aa93fea697135ce209eed33294190784a7398d7f242040000000887fdc6fef0474a161f4cd100992a0dfe921011d4cbb3bfa111caa8dd2577bd83c7a4ef98cb40ee3fd6ee01bbe81eae6df23409eb7a9c23b80b520fea4d9252e	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://223g8681q6xbae0.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://8gfs9l8vhk362ag.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://7e2tbo3s6486980.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000003f9cd5185e126f931ca9210e2635e7213a1087899dc25b0fdd9085558c6642d6000000000e80000000020000200000009f90f03d7352fde2acca2fda3fd426629ec40ce2ea1c9c30c825cdc0652af660900000008a822cba1900ca3feb517d86ff6d4558a4bcbb50b0ae6b5aab5bf39a9d3ce47656fdad8247d446fc14485b2eb7b0d8e02ccfa3309759bcc69aeb6613a6d5de867463683be4715eae457809f87ad3203cccffddc0db58f1990b56080a45c56ca5e46b7569228787565cee8d8e44e156475f7b172eb77603807387a14416244dbe751394b5db3caf91a74ce3254e445f684000000069ba03e164ede398bf740e5353573b4d0a9b659d42b4b8fb81ecc4243e4eac24da1ec4cbe263ffa131a96f3605788297faae70a9c55461c2a8a69a05e31446d4	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://kb422x1rzu81ye9.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08BD8D21-889A-11EF-9D9B-465533733A50} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://qr98ho4qvhe7t40.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://k25h7abmw10we7w.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://k2d6k35jb3c6j18.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2760	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	2760	winlogon.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2820	iexplore.exe
2820	iexplore.exe
2820	iexplore.exe
2820	iexplore.exe
2820	iexplore.exe
2820	iexplore.exe
2820	iexplore.exe
2820	iexplore.exe
2820	iexplore.exe

Suspicious use of SetWindowsHookEx 41 IoCs

pid	Process
1736	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe
2344	winlogon.exe
2760	winlogon.exe
2820	iexplore.exe
2820	iexplore.exe
1488	IEXPLORE.EXE
1488	IEXPLORE.EXE
2820	iexplore.exe
2820	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2820	iexplore.exe
2820	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2820	iexplore.exe
2820	iexplore.exe
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE
2820	iexplore.exe
2820	iexplore.exe
1488	IEXPLORE.EXE
1488	IEXPLORE.EXE
2820	iexplore.exe
2820	iexplore.exe
1604	IEXPLORE.EXE
1604	IEXPLORE.EXE
2820	iexplore.exe
2820	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2820	iexplore.exe
2820	iexplore.exe
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2820	iexplore.exe
2820	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2760	winlogon.exe
2760	winlogon.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2312	3044	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe	30
PID 3044 wrote to memory of 2312	3044	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe	30
PID 3044 wrote to memory of 2312	3044	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe	30
PID 3044 wrote to memory of 2312	3044	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe	30
PID 3044 wrote to memory of 1736	3044	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe	31
PID 3044 wrote to memory of 1736	3044	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe	31
PID 3044 wrote to memory of 1736	3044	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe	31
PID 3044 wrote to memory of 1736	3044	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe	31
PID 3044 wrote to memory of 1736	3044	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe	31
PID 3044 wrote to memory of 1736	3044	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe	31
PID 3044 wrote to memory of 1736	3044	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe	31
PID 3044 wrote to memory of 1736	3044	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe	31
PID 3044 wrote to memory of 1736	3044	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe	31
PID 1736 wrote to memory of 2984	1736	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe	32
PID 1736 wrote to memory of 2984	1736	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe	32
PID 1736 wrote to memory of 2984	1736	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe	32
PID 1736 wrote to memory of 2984	1736	3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe	32
PID 2984 wrote to memory of 2700	2984	winlogon.exe	33
PID 2984 wrote to memory of 2700	2984	winlogon.exe	33
PID 2984 wrote to memory of 2700	2984	winlogon.exe	33
PID 2984 wrote to memory of 2700	2984	winlogon.exe	33
PID 2984 wrote to memory of 2344	2984	winlogon.exe	34
PID 2984 wrote to memory of 2344	2984	winlogon.exe	34
PID 2984 wrote to memory of 2344	2984	winlogon.exe	34
PID 2984 wrote to memory of 2344	2984	winlogon.exe	34
PID 2984 wrote to memory of 2344	2984	winlogon.exe	34
PID 2984 wrote to memory of 2344	2984	winlogon.exe	34
PID 2984 wrote to memory of 2344	2984	winlogon.exe	34
PID 2984 wrote to memory of 2344	2984	winlogon.exe	34
PID 2984 wrote to memory of 2344	2984	winlogon.exe	34
PID 2344 wrote to memory of 2760	2344	winlogon.exe	35
PID 2344 wrote to memory of 2760	2344	winlogon.exe	35
PID 2344 wrote to memory of 2760	2344	winlogon.exe	35
PID 2344 wrote to memory of 2760	2344	winlogon.exe	35
PID 2344 wrote to memory of 2760	2344	winlogon.exe	35
PID 2344 wrote to memory of 2760	2344	winlogon.exe	35
PID 2344 wrote to memory of 2760	2344	winlogon.exe	35
PID 2344 wrote to memory of 2760	2344	winlogon.exe	35
PID 2344 wrote to memory of 2760	2344	winlogon.exe	35
PID 2820 wrote to memory of 1488	2820	iexplore.exe	40
PID 2820 wrote to memory of 1488	2820	iexplore.exe	40
PID 2820 wrote to memory of 1488	2820	iexplore.exe	40
PID 2820 wrote to memory of 1488	2820	iexplore.exe	40
PID 2820 wrote to memory of 2472	2820	iexplore.exe	42
PID 2820 wrote to memory of 2472	2820	iexplore.exe	42
PID 2820 wrote to memory of 2472	2820	iexplore.exe	42
PID 2820 wrote to memory of 2472	2820	iexplore.exe	42
PID 2820 wrote to memory of 2168	2820	iexplore.exe	43
PID 2820 wrote to memory of 2168	2820	iexplore.exe	43
PID 2820 wrote to memory of 2168	2820	iexplore.exe	43
PID 2820 wrote to memory of 2168	2820	iexplore.exe	43
PID 2820 wrote to memory of 2588	2820	iexplore.exe	44
PID 2820 wrote to memory of 2588	2820	iexplore.exe	44
PID 2820 wrote to memory of 2588	2820	iexplore.exe	44
PID 2820 wrote to memory of 2588	2820	iexplore.exe	44
PID 2820 wrote to memory of 1604	2820	iexplore.exe	45
PID 2820 wrote to memory of 1604	2820	iexplore.exe	45
PID 2820 wrote to memory of 1604	2820	iexplore.exe	45
PID 2820 wrote to memory of 1604	2820	iexplore.exe	45
PID 2820 wrote to memory of 2872	2820	iexplore.exe	46
PID 2820 wrote to memory of 2872	2820	iexplore.exe	46
PID 2820 wrote to memory of 2872	2820	iexplore.exe	46
PID 2820 wrote to memory of 2872	2820	iexplore.exe	46

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:2312
- C:\Users\Admin\AppData\Local\Temp\3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3a263feb4cfd5e232ccbadc3cec739f5_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      PID:2700
  - - C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2344
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Modifies firewall policy service
        Modifies security service
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Windows security bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Event Triggered Execution: Image File Execution Options Injection
        Drops startup file
        Executes dropped EXE
        Windows security modification
        Adds Run key to start application
        Checks whether UAC is enabled
        Indicator Removal: Clear Persistence
        System Location Discovery: System Language Discovery
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2760

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:680

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:472073 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2472
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:1389587 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:1520661 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2588
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:1586200 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1604
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:2044952 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
1a59df6c289a1d854a026404b15a2135

SHA1
13f5b70076de35b26d8470a723645c962df69320

SHA256
a4449204c7effd91c3f970bf8badc05be30eba358cb33bb6c92ddd4ede941add

SHA512
b2b6d28b4f1ded37f9e2e39c896e6d05623b1034ccdbf06fa02803da74abaa5e6b8d898c2b757ac8de9fd80ed7c3229a6cd2948dc17aa81397f3fa5e2d8f984c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
2KB

MD5
45db1a5450af1d75df162e4fdc994beb

SHA1
001bf5f5f8ff50ef31413404d2c8c41d572ae3bb

SHA256
a16fd7c4ba43c23a28748dc1b930b337af1fc8f0a0f6a13d99ad01b3c5612bcd

SHA512
d5f80ac606ea95575331f694260dcee26e6e20f0f828d9e26e03a5fe7f4eead2e6cb148a1ec0951c7e46bc4695994f4afcef343dc2785ba36922b03b3e5b3f12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
67e486b2f148a3fca863728242b6273e

SHA1
452a84c183d7ea5b7c015b597e94af8eef66d44a

SHA256
facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

SHA512
d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_A3FC0BC6A75F11C789144CCDE90F5957

Filesize
471B

MD5
487bd4e9f19444919463ed023a61e84a

SHA1
9c6b75c5ad9a8242a9ab163b168fcef4d13f947e

SHA256
7b30323702c25a706c6320063b3876ff37cfd68b794a4f3359c0aba6c2f75391

SHA512
a2e7e9b70245a063ff46b45ccabeddb645e9a56d25312b8351a8ada6db367866127aadd4711fec3f330e109bda4de02c53d02240013eb14297949f43d380466a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
2KB

MD5
77cc8ba82c11864629f2b06cd1ca841f

SHA1
814879c9d3885cc581343d0fbef5b9fb557a5d3c

SHA256
a28e57bd3d91c5330231424719e81ef52eea7a664de81b602006f0d8c51de3f5

SHA512
7f90d8127e440e69a68dca4574003fe3999d9d4589bfe37628dc1568b7e52f3b94dba87c43a7e6e2cda015436779fed4bd0c4b81a8cc5b6d7aa22ce1b8ee83f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
c7b47c8907e6a0c636e50a06aa2bca2b

SHA1
ebb141220eba9dc8beba4d37b55401589912517c

SHA256
f977c0d63123dedc5fb8ab075d7dd56a2dce8ff9bfb821772d6a0fc04d54001a

SHA512
e34a7df9109c1f684c905a50d86a927ab80925f1e9c25fcc77a981152a30e1a3cb8ac4df3c730e13b71906cc4d26a29ae2f816aed1b30c0412a5ad1e1332f2d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
a37fb717aa5cfc55adb50b825045fedb

SHA1
92061fe6ea5924920c4c83827bbea2653ec8bffc

SHA256
7061b7af26a903a2c74f6689eb3bf3cae1e231df5b88102b530080b166ad5d6f

SHA512
41a270ceedfe9e7218d788fc24ce0b9636ae8008320966979cbad0c13143eab95aa45dbfd9819b5385cac2ebbf4d18e9f323a70393441b12aebbc410bbbf69eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
04bc0c0eda42071a76c20f5cd8477178

SHA1
416ff85331340f1819a959f2379500ad50aaf312

SHA256
abbcae2c31f66e96f6cb805e524f3ec22215fa4334fc5bc975fe3d556bbe4bc7

SHA512
9b549519f84018506f1053ae47b292794303d921b7cd4bac9d1277c05bec5d1785a6b7188658018f48af7c43ff2273dc4f43280ed1a46963d764f83799a0d93d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
466B

MD5
6bb9d8a22645b88a79730b718164f9b4

SHA1
d08f73137a3bde6e5a91e5244e0701125c031acb

SHA256
77e5d52e65c5f49c74309e411a908b40ec9f9ab42373a68543593a1a90fcf069

SHA512
cda3e562b968365ca6fd988fb7a073db07e7cf75c8e7da23ed568f42f8d9fd1793cdee96051802b5894659050bfd42a4b5b31725482dcba265bfb0a0cdfa9679

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
4f7a8287afe04e2e7a5fbe58e17801bb

SHA1
ba93e20e009b03a5ad91f3a6631c04c534b14c78

SHA256
f20507d067e7f15d220476a3d75723bc653e98de64035ae1c496476b7314c7d1

SHA512
0de8713372887f191e96c6ed8b5a97b04f473fb9cf8525b993d9978cef4048bc36f51251b872464be969a3c673483ccbdf595469b1a26288fc582810023a5b13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61f4ac2cbda5ff53d14d4b50f9cd2034

SHA1
efbd392b52657052d13c3b027d62a748f535e790

SHA256
6522abc77b8f7c4738e72aa7088700bd9b17121ec0469e3cbd5bc1347e99ec09

SHA512
4b420495e43320a54bc16d85a97e6fd57003149531fcba4ced69097287c0fb9defe713ad6efdda3deb41ff88ba9e08bd316b440b2731449ce8fb61f2dd27bc83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e2fa28e980e78bad726f0c3e93b43f5

SHA1
b62594ffbe5c2546620d91f9367046de546a7895

SHA256
84e0aff86f0e10d9300b5c37636124221c2d87d7e9b6a8ed047d8e4bc1bd4b83

SHA512
a9e9abab4d26856d34a3f750731d85092f2c1b66b0546491e2ead6465458c9cf0acbc03502e1a6efa3a35267888eed767cca8751f4ae39273c30a934f8b49021

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
068a8e6d271be156eb6b77abcd13d751

SHA1
22ab4e927be35b5867e1aca9a946a3cf7670b408

SHA256
afb21489314b7b8b609cc035a88ffae3549321f35ac61dd1dfd0daa3e2428ebd

SHA512
f60844068cf76b3b274f68acf37811da69559a8d5274dc9b474348f8648de25c5470c4a8313f6b1b30dfe1734dfb70a68c968a999db426b257ed799a46e36d8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1156b66bd1757e21aeff233c90ed594f

SHA1
3970b85eb07587afff297db757c9924c08d84a6d

SHA256
a6aec7465adc0b295d0563c022e13cba9e8398a59a845ece427b8c34b79c7279

SHA512
f169f3229433ecb1222e0cdd06c152b5fc6c4eb9faad35b528a52904e4a3ba3108d95de5b0c3bcf09265b0020b6eaae117ab4ab56adda5ded432887ff1cd9483

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
414d8d051a950ebbab0391d893120e74

SHA1
fdeb1947826ac38987bf97e7c46dbc7b4b6688b8

SHA256
33b2c9a1edcf6c6b3658a0202f7eea53c6eb7e2a097a065be3daf167fd014014

SHA512
30d5994a6dd6b25d64d9f7aa4cf730a58a04abe6b5b3cce3b5ec3cb81a684fd00edd7f0dd3d0c1e2a610b00947afaa47b8ad4d1fb5fc8ad969d77ec48c7577af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9b7c5e5859d6c03397747f9b98c3fbd

SHA1
2c0282c344028aff3158be77c56cc0e2e9ef519c

SHA256
946314a4454af8b9eb6810d18f5f4701c25f7094f053c22c066128ef76dd2026

SHA512
3f1f6d6f6b10c7b0ad3e084a33243cf8048ce1933ef7e4cb744f2135b9e6f1fdd66bb9f229f112c94821e42d2c44e75cd64bbc708a6552062409bef876bc38c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc9447e89445b45dc9fbdc776df23256

SHA1
4f3a6681131797005f651cd539196161659ca12f

SHA256
bb6298fa5776a79fbfb7147107894f4b3e882b5173d75f4d98defed9f7134cfb

SHA512
b5110413039a9cbe2cbfce4c1470d5f5edfacd92d3444d4996bc9ac87569696522bdf3938cc1a407d7fe7df3eba83dd2d5647f94c322f781e8a96231c8d16580

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dd7ae84e13da87109b8a2c40a1c9149

SHA1
4e5c46552c78245f37ea26cc82a2f09a4612a938

SHA256
1a072e76fe4d9004823313db46d79598cd5aa80ffc7584a48cb3742d10ec96c2

SHA512
66e9b5c4005e72c5fe6d4dea962916de3ed8e8ef9a5cf73e171fc81c45d45623829150429fb6de669a6436f08ba1ca31efa67b25420381a6d9ccd5790eb576bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9834caefee74861009d18945d67277ef

SHA1
97a63a0608c7bb8f9df789664f5b7e6b21799c7c

SHA256
03eb08ced8084cf274b10a44258e0f9c523993b955cb6a00061ab65fff562a05

SHA512
de80b472a9c89d966b0bca78702ccfe782812c333bbba198370cdf67efd2ec9c5d71d608674ab7784d02d7f9b9cae29dc1e0f69b29eaedf60e2216be4e22cad1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0843fba8de3c26d3d46462a34ff40a1e

SHA1
1026bf123aed67c72a761f57dcd5685f11013d82

SHA256
302a61c5ca1d5701f3b3adb108af61bcd361348c6d2c9dc59dd8a327a7a9fa79

SHA512
0208e2aceb59213e4042fef62daa7632986c965e30a99e6ce273b698fdd205f45d20ddff7fb49cd54a5f7d3a0625cdb5fd83ae3f7fde09578f7d38bcb4c68939

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7d065c6f2afeb9a342b8f5f105b1369

SHA1
ed845eb7a8bd67cb11eeca771aec5331ac4f4d4c

SHA256
d4864752bbaf3e023ab4ba32307513ef309cc37edb7ea50cda9135b7fe176a07

SHA512
3bdea05b5675afee8d4807063b123c13d34e22be1289bd44795f7d0a0fcce265950215510d2aa5a3bb32e573540e73e7e89262a26410f5822a8402cd31dedffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7184b2f0a8f658e0a80b94ce7b4c11e

SHA1
21eaf1759e90e1faa1a519e4e8bc3f37d83c23f9

SHA256
f7a0b98d121b8ef99d3979ea21b4bef0b4e6a4659b62160d448931eb0d9e95c1

SHA512
b9e913aebb2a88111cf5a8fe0a56e94ac3d6f46d212d4b93d87035bdc35e9634f66d8c09d55a040f2fc9b1819880314c62939d08e5da35ce24cbf6b05e181256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7d221a7764436f9fe27f0db23b3894d

SHA1
e1f8f15576c847beef62dc9d0b5dda5b89989d78

SHA256
79b1c98396479a46547ab0a452142ca6377cb387db1e2202abd0e0525909dbc8

SHA512
b3b8f4b47b99290e9b3659e7f727d637982ac9c1505036da375be4099bac52eadc70fba8d66462acb0f18aa776ab77bee8b63cb6cca44e4d868836d3e23035af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1e206b4201e4ffcf5cb82c26516724d

SHA1
24c0e55706c2c7dc476da54022861d0971e36c1c

SHA256
91afe0f05e85e714fc12873affc971fc79fbc03459b74bb517f018887a9806d2

SHA512
8cc609567db71058a4f0d86aeecc68a591ba2f02af5b8539c3105e802c98407b2f4ca66c140298761c27fc6acb6a142aa04894ad9ff2e8da88225e03534d962e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c82ec7b826e9d3a60060a84b65e51d9

SHA1
344e3ad7ef0e9cfc203137b4a6dcd19cca90af25

SHA256
8dbac29a3b02b8f26ea69fc8d6f62c44b52374b1bd7e1649bd07f10306539b48

SHA512
0346d50a03e7c9b171de187b1376c98ec125f1baf0b3b0d5fbfa19ba0d3a8633e617a9af8374df8ac4985e7ee2a5c1d3965f3e1fee0680ca7f1465c191a69ae0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1be99c30a49d1a46b893e93745729fb8

SHA1
5f0584b8017fc5297dea645c210a5a89531f2327

SHA256
8d30a54d13a3d4e3789f6d98a3648c1a0dbfcf13f553208379de29154a095f65

SHA512
23baf1d5e9b9f1e875b070aaadd1a606e54419ada559d3651ca12c7e6a0cde9c9003da6216faffd0553beddc1d8a9fa57fe5ad6ebfdb2577c32f6b1c54b3ff9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5677bb30b628d2276cb8907fdac25c3

SHA1
581fc42c032f792d39feabd455b12dd3d4bd1bff

SHA256
9471561d8fa16b52f663b7c942a5b9836fd321f9103437d32d32f0861e4a1d5b

SHA512
978e640cafd96fd1c08e8993ef1621078435ddcbeda4c5dda06541aa0b8fe5f16c84afd8e26989dae309f65b2484570bb35c1b7d17e68b5860dd2db5dd949b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7638fbf301efb7eab6a3e825a765b9d

SHA1
c496cb2e94a4083c5ad321d85c5bd1ea62be2835

SHA256
d6f31a2e22d02331c810a001e69d66fbcf6a2f482090bee29b65b4d45ef5266a

SHA512
59c350105052bb1b81fef3eb10e4315f2cbfa7f91beb6feec6fa5dcd13fc0969bbb27f425a7a8f8b739a75f6c311b89db3717f3be5a1b300b6ae8b4fc8c63a4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c53607075ed447eb7ecfe04d3bbe037b

SHA1
fef83e84c78ea9d7f5ecddece6320791f06e4661

SHA256
a4384b5bd967c5179f1f85a810510017f86cd28917637bbfc0dfa22861862476

SHA512
1ef7e6d41d468a028b84ef3801476c66470aa8929b4cefc4ecea418ba6523f70ee196b7c783055f45ab7b8408b8771ff8c28c2f9c1cee4bfe903558ec301134a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ff4e6a29502a03b874fc3c06e57e3f7

SHA1
966bf1b128a378ad17ec9430c9b88d8a93527a6e

SHA256
a50f5ee41b54cdcb7734400113f87807b3c4c626ea0892ababcfcb600b4b7153

SHA512
6d5553dda6929dfc2b3ddb584da20e47e788c91677fa48a5de5055324960057175340434111acd22e0670573d4a8b1a06a7bdc9b9e962683e5ffca8811587021

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b835ad264398b04dd60a5b87a6bbdd3

SHA1
f4c9f80b2fafeea5e93a7990bf99095e0a831352

SHA256
8a9f5ade8462131048de26ee2d2fca8c6f9f0babd4186c16b40bade4a56b3eee

SHA512
ab817b3df8750bfec0136c58edb58eb0bce5d14648b4dfb8ff385995b27fd2338a9c1007097e5dd88dfc93c6fcefcbc4f764a7a89d609e185782d013af564bd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a65027db1edd67bb90894c663760e12

SHA1
2cc51678385ae6567d566d7204565e940c282036

SHA256
ccf370c793bb3cb0b58744bf0eac14c0c3d74b379406020356578ff220f8eea3

SHA512
461952bb9fe3536db80da3c2f92e7f26c3e1247848fc03f6601d96e2e702164d60c2c74e0665650360a0c3d2550f4978889ce884fe17a4f9122b89762d85091b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_A3FC0BC6A75F11C789144CCDE90F5957

Filesize
414B

MD5
f7f13580fe8eb8e9b54d832c22a178ea

SHA1
71570fe91b0489988693cdd6bd9ba92919f4c83b

SHA256
6804a39a110b32bc8a85d0c9d2593b61d2ee2c5220da4cdde3721e172d8ef7b1

SHA512
424e974bbc883f001543472620eb6df6a0d0bb377865014e157a368ea69a50e07ae77f3ba37ffb835c6f66257d6f25a60cf9737051e5a800e5b6d6a20314f309

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
2b5781023547330c92a87727dad8ce99

SHA1
2a02f614dc8fce93e86f552db3b554815b20a1ca

SHA256
b36f0e766bad3f754820f6fdd432d35ffe2a46d2e1f64bcbc9373c49fb84cca4

SHA512
6a087a156f881092b01e1e4d02ebbfe98e073b5a3a3cf2f4d0539422dec3348afa9ef52dbd75aed5ca11423421cfbeb83cb457ed7a34cd5c2e52ed8b6b337318

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
470B

MD5
9df31b1df1d2fe40a7e9494c27e2775c

SHA1
f144bec05ed7a91570be927a4b644900a3277c95

SHA256
f65276b9030d27ed52d340db09956b67a5eb1ee7a5b38f2085d5f6b96304cad3

SHA512
b8f9d2b2346356c943764b3e3acc24b7a971bb145ea8f1287fa9114ee9a6785b803df3695f95832884d87b255dfcb7e0236a48030fa892f0af2ee03b40fe4e38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
67bd17dd4fa95f79797dc71e34480ec1

SHA1
940a49a48c1d1bd150b36a8847ab67a43b0c2f54

SHA256
ac7f8b1db1bfcde6ba92f71522b40de0980dac1c69d982cb60903a78e9347096

SHA512
7208a037f5485bde90644f9f389584de9ee5fd86ec9f2870e59fc8e258c2fdb1360133835d1c9e61b7f4bb9ffb14ac7cbcc94a0bf60996332175371f1e24b565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1LNUKNV0\errorPageStrings[1]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8452S9S3\caf[1].js

Filesize
150KB

MD5
73e7e417e2896173ff6cebfd032e6a38

SHA1
deab5685e1f4ac741b186dfe508c1b7ddac15a0c

SHA256
5e87fc9cd35188c5ceb5feb7ccffbe19c9f54a42f08add519e1ebbf57cee3d12

SHA512
fef118373c8eb5246349e6ef315f1d8563ef5bb5cdf9e0997980f6ea207a6701d1992ff484b8579841a5f6ef7b1dca8d704dba73e8eec8e7a305e617bf271812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8452S9S3\httpErrorPagesScripts[1]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8452S9S3\main.ef90a627[1].css

Filesize
3KB

MD5
3f821ada778691e677aef2cea8c4b4f6

SHA1
643e7b729b25c2f800469623191dc837798e9d50

SHA256
7510035d553a99fbf93eb67737b2df057ce096fa1ed7aad83cfd559e11f2320d

SHA512
8993a8ad28ed4035a022d1b7274c77a97b8235b2ddcd5e6d29f7230d375851539900d4ace652c94c4be8a8284ffd86501df420385a6e680df4222c162deff4d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IAE3FJ0M\ErrorPageTemplate[1]

Filesize
2KB

MD5
f4fe1cb77e758e1ba56b8a8ec20417c5

SHA1
f4eda06901edb98633a686b11d02f4925f827bf0

SHA256
8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f

SHA512
62514ab345b6648c5442200a8e9530dfb88a0355e262069e0a694289c39a4a1c06c6143e5961074bfac219949102a416c09733f24e8468984b96843dc222b436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IAE3FJ0M\caf[1].js

Filesize
150KB

MD5
3c537b5dbb95f6041709013496655569

SHA1
72aaf822abcf1d937e5b9231ae34d7cfc04108bb

SHA256
6ec0f0c9e2481821f3f88931bb500b68a8cb7835b9c5abbd876bf9e1d3d9f32b

SHA512
2d213a5024d59f754c222f00a209ea599c7c78f9ac0a8a5a3dc2221603cd37a2cfbd0a4fc9a7b66a58064e426bcf629c806f99e5414c3f9c81c34e5941a876e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IAE3FJ0M\caf[1].js

Filesize
150KB

MD5
c29ca6bf7bd69a8ca35cb7e899b02354

SHA1
385142213e863a53951d9540f233a8bdff891054

SHA256
0810ecb297f4e029e74ba34b557efbd0da94a06521abbd36f8bb1c512aea4dfd

SHA512
ffc9f1970028055abf2cb5b04c29f0d55207c392b5c6fba70dd250f3ef683af5dc765be5f0998b4105fe18fba9c3f06c2a7f8cd357ae8e82e271772718d07e81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IAE3FJ0M\main.36e19f48[1].js

Filesize
674KB

MD5
449b102f3891baa1b7e19c676a443066

SHA1
09fc9b6b47f792e96339121fe61a7b1c53c8481e

SHA256
81a5900839e1bb0d7504909e489997d1dac54fd473face4168d9377d73cfa46f

SHA512
06162c2a757dab2dc244e22d1f022f2f65e6fb9cac72b2bbf5a7e266ac80a1392ea04c9651fd6a3535d22c59410588659331f869e56aff395cf72f3ef1321610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IAE3FJ0M\tag[1].js

Filesize
58KB

MD5
7378d3ef3bcb274a3fef6a74579f059a

SHA1
e8d6929cee9bbeed6519efff66d2183aa4cc323e

SHA256
076fe7eed544528a51dbcab080a176591e0ab5b5f4dd2f5b2083a142f083c0c6

SHA512
f7f15dfa27558506783687adede1a1a4aa88b6713026a21ecb4b98c8d63a2075d1dd04e3bc36b80a5c19bec491a3281126c7af5b3de92980c2c6a76ffb6f9ee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\S2LTA58B.htm

Filesize
220B

MD5
8675b7e831ca32c181bcae97697f66e1

SHA1
e55bd6a8e1ba6b9f0ab83c92899b67a318cf4aea

SHA256
eec20fed1b69999e8d0bef7a6004193038c97f7a19d52fd6afaded1c0edf4ef7

SHA512
698696eb393f8d54ebc9bb478f79a934c4813c59ddde879591e425811493fc94352e649b745d976f3d877b6241dab7f6bb38c2f3b9eebd9fcd2e94dd754a2066

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\http_404_webOC[1]

Filesize
6KB

MD5
92ab50175c4b03970f264c637c78febe

SHA1
b00fbe1169da972ba4a4a84871af9eca7479000a

SHA256
3926c545ae82fc264c98d6c229a8a0999e2b59ed2bb736f1bda9e2f89e0eeac8

SHA512
3311f118963ad1eaf1b9c7fb10b67280aae1ab38358aed77c10f2587100427af58c7d008abb46ad0f59880ac51e50b5a53fc2c2a96d70f5ece4578ab72382b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\lander[1].htm

Filesize
620B

MD5
b90de8db327e4bbd8578971715c20f6b

SHA1
4a86f6e7979314934775d934d6f00e96a3ca3418

SHA256
5e082d46aa366a8e97c98d5ea3bd3811ffd29373698ec0d22bfc5ebd79721f9b

SHA512
7abf7059fd439c388998dd00bc8093e39fe42bdd05c7a5ed8c0001903ce071bed47f9db649be9d27e657130b59739d63c8f905d1df5f4be6ebce1afb55ed333c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB241.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB2C1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms

Filesize
3KB

MD5
a11e0b31d8409f4995644334a43bbf09

SHA1
d8fbeb28401661a001e547d2d3366b72b2ec199c

SHA256
29e80eeb8cfd82aeaa9f272d6a1b38942912126dd77f1f31ea2e73e088c088da

SHA512
74c8ebb7759b47a2ef1bc6497779137526d1a585bb2de92dfc0a1a15b4485b1d49e9a3f5d8baee94b2a2c6a673e344afd8d76ae99781af0ae033fb9c9960243f

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
929KB

MD5
3a263feb4cfd5e232ccbadc3cec739f5

SHA1
6e1312546cb23ce0c970640c592bcb9c1cfe9bc2

SHA256
f71bfea2e40f694a2f83fb99568632b04b7ac154ab0b46aa2ea92d32b21a8fa7

SHA512
5fd37927241db61a7c6bf3b04ea4f1ff9014b55f087435fd277183596c6a6eeacbaacfeaf1d8899d493f162da408ddf6598c5019bc267135f59e71cbbb8da59d

Download Submit
memory/1736-23-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1736-6-0x0000000000E10000-0x0000000000E4C000-memory.dmp

Filesize
240KB

Download
memory/1736-5-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1736-1-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1736-7-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1736-19-0x0000000002620000-0x000000000265C000-memory.dmp

Filesize
240KB

Download
memory/2344-32-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2344-30-0x0000000000A90000-0x0000000000ACC000-memory.dmp

Filesize
240KB

Download
memory/2344-188-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2760-36-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2760-1306-0x0000000004E00000-0x00000000058BA000-memory.dmp

Filesize
10.7MB

Download
memory/2760-42-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2760-39-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2760-189-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2984-20-0x0000000000A90000-0x0000000000ACC000-memory.dmp

Filesize
240KB

Download
memory/2984-26-0x0000000000A90000-0x0000000000ACC000-memory.dmp

Filesize
240KB

Download
memory/3044-0-0x0000000000E10000-0x0000000000E4C000-memory.dmp

Filesize
240KB

Download
memory/3044-4-0x0000000000E10000-0x0000000000E4C000-memory.dmp

Filesize
240KB

Download