a81585be67a78fc1c9a208de168fafeb95cfe5f33488cb148aeaa5adadb9c68b

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe
Size

950KB
MD5

9ede768a53b4f7e1afb170587e68be2b
SHA1

8ea792b22437b846cc4b770f646d74e6fee0fe0b
SHA256

a81585be67a78fc1c9a208de168fafeb95cfe5f33488cb148aeaa5adadb9c68b
SHA512

321e7737345ef083f24d2e33e688fd5c293214cd3354268a7c23fa71c00cbe8a13797f27a53eb0160ed5b3e4ea0c402779b355b18b9452dbbf2f0867e1210e54
SSDEEP

1536:ylVhXDmoAFAC3uhuZqhspOxx00JJPEwKbpO36gvh0rZwATC068OeDZ0rB:yl7zmooAnuW3JZEvpxgvuZwuHv0rB

Score

10^/10

defense_evasion discovery evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 14 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Drops file in Drivers directory 1 IoCs

Processes:

winlogon.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts winlogon.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portmonitor.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sgssfw32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sh.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vptray.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\borg2.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ndd32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ping.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\undoboot.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wink.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UI0Detect.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkwctl9.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portdetective.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tca.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvapsvc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsisetup.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wfindv32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Filemon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsisetup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntrtscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcip10117_0.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppinupdt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tftpd.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexplorerv1.0.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonealarm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bidef.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dv95_o.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ostronet.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esafe.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\realmon.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldscan.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minilog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vccmserv.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UCCLSID.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atwatch.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfservice.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mwatch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\popscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpcc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rrguard.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Diskmon.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoupdate.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcdsetup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\penis32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscan.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANPST.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mxtask.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwin9x.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HelpPane.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nisserv.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bipcpevalsetup.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\expert.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guarddog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscenu6.02d30.exe	winlogon.exe

Executes dropped EXE 3 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exe

pid process

3044 winlogon.exe
2376 winlogon.exe
1272 winlogon.exe
Loads dropped DLL 3 IoCs

Processes:

9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exewinlogon.exe

pid process

1936 9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe
1936 9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe
3044 winlogon.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
3044	winlogon.exe
2376	winlogon.exe
1272	winlogon.exe

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\241424058425F465 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\241424058425F465 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Indicator Removal: Clear Persistence 1 TTPs 42 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

Processes:

winlogon.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSACCESS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETLANG.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOXMLED.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSPUB.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORDB.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WORDCONV .EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXTEXPORT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSHTA.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DW20.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GRAPH.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOHTMED.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSQRY32.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLVIEW.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONELEV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OUTLOOK.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IELOWUTIL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOSYNC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\INFOPATH.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSFEEDSSYNC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ACCICONS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCELCNV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\POWERPNT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SELFCERT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WXP.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CNFNOT32.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GROOVE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEUNATT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEXPLORE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTEM.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANOST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANPST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DWTRIG20.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GOOGLEUPDATE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OIS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPREVIEW.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINWORD.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCEL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IE4UINIT.EXE	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exewinlogon.exewinlogon.exe

description	pid	process	target process
PID 1076 set thread context of 1936	1076	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe
PID 3044 set thread context of 2376	3044	winlogon.exe	winlogon.exe
PID 2376 set thread context of 1272	2376	winlogon.exe	winlogon.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1936-6-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1936-4-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1936-8-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1936-2-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1936-9-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1936-10-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1936-12-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2376-44-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1936-43-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1272-97-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/1272-105-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/1272-104-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/1272-100-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2376-261-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1272-278-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/1272-815-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/1272-817-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/1272-1283-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/1272-1285-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/1272-1298-0x0000000000400000-0x000000000043E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exewinlogon.exewinlogon.exewinlogon.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Control Panel 2 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 52 IoCs

adware spyware

Modify Registry

T1112

Processes:

winlogon.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://rg678xv1f2j254n.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://7q7h50y9883h049.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://2b5777p808y55yf.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://uu3e44o78fg4m15.directorio-w.com"	winlogon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd30000000002000000000010660000000100002000000097cb2095bcd510313db146021f6932a7b1954cec0ad2fed03b0a321a0144129d000000000e8000000002000020000000a5565ce208dd5ec3cfb694d70126c1e340a296fb91bf94a0678276b92bfe3f6f90000000277ad4c519c8bc60e2f161f6884d464f518d197f93ac3d13e5881931229f65183632a5c76e92f4bb2f729e265e3de9e84c1d3e58933432d3a9dd9f93a408197ac67da2b9fec2ef6af3358487c636f51f3cda25933b1c389aa1e62ccfac3c2df9f8b13b84bb59b4961b1bfe01ba33d1b6dc65dd6fb673115472c260c1a6fddac198bef5a0280df458c773e7d2d2447391400000002d3028f5de2e96d0a61cbf3ff0505ea046bd5781427f07231b77610b948eb4faa4394af08a0a3335d65f53d95ad7a06b669ff8cf3cdf3fd697fc78b94c9e99e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C245FB71-AB8F-11EF-B439-523A95B0E536} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5069ee8a9c3fdb01	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://252e4i9k18it14a.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://41o9e2ipo9m6o01.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438743807"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://9639691n51yhh99.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://81g9s7vu1j1w55z.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000a2730212ed9f78707e2a63046f9aba81968ee01547d4e63d19597eb8702bcb7a000000000e80000000020000200000009c2b68c9d9155af4618c51e6fb7cd2a43d2c3a565d131d7b78e3966972390e9620000000316ecffa4e153e382ace2d72798b38e44a3bb10869538b261a6a8b3abb093bd140000000234b317118b1047cfc47c4470caecc14b4ef2e9935aa191e0c46c66d2dac8d2330f8b37d1af4bfef11301932dd25d31d00b8d8c2043da6c94344a95b0322344b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://8yt2y0i83ea9o2b.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://j97g3z0kfe797i6.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

winlogon.exe

pid	process
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

winlogon.exe

description pid process

Token: SeBackupPrivilege 1272 winlogon.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

iexplore.exe

pid process

1020 iexplore.exe
1020 iexplore.exe
1020 iexplore.exe
1020 iexplore.exe

description	pid	process
Token: SeBackupPrivilege	1272	winlogon.exe

pid	process
1020	iexplore.exe
1020	iexplore.exe
1020	iexplore.exe
1020	iexplore.exe

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exewinlogon.exewinlogon.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
1936	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe
2376	winlogon.exe
1272	winlogon.exe
1020	iexplore.exe
1020	iexplore.exe
1492	IEXPLORE.EXE
1492	IEXPLORE.EXE
1020	iexplore.exe
1020	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
1020	iexplore.exe
1020	iexplore.exe
1492	IEXPLORE.EXE
1492	IEXPLORE.EXE
1020	iexplore.exe
1020	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exewinlogon.exewinlogon.exeiexplore.exe

description	pid	process	target process
PID 1076 wrote to memory of 1936	1076	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe
PID 1076 wrote to memory of 1936	1076	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe
PID 1076 wrote to memory of 1936	1076	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe
PID 1076 wrote to memory of 1936	1076	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe
PID 1076 wrote to memory of 1936	1076	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe
PID 1076 wrote to memory of 1936	1076	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe
PID 1076 wrote to memory of 1936	1076	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe
PID 1936 wrote to memory of 3044	1936	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe	winlogon.exe
PID 1936 wrote to memory of 3044	1936	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe	winlogon.exe
PID 1936 wrote to memory of 3044	1936	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe	winlogon.exe
PID 1936 wrote to memory of 3044	1936	9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe	winlogon.exe
PID 3044 wrote to memory of 2376	3044	winlogon.exe	winlogon.exe
PID 3044 wrote to memory of 2376	3044	winlogon.exe	winlogon.exe
PID 3044 wrote to memory of 2376	3044	winlogon.exe	winlogon.exe
PID 3044 wrote to memory of 2376	3044	winlogon.exe	winlogon.exe
PID 3044 wrote to memory of 2376	3044	winlogon.exe	winlogon.exe
PID 3044 wrote to memory of 2376	3044	winlogon.exe	winlogon.exe
PID 3044 wrote to memory of 2376	3044	winlogon.exe	winlogon.exe
PID 2376 wrote to memory of 1272	2376	winlogon.exe	winlogon.exe
PID 2376 wrote to memory of 1272	2376	winlogon.exe	winlogon.exe
PID 2376 wrote to memory of 1272	2376	winlogon.exe	winlogon.exe
PID 2376 wrote to memory of 1272	2376	winlogon.exe	winlogon.exe
PID 2376 wrote to memory of 1272	2376	winlogon.exe	winlogon.exe
PID 2376 wrote to memory of 1272	2376	winlogon.exe	winlogon.exe
PID 2376 wrote to memory of 1272	2376	winlogon.exe	winlogon.exe
PID 2376 wrote to memory of 1272	2376	winlogon.exe	winlogon.exe
PID 2376 wrote to memory of 1272	2376	winlogon.exe	winlogon.exe
PID 1020 wrote to memory of 1492	1020	iexplore.exe	IEXPLORE.EXE
PID 1020 wrote to memory of 1492	1020	iexplore.exe	IEXPLORE.EXE
PID 1020 wrote to memory of 1492	1020	iexplore.exe	IEXPLORE.EXE
PID 1020 wrote to memory of 1492	1020	iexplore.exe	IEXPLORE.EXE
PID 1020 wrote to memory of 2688	1020	iexplore.exe	IEXPLORE.EXE
PID 1020 wrote to memory of 2688	1020	iexplore.exe	IEXPLORE.EXE
PID 1020 wrote to memory of 2688	1020	iexplore.exe	IEXPLORE.EXE
PID 1020 wrote to memory of 2688	1020	iexplore.exe	IEXPLORE.EXE
PID 1020 wrote to memory of 2152	1020	iexplore.exe	IEXPLORE.EXE
PID 1020 wrote to memory of 2152	1020	iexplore.exe	IEXPLORE.EXE
PID 1020 wrote to memory of 2152	1020	iexplore.exe	IEXPLORE.EXE
PID 1020 wrote to memory of 2152	1020	iexplore.exe	IEXPLORE.EXE

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Users\Admin\AppData\Local\Temp\9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\9ede768a53b4f7e1afb170587e68be2b_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Users\Admin\E696D64614\winlogon.exe
      C:\Users\Admin\E696D64614\winlogon.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2376
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Modifies firewall policy service
        Modifies security service
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Windows security bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Event Triggered Execution: Image File Execution Options Injection
        Executes dropped EXE
        Windows security modification
        Adds Run key to start application
        Checks whether UAC is enabled
        Indicator Removal: Clear Persistence
        System Location Discovery: System Language Discovery
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1272

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1020 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1492
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1020 CREDAT:1061901 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1020 CREDAT:1061917 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
e88f851a1dfdd3f549bb8d0bca0e1235

SHA1
028ec03e59858bfe111c536eb880c1cc676eb6b2

SHA256
069421eec2e0f80ebd113394bd2c5e1a880636ae306edc4023ad549d57725c6c

SHA512
5c3c24ceff430c6064b4e2d3f61a9ed72df49dfc1d73703f625887b6270475b2d033ac654b291a8366f5df5056655a93fc1c08ce359e0ade9bd88da59aedf18a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
5275eac3d304260b1b6595196a6b1c45

SHA1
57e89dd2a3c202148ee134f5436c07b8471d8033

SHA256
1506dfe8a8a023906aba069d34ac77b04b5617622fdff1e5fa05482678cadd01

SHA512
633ef0cc8476f37c1769d2faf7f0f2a60186aa26704d1bbee7b147a49576af70657151609b7ad2984ffee6b0296284b555c52966913b1c63b693eeee6bd3f050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
408B

MD5
47a0a1a551602c653f9b51ed0fa4bb58

SHA1
74381466947580b7691419d356677a54d7333968

SHA256
ab94605bf4188e09860c0e0659214d0ac30c1d135a32c85d774108c5408a67bc

SHA512
f7e9e0fabc1bc0c0fd75b465b2394c98b2af710b29a10fde6c6bf841c8ac18a52d18bf8ffa3b43886a17ec3b67e8fbaf6816789bcf4f429be76c7084564117cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5beb84961302a5dd64066fe4f8abd7d

SHA1
9aeb61fa4fad819bd17cd465ef3a10c49f47c983

SHA256
009c6ac4dba5fc1f33ba3727606dbdb1d873384e5eda6f486791bfdefe6d5aec

SHA512
9298926caae2fb3cafe25422a6806ca178d53eb5f6dd13487205ee44c83554177fb855d18f830ac35fbcc95e8e97bdfce2b6a2794b6de3077f4083cb172f3ac7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3918db0b5431ec71d8a97a764aeb6bd2

SHA1
45d100fb316df91077fbdcafb2c282053ab8f947

SHA256
87523ca11dde5aa3e92c4845e081569a7602504400f485df7b38698d4c9e6d85

SHA512
05392163277aa70bb8d3f655cb2deae6ec8b67d54bb39665eee0fd07d684617dfec16dd30a8b9cd22930d5975c95f4aa375378fa453a51e360434b34ac333cc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5512d7caa9459ddb871a8f9f2ce0bd86

SHA1
023dc40a5589b61831ef14352207a2ff99a4ca1b

SHA256
d6715de132c429dc04a9583f25cf236008f5fc2cea5de77080af3c61d4a50eda

SHA512
a194f47be63cbe4a0044953465ac0c37e2cc55758619fc78a2cc27bfa6853980968cef29f30572ab786630281b9b1cc7e67b6224ef670bb5ead274769a4e8bef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d189d710c6251ee4f943b5740c43c080

SHA1
7b02258147b63c1eae8acdc8ba9a4cb1c9210ecd

SHA256
98b966638d316407a1b5e4a5945ba779fea564da089b544d2aeb9985632bac33

SHA512
4334ea8f1d74ed337d676531a0020f067b845e3c7664ac397e89bea859a23634b47357d5b29457a59599baeba1a6f12225839624e8c47cf190db7acca6c1e0ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e85b53f9364c6cbfb11dc9569d421dca

SHA1
5ca14470fb7524a33d8223f078ee31817cd0ff00

SHA256
8b2c5849f661eee6e2a2e1b607bcb234cd27f752f3e8c20162fb9d29bdb199d9

SHA512
c2a7e122d371914fc7419f4459f0315b077abc03d5303ee73db79619f789eb6b70c224ce27b196f1c6a19a01d47628362de0b15b2c1befefe751999099fde87e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
247bc88be97b0d1fdc9dbd81402c519c

SHA1
1730e776bc5d944afc702422a871ad7636d5af8d

SHA256
5da4ac0001e59ea3be24cf6505c2809ceac085b058557f6f2e94056b037b8f68

SHA512
920d7eb39f08380b405e04a7186c0b9cd5d6966e512ad2e7df00ecc1058a7f2fed8b0ab79eed3d4f1845c31f26dddc2c8310d2ceb4d6a309d1ef1154b536d13d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f962b45adb4dd4048eae9dca30b60745

SHA1
90e39d6a305e8b495addbde0db8677a0dc2ac3b6

SHA256
d63388945396c2db7e2d222910ee9e7ea499a74f408ba2e7ff635ee0bc79e3c5

SHA512
6f94c0db612a07bee29b5250492e03a5f3970d582f33b49e9444f8c6f93be8f6026a0b491bcbd44db2d044aec03acf0de8331340ea6439d089cca96c68e90b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e022b6de296530fccc2f77720ca0e4b9

SHA1
f916532dfc14bcd8e64e429093209159af58ab43

SHA256
9a3f38f53eea70e4381bfc208694c19cd873d3a10620e6293a1f33ec7b92e502

SHA512
4d65f254835feafff10ca4df20ed4778362474ba4074377f4e7e16962ef27ea8dd9d326f718bb24dcc655502d8eaacae0b904cbf43d5e2eaa53d8609ffbe1da7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45ad546820410a0de8fcc6703b9fbfc2

SHA1
dbdb84655d9fb2875d609030a6ad9757145f9ddb

SHA256
adfcb562179751223c00db7731930f5f4a2cfb9d43999c932e9a6b0a9c358309

SHA512
fd20f6f1a79d2c4f2e8c488ab07b6b7465afd6dc723afe75e00a88e9ca469459f4004b5175cf2b892a56fdd7ef91e3a7023fe6fd9261c9a1fa6d3b561a6c559a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
837af614ada456187377dd470aa6afd6

SHA1
e4a6faaeb3f9e782b5f8568cc85745df26511e04

SHA256
8753d10f4fe33627e8f830cd978bda527aa16d3bce6139b478cb1dc914d1f496

SHA512
cad04cf835985ceeeae82f751b3ca1f2aa9c82159bd5361e830ea75112e7d08527ac813cf0aba5cd8631c3d4463be5138a02849375fb35fdf8f335719e3c7637

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c07035895bddf0f82cd7c72b2fef383e

SHA1
569feb4b1a327157c2eb0e6998c147041181c3a2

SHA256
154b0bef57b10b57df7bd044775b9604f8eb121558f34e2b082adc5875ab66e5

SHA512
766997d23d620060ea29838011128db9b8d402353689c2b27feeb74bfa47c4ea2fe542fd3c135432610a0b4342a37b5fc320b69b6ad8bc22e708fc6df03afda4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff0c4b86f4e01cbcf4ba9df387a8d603

SHA1
553014cbe1e7fd6741c1cdfc69da123c8241d082

SHA256
b81d8f97b761f9b218e90f53a57a8aee40abf359d94a6e522161726cd8e33d78

SHA512
03a3827c74a4fabc4131076451816960c8af9633be490a71e405a11a0bb8c66a6bedc3d9980697a7a5592d15b456622ad25ea11f6976f9c23f059747c9b90d86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8a34eb8d2158d30597ae11b0ba94569

SHA1
4fc531a7dc495f23f443518883b35e0c15b9a1d9

SHA256
fbd4dd487e81df63b9e756f755fccce7cabe8deece2774e2c825d3bbd460e9d4

SHA512
7a64f498580162e6c0f3a03fef62d278462fa3070d1beff3f5a19cd0861e1986915590d3b19c0eda620c623a1b53f5cf48b2aa660c7ae4fae1f743253efbd6e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
367cc0aa2cc04f1338b9bbf5048fba51

SHA1
df839a1274f84d5cbd8f4893b3649fccb9c3ae0c

SHA256
3ef93cc2b36dbce5392e62e56b68f58a6e46af1860aa2bd45af4dbf503242b7c

SHA512
57ae82a58cba2d2d67138a12f26062a535b311fb6a362e4c67b1c606cecb6b2470645d0345ff6e260febcdca9060b37f874ab010e5c6521b9e9446e4bce63476

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
396bc0a4b8168cc3672c0c130317ae39

SHA1
8047b2f94356347d805648b21d4392bcdce849da

SHA256
fbcd70b7ca4747b253ba7c38473aed36947eb0665ba81766a04bea07a00341f3

SHA512
3cebe77c193d912e33edf3381ee71e69426d98c0be5f84cd08768fa1ba9800c5ff19efc9e716c2bcc1815533e5cd5a30ba66aa11ef8cc3da4493820c152204e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26dc011d4576a53fe84194a7c67951bc

SHA1
098339e455857847c4718fb706e7fd14c1f9fa9b

SHA256
20cedd7ea27607c26263e51160c67076312d421c438f3ad162a635ba3b7f9b8f

SHA512
d5a288901181077d76e1b98d0ebbbf56444595f5153fc3d932ab06c2b3fe0c8a3f0da9a6656bb4d5e0b82fe264487508f799351b597293c67dd74dbe1c058455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dc4b4f77ee2ec959a46e5b0732bad3b

SHA1
4430dcda9529d4b328d6e7b73a3b01adf501faf3

SHA256
11805e91cb1bc1cd6830cb1571e95af26fec6fd89443955df979de546e9721e7

SHA512
632de226803c4da0883dcf4e3886c8ab4ddc2a5f858206e8f10ad48c3847bac18828f5bad6b39fb28ac0ced9f801997570096a5239838bd5bc4f06fa4037574c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04eb1a453d90a9361a7f8e1af2e1aa1d

SHA1
dc07d272fb733aab422e67ac2a7c651b0dc4e083

SHA256
2817aef0da6f6a6c8c61838c85a84b727c0728b8a0569b5abf6f9f049b0e1463

SHA512
426e333fa73e4c5de59f8922eda25b18609f42da6e34d10703eb3d71839504cc14dfc0cf8e0a18bcd0bc798967ccaf63513aaf4edb07783d925ba2d99f56a3ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efac8a0731f521ad209f120f29377d4e

SHA1
5857288b7ac2412d56d8733a9bd8fb3b6ef19f6c

SHA256
76f329176070909bcc5335f3db9ca6fda98813aa255f71d518cc5e82519bdbae

SHA512
cd848c0307d696fa7e32098fa192cd8d127714c613496d80168db29f5f6985bdf33b1f2ee2ff120d329f21b3b0d079c42bd6069f42a0afa42a440d4770bac06b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb07c3c9461e72fa84a942dfe91c0a82

SHA1
2991e3c14de1d91f399722ffe84f0bd152d8cc09

SHA256
683da9787c69e87c76b51979ed174c8e5c55d9029167e884353d9b2e4a01104e

SHA512
eb055e1058446a152fdad33da98d59291884c2b99762ecf294132ec7a01a7b538fee5fa7780699d2e49ab3a2e4a55d8c2680991ec8830d18634b5aa67a59bd6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0074e13293f9fd9975ef93b278a4238

SHA1
adfd74e98e7ae64ad8d54628829b2a639de1e353

SHA256
c5e5ebec59caa5339ea577e2a45ed8ba1a14a9594ec63cd27b588f4cff34d85e

SHA512
8138ed7ebc131b46f2616924f49a9120a6195fcda11b06e4dbb41a406ec57ba0cd85a5195efd8b3834d4b065e693784ebdbe93e4f0c2f91fb67d8038e069934c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c368fefe776fc317020887a7c62499fd

SHA1
6b291da2036da44d383649cc02283d8fd3a2372b

SHA256
02ed6e1794a5a8bd4aad4bcc4ba4c01a591425d5be96c91ce1403effc5bf5b89

SHA512
f2a1e707d8d77abd23d9fb7535a63212e32594ef273b1e23645a03b259718b91928863671c8cc7fce355a72f85ae9d15bd6d1ce7e278b2107c5f4711af277270

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aafd0e1dfadc5c28fd64849496a607f9

SHA1
f86459ce71844908adc9e9cc3f8a08139512812b

SHA256
60bac7c8c61e2a97755ad55e1e00c9a965ec14211de32b9109e29ff0b3eb67c9

SHA512
eea25afa6168fa9ebdaa6d761142779ad763b73ad86bd70d4c391ffe6f92f22243c3532f3feb9c88e7d9ea7f65fcb416f40dbc1c396ef2a8ef57c6e365ef81f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89a7418e6d432363a3d2dcccd041e1ec

SHA1
254b1153f70889b2d02102c5297866183092a57e

SHA256
693079c457f9b7bc891a65efa9292fffca21774d8929f91338998ff996e3dc50

SHA512
9c97bac71fddea9b0b24c769a3bcbc78436bf34c5e75523333758e2d713b5aced91d153baf1c2b012b929aa6a407f93d7fb7ecb53d541ef8b734d5512ae01e09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22c4ef9b5b76eacf5a98e9611030d329

SHA1
7572d7d7aa4183c76f7d85afc4494be87ce94304

SHA256
d624e0b0abd6506b70b04899888fca32ea55e0bb5d4ce253aefb7dfa9e961c62

SHA512
1fa989d0f12c97e029578c002e19b49facb4b85dc5205a3201f3b254a7bd035426f0c92021d3eb038dcc9319608c6aa3f450156998ac5c9dca6c46040a8a5aa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97c2317796218744de8f627947876ec2

SHA1
0d3c2d1001367d9fa5ef326ad77bf8da96a50a3d

SHA256
fc31d8cb39ee9126f069672556de441b0667cf79decae00bb27c935cc957698b

SHA512
d6cbc7ada57d8772a7123e8dde6148463e3d6f5d864a3744475d65df43e23204b3fb0e644e5e463123cad4e4702868ce53a8aba33e415a95224504507bfda8cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4c9ede34d6b78177af7e627b16044f2

SHA1
6fcc78e204b0e453edffe1850909c86e77009f87

SHA256
20e2857271d3989d20c3e7550e37240b5f4714d79e4eb7891a4781fd4edf5159

SHA512
5469409d62463a077039a63f528cc2a948166d6e7a5c46e2f055861ab5f4330da4e0ab7bd043447d029e2210f9c516ec787732d121adcb8db1528e8f3db30379

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e204206271f22b42a96b1f9ab0e1c0e1

SHA1
b30b52a5aeb414cc26d761dc51fed5d99d37c6b1

SHA256
dffae60e5b3d0ae5c4aa9d1ac4f11259c292f8249fc9830825f4e0a7c225b3ca

SHA512
f0cb1e2eb05fcaa3a175097fe392bd1bacba86bea1566fad5f0ebc430b5f2654f2d551503222922f2fc644de77d9e92158f8edf6726bc7e85feacb9f053e9161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
21308a9405d220ed498d3c3379bd962a

SHA1
c94605368af169afa499dae3ade49d665b9c101d

SHA256
576ea16b067e1e3c57f383a1ab309d90b301fd9e83225f51c7b6f99f1d9cdb03

SHA512
3e673a07bbe3c053ea52b985695c64b98628378ced2231009a55a087e9e6c3e73dbd6489134dc43c7254eb6eeb02c65bcaf2e4b7a6a5f412f8a4028c9e3510df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9F2E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9F60.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms

Filesize
3KB

MD5
b9c00b0c26206f21896458d0d8e088f6

SHA1
84ce58fa334a7096a42e76fd90ad0ca4ff599e16

SHA256
3e3edf58557a604af2ae630395424f1aed0fe068666e692d4973fc9441619dae

SHA512
d44637f064205e9b0fb793ed507ddd6732f41d357cfca54dc147e3cd4db5e68fce02e67bdbec6d8a54d6be8b9ab3c621e96629e04255accd84601bd64d821fcc

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
950KB

MD5
9ede768a53b4f7e1afb170587e68be2b

SHA1
8ea792b22437b846cc4b770f646d74e6fee0fe0b

SHA256
a81585be67a78fc1c9a208de168fafeb95cfe5f33488cb148aeaa5adadb9c68b

SHA512
321e7737345ef083f24d2e33e688fd5c293214cd3354268a7c23fa71c00cbe8a13797f27a53eb0160ed5b3e4ea0c402779b355b18b9452dbbf2f0867e1210e54

Download Submit
memory/1272-815-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1272-817-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1272-1298-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1272-97-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1272-105-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1272-1285-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1272-104-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1272-100-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1272-1283-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1272-278-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1936-4-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1936-10-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1936-9-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1936-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1936-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1936-12-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1936-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1936-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1936-43-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2376-261-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2376-44-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download