Analysis
- max time kernel
150s - max time network
142s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system - submitted
31/10/2024, 02:12
Behavioral task
behavioral1
Sample
8126840a68ac0b59131895236692c577_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
33 signatures
150 seconds
Behavioral task
behavioral2
Sample
8126840a68ac0b59131895236692c577_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
33 signatures
150 seconds
General
- Target 8126840a68ac0b59131895236692c577_JaffaCakes118.exe
- Size 1.4MB
- Sample241031-cmvsvsxcna
- SHA256 d38e4a084a04993bf205a802fb04c83ab1436319c95605595bb274231b19c435
- MD5 8126840a68ac0b59131895236692c577
- SHA1 9a610c195b9b153d8f31a0cc786f709372bc81d7
- SHA512 74cacd4ddd9253f960fac294c36c13e9d7d94f10808622db2acb8cdefd5fe65ef6e603313a8996322f11c935bbebb3c5a58253e5dcb879f95a0c674845a2e4c8
- SSDEEP 3072:hxAMvBIEH5OIPPSwSHErh1Rj++Ekibboxd2Kzm:hxAWINKSqh1Rj+TnHqm
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies firewall policy service 3 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" winlogon.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List winlogon.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List winlogon.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List winlogon.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1" winlogon.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401" winlogon.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0" winlogon.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750" winlogon.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0" winlogon.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" winlogon.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861" winlogon.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile winlogon.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications winlogon.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246" winlogon.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" winlogon.exe - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3" winlogon.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" winlogon.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1" winlogon.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0" winlogon.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe - Disables Task Manager via registry modification
- Disables taskbar notifications via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts winlogon.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds-3.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcontrol.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drvins32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwatson.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavlite40eng.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ostronet.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccntmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnlan300.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscanx.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfmessenger.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qserver.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\realmon.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\schedapp.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winppr32.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atcon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EHttpSrv.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fast.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsupp95.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smc.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ncinst4.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtvscn95.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nd98spst.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpf.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSACCESS.EXE winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_findviru.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atcon.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccpxysvc.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icloadnt.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sphinx.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luinit.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnotify.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwebloader.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkwcl9.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpupd.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcc2k_76_1436.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vvstat.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winppr32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UI0Detect.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv9.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\connectionmonitor.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpf.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbust.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fprot95.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\generics.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ogrc.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpftray.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netutils.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectx.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rshell.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavproxy.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\platin.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\"" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdclt.exe winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\POWERPNT.EXE winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanh95.exe winlogon.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe winlogon.exe - Executes dropped EXE 4 IoCs
pid Process 2804 winlogon.exe 2508 winlogon.exe 2596 winlogon.exe 2904 winlogon.exe - Loads dropped DLL 4 IoCs
pid Process 1764 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 1764 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 2804 winlogon.exe 2508 winlogon.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1" winlogon.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe" winlogon.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe -
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CNFNOT32.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOSYNC.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONELEV.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANOST.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANPST.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SELFCERT.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WXP.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXTEXPORT.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IE4UINIT.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\INFOPATH.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTEM.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSE.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINWORD.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IELOWUTIL.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOHTMED.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORE.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\POWERPNT.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DW20.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCELCNV.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GROOVE.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSPUB.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSQRY32.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETLANG.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DWTRIG20.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GOOGLEUPDATE.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOXMLED.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTE.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPREVIEW.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEUNATT.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSHTA.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OIS.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ACCICONS.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEXPLORE.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSACCESS.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSFEEDSSYNC.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORDB.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLVIEW.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCEL.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GRAPH.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OUTLOOK.EXE winlogon.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WORDCONV .EXE winlogon.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2860 set thread context of 1764 2860 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 32 PID 2804 set thread context of 2508 2804 winlogon.exe 35 PID 2508 set thread context of 2596 2508 winlogon.exe 36 PID 2508 set thread context of 2904 2508 winlogon.exe 38 -
resource yara_rule behavioral1/memory/2860-0-0x0000000000840000-0x000000000087C000-memory.dmp upx behavioral1/memory/1764-7-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1764-6-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2860-5-0x0000000000840000-0x000000000087C000-memory.dmp upx behavioral1/memory/1764-4-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1764-1-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x0007000000018636-12.dat upx behavioral1/memory/1764-13-0x0000000000510000-0x000000000054C000-memory.dmp upx behavioral1/memory/1764-19-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2804-26-0x0000000000D10000-0x0000000000D4C000-memory.dmp upx behavioral1/memory/2508-30-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2508-37-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2904-39-0x0000000000400000-0x0000000000443000-memory.dmp upx behavioral1/memory/2904-46-0x0000000000400000-0x0000000000443000-memory.dmp upx behavioral1/memory/2904-43-0x0000000000400000-0x0000000000443000-memory.dmp upx behavioral1/memory/2904-42-0x0000000000400000-0x0000000000443000-memory.dmp upx behavioral1/memory/2904-593-0x0000000000400000-0x0000000000443000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8126840a68ac0b59131895236692c577_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8126840a68ac0b59131895236692c577_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe - Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Sound winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Sound\Beep = "no" winlogon.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://o7miyo13eslsq1s.directorio-w.com" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Download winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://9v5xutgqnyz0lh4.directorio-w.com" winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "436504530" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://9p0gazss7t8elao.directorio-w.com" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://615wr7318h4uc11.directorio-w.com" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://2j35w93w0b8419h.directorio-w.com" winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://1579f0m1wc9e333.directorio-w.com" winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000095e656d4331da74999cd4cfd61f705750000000002000000000010660000000100002000000015cec8f943fbe8b392844f954430f0152d3b867cd2c9f9e70cb19525fa47864c000000000e8000000002000020000000c9fd9e4436570167eaa76b48a5eb8a60350d9940ca11e0e856012d77328274b090000000b86b567b9a2e269f2ab5fe09a535cfed2e56550c0eab296ee09fa469950131bde9a7f3520e5c58bac2a02f80679530f3c96dfaa3c2316323f5c2586853edb6fb1ac67698378d54d1fae3f118ffa264c975b74c6c6dbcd9c10e2edf8c66afd77a943eb5d35469afc2e5b1836e1f5395f0673c808f0d783dc85cfb8e2c435c986e9db2e3255ce2960d9dc2e540cad2d85340000000b7bc46a8931dd9e9581e4d6802784c8f4c8d1bea4113b10c83df2d7d90e83af05ba3ffff5f117a48cf332dc3fcdd5cd40b1b5c1f0c801ba78e2760d623ba7a8a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{094105F1-9732-11EF-B4E2-F64010A3169C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no" winlogon.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e584cc3e2bdb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://321nh6u1sp2uf5n.directorio-w.com" winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000095e656d4331da74999cd4cfd61f7057500000000020000000000106600000001000020000000e7ff2fd2f7fead5001a7eb7a8e20fcd885e1bab5dc0d0b75681ce5a7435fa08b000000000e800000000200002000000062a0fde4347208f12350b69b951ede93b26919640103c1262e0b93f36d3f46c02000000050e9c69dadfa048d64dace47dd2ddf13c068d1a56796a008564cd6c7b0a05efd40000000d4bce429c18058e2ab0a09678fabe5485c81bc4b7385a3b921f5fff8136fe256d54d6b42c136cb473169b700d354a4a846198554322ea8e98a63963ce18128bb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://m753b67257x7iz5.directorio-w.com" winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe - Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://1v8y6140umdx5x2.directorio-w.com" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://1vk345wxzr1s7gh.directorio-w.com" winlogon.exe - Modifies registry class 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\"" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\https winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\https\shell winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\"" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ftp winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\"" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open winlogon.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2904 winlogon.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeBackupPrivilege 2904 winlogon.exe - Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 2028 iexplore.exe 2028 iexplore.exe 2028 iexplore.exe 2028 iexplore.exe 2028 iexplore.exe 2028 iexplore.exe 2028 iexplore.exe 2028 iexplore.exe 2028 iexplore.exe 2028 iexplore.exe - Suspicious use of SetWindowsHookEx 45 IoCs
pid Process 1764 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 2508 winlogon.exe 2904 winlogon.exe 2028 iexplore.exe 2028 iexplore.exe 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE 2028 iexplore.exe 2028 iexplore.exe 1232 IEXPLORE.EXE 1232 IEXPLORE.EXE 2028 iexplore.exe 2028 iexplore.exe 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2028 iexplore.exe 2028 iexplore.exe 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE 2028 iexplore.exe 2028 iexplore.exe 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE 2028 iexplore.exe 2028 iexplore.exe 1728 IEXPLORE.EXE 1728 IEXPLORE.EXE 2028 iexplore.exe 2028 iexplore.exe 1232 IEXPLORE.EXE 1232 IEXPLORE.EXE 2028 iexplore.exe 2028 iexplore.exe 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE 2028 iexplore.exe 2028 iexplore.exe 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2028 iexplore.exe 2028 iexplore.exe 1576 IEXPLORE.EXE 1576 IEXPLORE.EXE 2904 winlogon.exe 2904 winlogon.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2160 2860 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 31 PID 2860 wrote to memory of 2160 2860 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 31 PID 2860 wrote to memory of 2160 2860 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 31 PID 2860 wrote to memory of 2160 2860 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 31 PID 2860 wrote to memory of 1764 2860 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 32 PID 2860 wrote to memory of 1764 2860 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 32 PID 2860 wrote to memory of 1764 2860 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 32 PID 2860 wrote to memory of 1764 2860 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 32 PID 2860 wrote to memory of 1764 2860 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 32 PID 2860 wrote to memory of 1764 2860 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 32 PID 2860 wrote to memory of 1764 2860 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 32 PID 2860 wrote to memory of 1764 2860 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 32 PID 2860 wrote to memory of 1764 2860 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 32 PID 1764 wrote to memory of 2804 1764 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 33 PID 1764 wrote to memory of 2804 1764 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 33 PID 1764 wrote to memory of 2804 1764 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 33 PID 1764 wrote to memory of 2804 1764 8126840a68ac0b59131895236692c577_JaffaCakes118.exe 33 PID 2804 wrote to memory of 2576 2804 winlogon.exe 34 PID 2804 wrote to memory of 2576 2804 winlogon.exe 34 PID 2804 wrote to memory of 2576 2804 winlogon.exe 34 PID 2804 wrote to memory of 2576 2804 winlogon.exe 34 PID 2804 wrote to memory of 2508 2804 winlogon.exe 35 PID 2804 wrote to memory of 2508 2804 winlogon.exe 35 PID 2804 wrote to memory of 2508 2804 winlogon.exe 35 PID 2804 wrote to memory of 2508 2804 winlogon.exe 35 PID 2804 wrote to memory of 2508 2804 winlogon.exe 35 PID 2804 wrote to memory of 2508 2804 winlogon.exe 35 PID 2804 wrote to memory of 2508 2804 winlogon.exe 35 PID 2804 wrote to memory of 2508 2804 winlogon.exe 35 PID 2804 wrote to memory of 2508 2804 winlogon.exe 35 PID 2508 wrote to memory of 2596 2508 winlogon.exe 36 PID 2508 wrote to memory of 2596 2508 winlogon.exe 36 PID 2508 wrote to memory of 2596 2508 winlogon.exe 36 PID 2508 wrote to memory of 2596 2508 winlogon.exe 36 PID 2508 wrote to memory of 2596 2508 winlogon.exe 36 PID 2508 wrote to memory of 2596 2508 winlogon.exe 36 PID 2508 wrote to memory of 2596 2508 winlogon.exe 36 PID 2508 wrote to memory of 2596 2508 winlogon.exe 36 PID 2508 wrote to memory of 2596 2508 winlogon.exe 36 PID 2508 wrote to memory of 2904 2508 winlogon.exe 38 PID 2508 wrote to memory of 2904 2508 winlogon.exe 38 PID 2508 wrote to memory of 2904 2508 winlogon.exe 38 PID 2508 wrote to memory of 2904 2508 winlogon.exe 38 PID 2508 wrote to memory of 2904 2508 winlogon.exe 38 PID 2508 wrote to memory of 2904 2508 winlogon.exe 38 PID 2508 wrote to memory of 2904 2508 winlogon.exe 38 PID 2508 wrote to memory of 2904 2508 winlogon.exe 38 PID 2508 wrote to memory of 2904 2508 winlogon.exe 38 PID 2028 wrote to memory of 2176 2028 iexplore.exe 42 PID 2028 wrote to memory of 2176 2028 iexplore.exe 42 PID 2028 wrote to memory of 2176 2028 iexplore.exe 42 PID 2028 wrote to memory of 2176 2028 iexplore.exe 42 PID 2028 wrote to memory of 1232 2028 iexplore.exe 45 PID 2028 wrote to memory of 1232 2028 iexplore.exe 45 PID 2028 wrote to memory of 1232 2028 iexplore.exe 45 PID 2028 wrote to memory of 1232 2028 iexplore.exe 45 PID 2028 wrote to memory of 2928 2028 iexplore.exe 47 PID 2028 wrote to memory of 2928 2028 iexplore.exe 47 PID 2028 wrote to memory of 2928 2028 iexplore.exe 47 PID 2028 wrote to memory of 2928 2028 iexplore.exe 47 PID 2028 wrote to memory of 3052 2028 iexplore.exe 50 PID 2028 wrote to memory of 3052 2028 iexplore.exe 50 PID 2028 wrote to memory of 3052 2028 iexplore.exe 50 PID 2028 wrote to memory of 3052 2028 iexplore.exe 50 - System policy modification 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0" winlogon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8126840a68ac0b59131895236692c577_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8126840a68ac0b59131895236692c577_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:2160
-
-
C:\Users\Admin\AppData\Local\Temp\8126840a68ac0b59131895236692c577_JaffaCakes118.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\E696D64614\winlogon.exe"C:\Users\Admin\E696D64614\winlogon.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵PID:2576
-
-
C:\Users\Admin\E696D64614\winlogon.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\E696D64614\winlogon.exe"C:\Users\Admin\E696D64614\winlogon.exe"5⤵
- Executes dropped EXE
PID:2596
-
-
C:\Users\Admin\E696D64614\winlogon.exe"C:\Users\Admin\E696D64614\winlogon.exe"5⤵
- Modifies firewall policy service
- Modifies security service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Drops startup file
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Indicator Removal: Clear Persistence
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2904
-
-
-
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2668
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2176
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:930833 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1232
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:2044943 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2928
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:2044955 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3052
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:930863 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1728
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:1979424 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2444
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:2831383 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1576
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Indicator Removal
1Clear Persistence
1Modify Registry
11Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199
- Size 854B
- SHA256 a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
- MD5 e935bc5762068caf3e24a2683b1b8a88
- SHA1 82b70eb774c0756837fe8d7acbfeec05ecbf5463
- SHA512 bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
- Size 1KB
- SHA256 592115ed4f1407febb0ced51e613ce66ad32d84143bfaed2c5990ad439a3cc71
- MD5 3755dc974dc983c89c3eeb17650ddf77
- SHA1 54142c635c10f3babb9d8b1664be790718e96d0b
- SHA512 6c2d76c24a005cf92121e2ec96ea1e6cbe93d6c2c48c910cbbea411841433148bfadf47c6ef85d5e7ce8b33f97ccc9131b314c8f9457b7f149ddb9451d02d95c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
- Size 914B
- SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
- MD5 e4a68ac854ac5242460afd72481b2a44
- SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
- SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562
- Size 2KB
- SHA256 677c2e00b2bd2a8bbc4721cc7ca4ff0d5ce334fb3f8757396c7df51bd61ba989
- MD5 b44b786694bfd96d3c090058dff2efd9
- SHA1 d1d8701831fd00e083b82703c42e7f3d5c9b53a9
- SHA512 ad9a05daa2d007c42206ba13277e85f275f151ae9f7f1e4b1844e743a157c91cfc66bf2dc2068cb8279c5c29604a6cab7e961de7e45cf273f9211cf5d0ac171b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
- Size 1KB
- SHA256 facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb
- MD5 67e486b2f148a3fca863728242b6273e
- SHA1 452a84c183d7ea5b7c015b597e94af8eef66d44a
- SHA512 d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
- Size 436B
- SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
- MD5 971c514f84bba0785f80aa1c23edfd79
- SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
- SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26
- Size 2KB
- SHA256 36c5f4a91e0125bd55d53e618441b88118d2b043ed2c162e0406b2b257e829fe
- MD5 ec48c020024ca393990eaad1c4166bd2
- SHA1 5645e6a65c6ee1cd0491f7bc417d22d30af7ff4c
- SHA512 6102a4c3a19bf097e918925c09088734aa1cce998803d7063f6900b94ecc161560d3d5bb3201a28cab8a944040d59f18df4bd4704e148bc98fcd2c7b73a4d9c6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_6C4EDE6B4E04AD6FDB8E61232C576EF9
- Size 471B
- SHA256 7d8dd79e5630070e5ef07b78bd2e586528b9c2807cbd88471088b35e31f37828
- MD5 e9855b3c6f08d1f2c13a88b4dc7cb955
- SHA1 cc43861c842b195cc022d8ccf9f6984ddd88d4bd
- SHA512 3a04b7125a7d2a1403677b2c5a3a91cf81101093a004255034637aeb4dac0b96687b454e8ab9dae0e6cf6c0bfea917f3caf6237d84b7f52f8246ac0c290952a9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
- Size 1KB
- SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
- MD5 a266bb7dcc38a562631361bbf61dd11b
- SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
- SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
- Size 170B
- SHA256 30f9333261f40999bdc967f9a4702bacc11060203f42e12f1c863b804fa62c5e
- MD5 ae2383c77f84432d7be920b06b0defd4
- SHA1 e6586a1bc19d4535b0174e2396c01ab916dd9014
- SHA512 3fd2eb7dd0fbd8795fd3e28da214536629f9c5f7afbdf4488c5a7119c4d2884e58eaca1549f7caa90ce048488b50b6ba564770cbddac06315b3c40d8794c0bec
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
- Size 410B
- SHA256 d6642f5689531d601e3d2d657adad8ab66ba674d05f36c1aed89848ca62192a4
- MD5 795fdf71a1c15172511a1caefc1acc00
- SHA1 c1175338460612d258ff9763ee62eef58141dc93
- SHA512 4657a9741bb84c523f09a5bbb0d0c3a1acecb8904e45e994c544d7f656c9d3ba6c4431a05b1ce1a6aa616f32c503c75853fcc1204461b3fd4e62164b3f4b2c57
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
- Size 252B
- SHA256 caa780a9aecf00b2def1e456d919eea51f06d4da83d435aa96e6113538406d9e
- MD5 bb370fe147dc46c1be43098dc4cbb5b1
- SHA1 c4035637e412a4709507ef02768fdb537ec05548
- SHA512 0713f9d7817d68d64db9c3cd70124015f2518a8edc6682467b9ba6713b54875cdec2ec394e01918ed1700beb85f90b6b92aa13820251ca0bd0c4d4b3b26c5be8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562
- Size 466B
- SHA256 fc14bba6fda5e38034402c001a8cd65f242dcc1f883cc8df637c00b5ad9c2dd8
- MD5 7baab2145b2248bfb00cb989f6857d57
- SHA1 532c61e53b41adc0161db7f36c6495a769d55bf0
- SHA512 e9f580201e5d9aa8577aeedc7d7df663d22eb3a8d39307ea640a62d7f28a5d67aa7f78834d9784e4ddb6a9b018babf2b6a3d1ece635d8345e1cdff757ce7e7ac
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
- Size 174B
- SHA256 8097408238997c4dffd6e6185e2ad8e0bfb863a4262ea7f9fb2719462a6712e1
- MD5 dac86f6676b6f14b52578dbd4394d0fd
- SHA1 053a5195d8b611abdcebf74d9a7b46b8d70097d4
- SHA512 3a22ef0437a62daebcc99d4461afad79f99d88f057fa5a9aa68e930ee03b38f373bcf20dd3381792f86a41b0ad3760e2ef09b8f8b14264fdc58287ff858a0bad
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 63630cacf99cb6331490228f51b4c52ef9dd45e2d13adae07c18cf6114b1b827
- MD5 efe2aa3710b0e0d2bd61e68ab5235e0a
- SHA1 43745b5e01b31b03b041f009493f85caea08f61e
- SHA512 a5ecd72abac5e2a0e3aa4c3257a39a9f52b88a71e2adf5ed1d6a70a47ef3aa0a47b6014e06e2f179dfadd0091fc8fb4ce1bc592afa3cb16fd33db6a2aa71791b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 0259b7b81521f22ed1af97964ab8845e505b1257efc8f6c36083cb82ce36548f
- MD5 ede10794f4c601081772dee7cd30e33f
- SHA1 7df7545b9be43acace07949e2002eeb40be0248b
- SHA512 6aa83900059c5dbc525cae2190871d24c76ef130f72c916045c5bc16a827500291037bf845bb3bffae16d0d1c02c3888d1b45ecb92d45d24df73843201b8ab10
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 317af094b3f43c9250e6521e43fb837f4afe43ec6ba3489a2685a78e5085b351
- MD5 bac6b94b3a240774bf5680a3a3d7b14e
- SHA1 82512190ca16b27dc03c8dd15f8c05c6b953c62c
- SHA512 a38b97e5fe3b3685a1a613e4f0efc4b370f101539c330edfb095ef79f7a863145fbc1b8667539f6d9bf126fbe84f6342e87d5a277a452df8a20cc744ef3039d6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b7835bbb42a46948e99fe375ed321032427632e9eb5c793435e36ceba9880a45
- MD5 5583bb76d57f2fae625439b5d26fd7ff
- SHA1 b619cd1682b9f1fd48d8431b9077a9fb1a445a41
- SHA512 4ff0b95a7f692eadf31a6cf93fb1ad10aa6239372f2fcd150971a168bfd002689b891e9a197e6c3ae0363ae093f61c2eb0db1dc769af79ede91b4414e7790bc4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 8d7d6603172deca21a1ab4782650364d26fcf6e6c066a753205ed275c026ea08
- MD5 5a47a62470ea51ebf179a0b887078a3e
- SHA1 8d9fa56e4754bca87506f7f38996a841556ec0a9
- SHA512 30d80f04e143ddf49f008b642ebde3405670b4a8f003aa3882fe0bb6ecb681a5f295f1cf2f9e1a249426b6a9e2c079f47460f9b7a573691dee97f59c648797f1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 aeac6ddc73e5babeabbd81cbf7e13e61d2dc6507ed8278dc8a9abd2a164918b5
- MD5 6a1d8d59912b59ead02de9c6f160f0cb
- SHA1 28205d57b3760831603020e7f963842f2b4480fd
- SHA512 a50bfb9d13e8c42fce38f11486406f25cc836b9b29441aa9d4851a2c0d9d13d319bfd81c0df722648271aad948c21c3f1494ee2072be13f9254d36055dff7316
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 35d3ffd346dbc8584ea7cb406c25aa60a974f45e5c87451a6b0669674f216b98
- MD5 5bdbdcbb4a5d5aa6d7a11c90fcddaa26
- SHA1 ee55fe4cf057d012a057f06c18f09964eab43d51
- SHA512 77cc059fc36d76e2af00d96df480dd9d49aa3fac5f73d505344de704d9c1faedf2d3abf84f68d3b01394cb2e3b7a0ae5fe8bf652fad7e1d4a423676b902a3b77
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b477aab4d7926e68f40766aa374765f1d98c80895b697a4d009a9118ddec220c
- MD5 288f9b7b3145f964f26fd154a81eb56a
- SHA1 dbe7bdcd7d42c9c63f2c3ea9bc06cc2d1b957ac3
- SHA512 b9202f95a30b1d9f5aa1b736f0c3feb6f626333ff05d7198fb73f6e53fa47eace39a8563d20a372fa921bfa401ed62c28a234f7362d6e8ee4d3aef8e7454f41a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 aa9b340573b9328218ada11b4c0f0791dbf6e21025927506a7396057641dcfe9
- MD5 58f842c2f0f2683e8309fba939f59eb0
- SHA1 d5cac90f20b1e75374019e77b7179a1354168e7a
- SHA512 053cc7d49b253391a33573214704b65bc106723e0c4bbb3d625d7bf267f4b13f9aa26e41e2f6a9956460a1f19cd14f2b5c8b00794e77a250b69224cd2c196969
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 0ae6bf26f19dced6ca09e7925dc7752e82d71bb4a7fff43b2199fc38e0ab06f4
- MD5 40d683e99dc55c55609f717b760776ca
- SHA1 9e9c331e06215a7083ac1630dd7df085c7459c8c
- SHA512 609ddf5266a926a53f52323a9144db580a98be435196b73987171950b756cf10ff37b0cfb861a2f37515c46634781d39713658f80557f5a549695a20424833e9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 3a15b00afa5cd32ed489017d496c459e8fad6f866193dc782cafe435713ec7de
- MD5 a01b2855e672db2e7499602750e9045d
- SHA1 c2ce4274810ba8519255ac32629510eaa01dc5f5
- SHA512 0b9b0c36b892ffd45a9dcc8150ea3b68d1132c053134a76ba7de355809efcdb6a219c7ceaec808b5e52c2a8dde3ceb28c207142d00e4cf2921f7b0a9ff74b226
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a87167de96636a1bba99025d8688d83ec37fa362cf7f0a356e423a2a11ee5733
- MD5 a5d54836e12fd5f528e980a8b1d0bcea
- SHA1 a9f17686f324bdf0069a1ca2e896d83d9b7935e3
- SHA512 2b25cb82a50c94f500a602c3806abc429aa0207f6e46b98b928d3d5e1493bd43227cccfb3d4a7ae4efbdcb05ba23dc8db11c47d60fd4e28745c2408ed054b8ed
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 5942985b5197b76cb5c6af1a414e27c3dfcf010ee39579d5911f7846c1eedb30
- MD5 d481f56f510da9b1b272b3e966c17055
- SHA1 4dcbe0c84ad5d8be0db744292d3c11b439c621c9
- SHA512 2cc9c0054c47adf661f33cf892da4327804baf51e3f05d9738f0fbf55aa003f0de3388813abac5c5688b0da82669a3ddd7d2d12abeacc838fcfd6933bac42560
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 32d54facdc4ba539dfe3f034e83bb2b5eb41485ab7c6130150dbdbd667d01643
- MD5 9fd7796e3c14d52f3b38a20ac85753dc
- SHA1 8f86437a63a80365439a4febe26dc37acd3d2ae2
- SHA512 27f65a2df510d6e9623cd9438fb75e8d28804539d076eae17d34bbf0971c1d8cbb12eeb79a4b300130b9ebcf23f922ca77d6ff79d027f5c1ee0bd55aeee97006
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b4a04348b85b0bf6239b6dd82587e0017adefd31e41421d08b0d3985e57f28b3
- MD5 7e0d9d5b6d71cfab08705ac72483f4aa
- SHA1 7ebf84cbbfc4ff8632eed732b6e57d00ddf88466
- SHA512 64b36e5ceb09fc9757ce9347c1759e97aaf555bbc85ce276a538b29eaa2d345c070bc154c906b62c6f3c3789f6ad5c52b92d9812d43837a93667589af6489fcf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 efcaaf8e11bc7256ffce17d7e63303f3c65ec4c9beed991c1e066e37d00f3bfe
- MD5 bb0b2b9cebe89d1e51cd66bd4f9f9afc
- SHA1 cd7ad47b89594bf8d5e53f9b34995aa1aa961643
- SHA512 d0d0555c1e625e1a8379040f20604ed18911c5a483b5f8cfd350e4ae719fd75a9f1630ea5fb7ad93cecfcf85a37b5de1109f56e13ad9f57e4e660527b782cc80
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 861859f214317693faef09ee10ca63a0a128ed87b261e2fd9aab58189ec95829
- MD5 d061c2257bf89415a385e3ec300906bc
- SHA1 d8de7d70ebbcdba607ff9129299f79ee3d4aa087
- SHA512 550611beee76677871233917c707ab438d29798e3bb6913e25ffc74c5e6df0ac2c89c0698fc74d9b20a90123677d5a4212ef7ce62f7a33a1c2eb6fc19735289c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f0a618ecd050609d32d8c57121c2fba4bcee869f0b7c8a4149e7f6ed05ce75e8
- MD5 f7a542507e069d28b5332fec3b44bc0b
- SHA1 982120c37be28d4a01f3310b2e9d96179e74d7d1
- SHA512 d07bf83c7e5e2abe8bd44775d8dc7a04a21d117858648a3a362fe2f577d9e2bc2168527a0d08f2816d069b850dc9935e9e3201acf81325e1d132f47af470d5eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 650594376e14828c3bf8934099102625e40ba42b2c90da87fcbd77bfb754c872
- MD5 b0a42d9bf6ec655e462720744c003728
- SHA1 e76b9937f1fe416fd77aaecc2d50d05fca1a2d06
- SHA512 7204e8cc9e4c425542f651871a6e79ad12fc5ff9079de5e5ab3036bef2bf241576ace629ff9c1e1dfd67f2a318a32ded4823d918c8620cd685d3931002a39168
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 fd94c0b40bf2fc0155453238266e542332264c5b8391743ec0d96002563e6f3c
- MD5 50d0f5703ad5b20964b0273a14667a7a
- SHA1 0979e3c7ab429303a2d3ec776d0f3cc765170a34
- SHA512 0c3eb72b89d23c3524e91c2ec4c58fbc987362fbb98426affad4039dc4cd2cc5736092c0c347fc8dc022e8a226c2a1ff97235470ee63e9b1750fc971198e7921
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 5ecf919819abe5b948f27a2df6cc20b8e9bdebd38bb3f92701c77778c8c14d8f
- MD5 258e844bb6f7a54e0be781d9202ce842
- SHA1 59e8af133770811ec401d428f6780f0922a01cc4
- SHA512 b2bd5852409c5c6dcf239cdb48507ca9fc9b9f8b2e412d1c865495e01b6dc174ed6cb7ae96b12377adbe8052172b6875b29646f48a44823818894a1226c63b65
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 9639458d876b68307f3298732f96de5e78c07b3bfb454a82169dbf9a708067f5
- MD5 ed85ed03cceaacb9e0b61974696c4d33
- SHA1 19cae7c5fc5f36a9e4f243e0435c4cf60e98c5b9
- SHA512 04b3e1139fa6064c38f557df4420aaa47ecbc7769200721f322984be5ca280878fe3db4a1de2a8cdf8c4231c5f1574f52c3d13bf0f153cc4f63c76b7b22336d0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 8bf71f756d6987900c29e84e9e35cb0f5ea7ef8d421ed67218b261321fc4429c
- MD5 e76f8fd47159f90962f1bb286b90fafa
- SHA1 bf4b4684d4ebddc1bcb012a7c04bd54420a5a4ff
- SHA512 2e08864603e08edd5179990b012f28d2d5567b1caf7503f353cdaffffdb1368dfc5d0d9c7023a9ff0007ff6b2e3f6e6ddf45ea8bec3a1cf5b205a1255bf67cc2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 3b34fe00840e19c62fb492c2b1237e8c5133a1c9176a234cea6d581dbeb12676
- MD5 1fbeab8cc73c08d314e562ae6cdd8ccf
- SHA1 0e1cc30f3541eb5b8991cfd5e1c19935e4e7698b
- SHA512 49cdc60b4a0aa827b4af5d3c7e17560df9126015539357310b6b4009f266c4b354919992438cc27ccf1cd7a2b154a1c372c26bdb7c1c627a79d1849a109cf084
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
- Size 170B
- SHA256 746f39bc75624c154bba8cd7419eb2e00f9fe5420a04d2eb8b5b2fdee35ad830
- MD5 ba64c8927a3d2f0573b0db6487add89f
- SHA1 646c1faafcb25e01206980f352b3530e189ba9ed
- SHA512 4aab49f54747069d3c2cf9d134f388a559f8b93b4ce1f3d5d860fde94eaf01383f24cf29a547453cbcc51be5183c4f791d7f36f003982d7a6656c1c5e175c194
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26
- Size 470B
- SHA256 3a0fba92ce8dff4b9fca701da6d3ae5bd47249756d5f1bb3c63a2eb8dff3a951
- MD5 f7c322d89b848908953d539db567099f
- SHA1 a08d200d4705c70bb4b05b0d245d0471728bd097
- SHA512 cf194f6be7528f5b5c751e37aec7efd6fcd16ecb187f34d2bcaa89489ea06ecffbc4e2b5698abd6572c9691af342e4a2cc20150927b4769ef4fe0c89cc8bbc59
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_6C4EDE6B4E04AD6FDB8E61232C576EF9
- Size 402B
- SHA256 01ed110e8b0dddc7bd85e3bcfff46e4fc90eaf6977da2f281045befa691d2823
- MD5 bf78158fae379f98f9bdaac5d8ac400f
- SHA1 9ccc1cd62704b62619b3c316de2f83f9cb089782
- SHA512 186cd241f95fa5d99b036c94286ac5e60487fa31433149196d38891a77b592fe7bd8318aa46040e21460c7e38ade68cd137a73600be46ac2abf5d80276eff238
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
- Size 242B
- SHA256 457217b40524e3d387e63cfb37dd7eda17a19b425af8d5d83b3a8f18fdf1766e
- MD5 6ec969909b8621412aa4bd1cfeac7425
- SHA1 4649c4f3206c076966bf0afe9c1a9791f9db766f
- SHA512 e67fd1ef72bc6c2a2bb56311a5d3a8f56f07c85a6caa98b1bb766a411fe8fc6c367764c62c90e6c9c983423d9a692e44e7c76fdb290ce1a3b00819ee1f7df918
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\caf[1].js
- Size 150KB
- SHA256 8d0dd55974c027b602fa403e5372a69dfc99c122fe9e1983f3bb1bb3dc28dac7
- MD5 e69ac32ab1e181b296b5d71cfa1ef63a
- SHA1 ad1d570d7a5fb3ffc42ecefe1cea13a9fac205c4
- SHA512 70a990c4f0e5af5074304b2f625130e2741d8c532a05c603adc853d184da203eb51859e66e998539e57f3cfb4e6fad6ba8196c81ceba03b6c1ae7e85afa1b243
- SSDEEP 1536:G916arcaGxRkkVPyXpKHhiaCnAJy05IjP6P4zeHHWGEfpH00fwBqg+GCSvlPbu15:8x6yhuHHWpfpU0YBWG10s8vJxx8sVj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\tag[1].js
- Size 58KB
- SHA256 cb666c470a82988da4f29bef5b1f8f3e1d4119fafc9e78538cc0e74f17c8c338
- MD5 78cb756aa06b07c207880f7b4fbb721a
- SHA1 6f96c8d80d2281afe016f345bdc448255740622e
- SHA512 a3fa57a8bc184f2561164395b9015305bfc6b4c1eeffae5a630395a21f730bf8a0640b4bc5d948d6f0bc78e3f6c829517ef011f1f78db0578272d8a1bb1aaa21
- SSDEEP 768:bemBuhO6Mw+ZzOPNDA3asXkuUltBzTwNeWTT6pdAjzwWeCcASNnXtBqqJ//gBzQN:zuM2l99ltB4ejBqYgBUsm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHT5LGG0\main.ef90a627[1].css
- Size 3KB
- SHA256 7510035d553a99fbf93eb67737b2df057ce096fa1ed7aad83cfd559e11f2320d
- MD5 3f821ada778691e677aef2cea8c4b4f6
- SHA1 643e7b729b25c2f800469623191dc837798e9d50
- SHA512 8993a8ad28ed4035a022d1b7274c77a97b8235b2ddcd5e6d29f7230d375851539900d4ace652c94c4be8a8284ffd86501df420385a6e680df4222c162deff4d5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\K24RBSJD.htm
- Size 220B
- SHA256 8d9ac95b12968978fb7ae85bb9a6d968cdd3f6a22c5cc772fe7fe129fc31f66a
- MD5 dfeb07871e58cd3537f30da5fad9ca14
- SHA1 fc52042fa6ee618f89631335f61c067893d024aa
- SHA512 6e006480d85d3358a6f7583310b0de2311b174956ae3c8ab3f3af24095b984418b6b9277e746c5c55a14bc9cf7d41f9822d03767d974301a60029f8e6398faf3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\caf[1].js
- Size 150KB
- SHA256 f83c8303e4124769ff07b4340f4e6f9bcdbef4a3d508208a96755ddc5d6f9a90
- MD5 0f190477fe91af746163dd0b1acb0592
- SHA1 5d4e1021bf48afa7ad5b62670bb3a50a0ac7566c
- SHA512 4430a19bfc3d2262de0b1c1de6751e51d37d0f861c1a2d045c0320f909fcd6ca240f4ff8642b6efc52ad27e1598e61bd433bda08da46f3a8268c81a7706c5eac
- SSDEEP 1536:i916arcaGxRkkVPyXpKHhiaCnAJy05IjP6P4zeHHWGEfpH00fwBqg+GCSvlPbu15:gx6yhuHHWpfpU0YBWG10s8vJxx8sVj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\caf[1].js
- Size 150KB
- SHA256 a4307735856c3205a21f0f6d40dda07e57a2d21d495c1d1a386581f7b9f1289b
- MD5 7b5b5acb8585466efe4ee1675d46dcb5
- SHA1 84bff504a1b14404ef4b288465c95d454b9f6b4d
- SHA512 db996d431955302468ebf45fa08be60aadb0934507d5b91743ee2ec9fe40d8b8f3722ba03b233fa6c0738bab3fada3526c980033d704a5926637a039da0ec9dc
- SSDEEP 1536:n916arcaGxRkkVPyXpKHhiaCnAJy05IjP6P4zeHHWGEfpH00fwBqg+GCSvlPbu15:9x6yhuHHWpfpU0YBWG10s8vJxx8sVj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\lander[1].htm
- Size 620B
- SHA256 e3645f226c6d2b938c261bdd3682a245e248f56e8cf7ef6d8ac30011d7ede8a7
- MD5 e15c460ec7ba9ac34c90a95a4d8cf472
- SHA1 7f87fb6d10fa8b1d88972826b2fca27278fbcfa6
- SHA512 5b69a590abe2c9289db9d09886fc74478dab94d029438a1e2bbc2019a27e008f776c838fbdc3a9c40b4dff322c8510cb6d4f34ab51cf76a40cedfac14e97f070
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\main.a345b721[1].js
- Size 674KB
- SHA256 9cde14ce75189208d1475f90c0cd75c31413d95f1c521ed0be883d3a5979647d
- MD5 a45598e4c3ad88168b72ba9e56f9db3e
- SHA1 23ca76f52fafd8bbfee3426cc2202975a43d7450
- SHA512 b719742992b9e1bd9a0f6a7b98eebe32718bdf1d4fc47ba3e1c0d5c2991d0019013cc5a6c1ade7416077e8136b6c24869cca87067b67e9bda6610743f6790241
- SSDEEP 12288:Quj1QYnTxQYnT9DUk4f0WTI4WugqciqXDEKrOCJBFMGJF:Qy1QYnTxQYnTBrOgP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cab650C.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar65BA.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms
- Size 3KB
- SHA256 01ce9959d361a7ea575c73024e7f49de548feeb488273b0645596f9178d1962f
- MD5 fdae27b090d9a0741aed17ab388b0a70
- SHA1 7e56c01e24ef2d2fa8e18ca33c848aeb058a435f
- SHA512 8a90b5acb08a04fd9304e3f0fdbb614767ab4552e3d89ec53ea1c9c5ec14a2f11bb549eec0d2340a9fa6461aea42c43e6883699043bb63f3a8cd9a8802bdae01
- MD5 SHA1 SHA512
- Path \Users\Admin\E696D64614\winlogon.exe
- Size 1.4MB
- SHA256 d38e4a084a04993bf205a802fb04c83ab1436319c95605595bb274231b19c435
- MD5 8126840a68ac0b59131895236692c577
- SHA1 9a610c195b9b153d8f31a0cc786f709372bc81d7
- SHA512 74cacd4ddd9253f960fac294c36c13e9d7d94f10808622db2acb8cdefd5fe65ef6e603313a8996322f11c935bbebb3c5a58253e5dcb879f95a0c674845a2e4c8
- SSDEEP 3072:hxAMvBIEH5OIPPSwSHErh1Rj++Ekibboxd2Kzm:hxAWINKSqh1Rj+TnHqm
- MD5 SHA1 SHA512 SSDEEP