cycbot | 3ca919091b0eabc0e968e60f78c62d30a9f0ba80770f159d247bf833f92ae6e2

Analysis

max time kernel
140s
max time network
117s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
Size

307KB
MD5

bb70a05349e9cc1ed724b25ad2254002
SHA1

bf38250d5393797f86428a68e74082cbb93ce3f4
SHA256

3ca919091b0eabc0e968e60f78c62d30a9f0ba80770f159d247bf833f92ae6e2
SHA512

7f859a6bacf23e729c7b7fd8c79300c036f3c087df1f94b281aafa78379dbe4329cd232b0971a13245829b21c7aaeea0dcf08bbe9e777f5ccf721e3defbe1756
SSDEEP

6144:78AF6g/s2H9nyUvOWy9O8fV14/wLbjCFh2O1DMhBA2AtY5rR/WMzZPw:7v6g/BdyaOWywu14/wLbjCFh2oQAC5rW

Score

10^/10

cycbot pony backdoor credential_access discovery evasion persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 8 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2588-113-0x0000000000400000-0x0000000000479000-memory.dmp	family_cycbot
behavioral1/memory/2588-115-0x0000000000400000-0x0000000000476000-memory.dmp	family_cycbot
behavioral1/memory/1996-116-0x0000000000400000-0x0000000000479000-memory.dmp	family_cycbot
behavioral1/memory/2588-712-0x0000000000400000-0x0000000000479000-memory.dmp	family_cycbot
behavioral1/memory/952-717-0x0000000000400000-0x0000000000479000-memory.dmp	family_cycbot
behavioral1/memory/2588-880-0x0000000000400000-0x0000000000479000-memory.dmp	family_cycbot
behavioral1/memory/2588-896-0x0000000000400000-0x0000000000479000-memory.dmp	family_cycbot
behavioral1/memory/2588-900-0x0000000000400000-0x0000000000479000-memory.dmp	family_cycbot

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3"	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe

Pony family
pony
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
2240	18BE.tmp

Loads dropped DLL 2 IoCs

pid	Process
2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FFA.exe = "C:\\Program Files (x86)\\LP\\AE1B\\FFA.exe"	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2588-2-0x0000000000400000-0x0000000000479000-memory.dmp	upx
behavioral1/memory/2588-113-0x0000000000400000-0x0000000000479000-memory.dmp	upx
behavioral1/memory/2588-115-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral1/memory/1996-118-0x0000000000400000-0x0000000000479000-memory.dmp	upx
behavioral1/memory/1996-116-0x0000000000400000-0x0000000000479000-memory.dmp	upx
behavioral1/memory/2588-712-0x0000000000400000-0x0000000000479000-memory.dmp	upx
behavioral1/memory/952-716-0x0000000000400000-0x0000000000479000-memory.dmp	upx
behavioral1/memory/952-717-0x0000000000400000-0x0000000000479000-memory.dmp	upx
behavioral1/memory/2588-880-0x0000000000400000-0x0000000000479000-memory.dmp	upx
behavioral1/memory/2588-896-0x0000000000400000-0x0000000000479000-memory.dmp	upx
behavioral1/memory/2588-900-0x0000000000400000-0x0000000000479000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LP\AE1B\FFA.exe	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\LP\AE1B\FFA.exe	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\LP\AE1B\18BE.tmp	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18BE.tmp

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\ForegroundLockTimeout = "0"	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\ForegroundLockTimeout = "71496028"	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe

Modifies Internet Explorer Automatic Crash Recovery 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AutoRecover = "2"	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf0000000002000000000010660000000100002000000014c3cf67fdfaa9c633591136c42fe4b5f42797523d089a99b223756056e1d5ac000000000e80000000020000200000007a0e0cf963292d01ae6734f3cc3686496825dfa95c3fb7d70d0ea6d6484cc46490000000799d272b1a020d7abd4ad2cc67229120ec806aacc464eddd0ce03d8a67ab73d26429fbc11a609481afa4ed2b4ccde9dd2e5d710458a25ef9fdf51eca4bd95a08369a136bec52862230d062d050a1372cda3c7f0b229c892d6736aaf0c1f4644ab2ff2c38599821dddacb5d824e3000310c47e565ed8e4a3f3d14728da4810e9a502372dd0f3bc62701907b4b1d49429a400000004610843f157a8650579d28fd11c4daff0b791d14908dac59228cc92214959c56ecf6109ccfa02c15748705220c2c70a9289106968ed730a68c2637e2cf362117	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439357021"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AutoRecover = "2"	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf0000000002000000000010660000000100002000000000e4c1766ef12c1c3bff5372992fb0a2cb1570cf1b21de80b169dec8ca6306d4000000000e800000000200002000000064b909f63fe9235d340d6d869502e9edcc169b8e35afd5d293adffbea44fb184200000000d121ff643859d2aa6662c2f723bf11a484323d4f8f1f725af6ea9bb5f5a733c4000000057d542898b37ba34dabf6570421e832a2171cc07c02bca1000a6ac263e545d0ed20881dfdb2dd2e1d2fa43f74c1aea5ff7418d7f7f2093a1febb69dc4a80fe4a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80ECB171-B123-11EF-A160-DA2FFA21DAE1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0eb504c3045db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "about:blank"	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2604	explorer.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeSecurityPrivilege	2760	msiexec.exe
Token: SeShutdownPrivilege	2604	explorer.exe
Token: SeShutdownPrivilege	2604	explorer.exe
Token: SeShutdownPrivilege	2604	explorer.exe
Token: SeShutdownPrivilege	2604	explorer.exe
Token: SeShutdownPrivilege	2604	explorer.exe
Token: SeShutdownPrivilege	2604	explorer.exe
Token: SeShutdownPrivilege	2604	explorer.exe
Token: SeShutdownPrivilege	2604	explorer.exe
Token: SeShutdownPrivilege	2604	explorer.exe
Token: SeShutdownPrivilege	2604	explorer.exe
Token: SeShutdownPrivilege	2604	explorer.exe
Token: SeShutdownPrivilege	2604	explorer.exe
Token: SeShutdownPrivilege	2604	explorer.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
2144	iexplore.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2144	iexplore.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2144	iexplore.exe
2144	iexplore.exe
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 1996	2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe	31
PID 2588 wrote to memory of 1996	2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe	31
PID 2588 wrote to memory of 1996	2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe	31
PID 2588 wrote to memory of 1996	2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe	31
PID 2144 wrote to memory of 2484	2144	iexplore.exe	34
PID 2144 wrote to memory of 2484	2144	iexplore.exe	34
PID 2144 wrote to memory of 2484	2144	iexplore.exe	34
PID 2144 wrote to memory of 2484	2144	iexplore.exe	34
PID 2588 wrote to memory of 952	2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe	36
PID 2588 wrote to memory of 952	2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe	36
PID 2588 wrote to memory of 952	2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe	36
PID 2588 wrote to memory of 952	2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe	36
PID 2588 wrote to memory of 2240	2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe	39
PID 2588 wrote to memory of 2240	2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe	39
PID 2588 wrote to memory of 2240	2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe	39
PID 2588 wrote to memory of 2240	2588	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe	39

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe"
1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer Automatic Crash Recovery
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2588
- C:\Users\Admin\AppData\Local\Temp\bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\B1113\21DAE.exe%C:\Users\Admin\AppData\Roaming\B1113
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1996
- C:\Users\Admin\AppData\Local\Temp\bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\bb70a05349e9cc1ed724b25ad2254002_JaffaCakes118.exe startC:\Program Files (x86)\13231\lvvm.exe%C:\Program Files (x86)\13231
  2⤵
  - System Location Discovery: System Language Discovery
  PID:952
- C:\Program Files (x86)\LP\AE1B\18BE.tmp
  "C:\Program Files (x86)\LP\AE1B\18BE.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2240

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2144 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2484

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d1228aaffc58f92cdc06a4e76d213623

SHA1
0d6792b61cf6c85d1331943d1de478d12891c4b2

SHA256
620de46b7336204d5ccd1379a58d46babffddf4c868c36a5f6802c88da0ff0ad

SHA512
d7b02db0e3d0097f5907f5b8f203a3e3af4728c53a8ff988041503cdd8243fc6914535e26df944e8278f10ea962514f532853bfe593f1c94d90b0d30230da92a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5c12b36324f4501109059c1e7dccc63

SHA1
c946117a9038d877ee52d598e4ccd2c89f778be6

SHA256
a86e5f6dc8d430574c655999365d06b16b6ec146c09f81635f9338bba7182338

SHA512
0af5d6809dddff5195bd484cca2e96ccf95f684330e682ae71995d04302aaff98a8d263d68d9df44d0430148e14bb8428c3e41150223f34dc8ae3079a6409817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f6be570ee2b71716075a489e87468a4

SHA1
ad20009b53f8d2f48a0be002a92b1cee1c7b898c

SHA256
743a616ca55e8e9c04c5ceb2a77ef28223eeb9404bda88af18b09f7dcdc562e4

SHA512
7c316b17a20c515b8867e3ad927fc385a19727d9830d338af245504dfcec60496792406c0f83ff3647d929b73e9a118fdb8f23fe602461d1eddac515e8afd706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55552994d292d4d4c3620e4b486d7a87

SHA1
c26468b7b38d6fb4daedbd95efbbdb1a018e360b

SHA256
47ed8f586a721b7711e551cca39dd12ba6d7a0b2a2001e5eee3ea83d04f4dfe8

SHA512
76440400991d20effd7755c5a631ef37c13cdf4ecfc2a7323aa441d479c9ed21cf038570cb98d19b209a77f1e95faddb36a6004941104ed8f6c1784365cbac88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0e73a99e3071407418ea1a91d3bafa7

SHA1
be6e2b519d62d54b713478ea282a0a65dc2a02a9

SHA256
6c48743376f8f763c46e7a38f9c4542bf69b3669a844403f2a87792af949abab

SHA512
2c9468946ceef4046355e095d41157e0583b45f2ea1f8c973d65ef11fea23a0f6bb56cbfda1580ba47ba9b2d78c26ef6f49f3d0d671b3970792ec766389603f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cff9536a7549b5378adbbe35bd59f4c

SHA1
35358e0711d4e3f747fd1adfc0f082b2cbc27a0e

SHA256
f750ea6dfb03d1b327dc79d4fe6c8ea61493778100c989fa7615fd85d88c7f47

SHA512
f29f7ae3895853123aba362927b1aa4d36cd60103c55219a0aff46b721e9f5c529d2f7a9c119aea930a20e55a1f7c2a317d5c8976e0d41ab4f0ae483a401d095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a886751a457b352b321297677f498ad1

SHA1
3284ad38813202431eb68856791a2adf2886ab22

SHA256
2372c83fe7bc7de7b39846c7dccb5dd8c57b3ff11fc5bf67292076ccfd75efd9

SHA512
b42339be3a56861c05b8070bec4f92b087588bea2d1a8ded4b699ff0d1cd989bb4c94c763168f2667e29db8b3cf7bdc07efd2e947f1c7480599105aadc001ab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81be827adb08980808bdb08d05ab7941

SHA1
56ca1bfe40fe87f81918c8adb1429789ea3eb853

SHA256
735625c46c7492ef1e95ae9eb1e1d439eb2d29ce889e623dfada517ed1e43ee6

SHA512
28e30b48d490c7d846e25775b9c31cd6c58909f512af83d2241bf178835834a19d19702b87e3f8f1fb52cf593b18ef7ee1e8a301592238ddffc200481fd1afe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94d5309eef40ff75f7bea3bc80cc0ee7

SHA1
ed33995a5e5ffcd54c5a06551288cac8b01fbb36

SHA256
fa2ba2de90fbb7937dba6a5db67cc03c5fdc05db9336390eade6b8e03a15bc60

SHA512
03f7a7cfc0abf10d02af424fff9b8c8ad1b78ca13f6f4a0f9184736ad7bbb97eba758a738af3f21a0574c9bc23a6e7280c578aaebbf17e363ea5fabe3c8c1278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fb211d5e7b3dd5af849b5c9c9a8cd17

SHA1
5fcf0993f394b173c66a91f0ceb25d7a1cf0b45a

SHA256
d87eb08df0a3b27718ef482cbcea6b5fdb2b544b1d6e67ac6037d8a3e1c1e5aa

SHA512
77b55c421818f5fc46ba30f9d88f384a25b827f845850db5992ee81d8fae24fbb720276441d0980cf6e78ee5392c8d01a63895a812e4b55669609399299c3e6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
381e8bca17b94ed682ad6595cf58994e

SHA1
24f8dc65c2c4df64b884c62aa12d068db5db9c8d

SHA256
a040e9f2ccb73ac4b5a9b2bdaeb9508ab335d047750d42c858db44ee8998f265

SHA512
9aeae7b864c5ebe8b15010629aaa6d91d00c7b5a8b4297a20ed5bae476740bb9a663b034c7d801547098c1b9f7224cedaecc21bd24f29c2281c60ead275ef657

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0edc92183cb82579af8d81a0f3d7ba6

SHA1
7af32371eb709307b510ac1eb08bc810cfeb4805

SHA256
e3fa94b81d8b1ed98d721fa66cc1437227ddcff38246ca59045c394d8d26700c

SHA512
5ea32f530c2c2991e676d002d490a4124246782dd8c51375afe5627c6dd87a899911b1557b950bc9a91bf40be533605279df98e98e2360425e2f225e2d73cf04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ad764824fe83e17960dd3a0aa1376da

SHA1
0217521207acdf73afab0142b8f1b50b579453d9

SHA256
ff5adbae102d08d7937bb71893678e60b167fba5da85ea056fa79b6d778839b3

SHA512
6078f142d2e5e41218765658197c245ddeb12baa118a119642e5ce3addffc73c437236032cc6630e882e49f779effa249877de5c3fd5d42c2f653f8aee5f1fc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5728d2345680c6bdce6ae3eb71fb1495

SHA1
87ad7105d0c64bf1130dcb77cb61deb1e7d6484d

SHA256
0903eee38f6f522832dcb6fcfc1421b559c0036d53a1717ca21b2499e1a5783b

SHA512
a11d39bb4a3919f5463e25336ce1308898a212dc8ffe76e6e590b344132745f1eb5117f78f27f77f8e06e25183ee5678b43719dfc5b64db3c423ef2337f87286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b3279e2f04a815e1c6eae766422a26f

SHA1
9524e30f67f1033d70e98ca4ecb809635e4f9d34

SHA256
8544dac4290228d6b7b5080f8873e8023a1ddec7ccb556ba3bee22a308a9b988

SHA512
3184d3033d51f3d413f926cde79ea0f1b1ba5ff402e22d8fe92a63831e24ef46f8056975d6bdece4c5d0a7be44cdc2690d6dba054e0ea6a93c78e025044d95e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69dfd7a8e1d1f9079db0c33049452a34

SHA1
27de068c8d0c0d469cd982c38a909587c6d31d50

SHA256
d0db08d8be935ea97baca603986a69e01136457ab9b56bd8afc362e38d707f8d

SHA512
3029b84f86b9401c1f6281a8e4fb4ec25d89fee23992b22648b957e94845690322790357cc4bc16d176397fabcd49741338470b681c9f499c3f25d3b33a358aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c21a99f5bb82dc0979e72f11be46625

SHA1
221435956b39ed5a22dc485d20b27ede3c07c160

SHA256
c96da0824d9b75d2bfb84a0d6263b00c573b8f905e65eec8b11d78cf79520d54

SHA512
00585fadd4ae980ba66ee5e5385948d60ed751cf3379a81b6c0bb78d450b38d06578a14d1dae41438bf877969e5a4d0d9f77debb6b9b3e5c44fb5e09a6ec61d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49cc7e2c740952654726848bba72b44a

SHA1
5dbe45b3ed3a084e5499ed37d1033eabadc061a1

SHA256
f96762a44f3fcc1dff081ed90f138f78293af7c1e9c94a57859e6ceefffe2181

SHA512
958df772aebdea3152a76775aef26d62af7ca7ecb0534709cd56d11198dc2da9d5a234e07d48f1d73959f95a2496d152d065ba69ed5759c51c930baf633c278f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe7f405f721eb513b6b32b245f89b34c

SHA1
3b2b804a428340f90a48cf9143867e3030ab5028

SHA256
916e2f96d6bf701a5b31de70f1ba187aff4c37ae9227f60fd031c20ef2ffd906

SHA512
c4f1db32abeff3a329de09ac8275450355d44265fcf22052dcebc3d10ca1ebed4416e856303a8eca2af1d25dbb2d6c45080cf460474260b7e5a9dfd5b0e56965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b60ff0cc1d3cda47a580c33ae65f272

SHA1
df7d5c61b421b130c0b62acb6162325c3e00cc82

SHA256
e66de10cddee02a6b091d26876d2e8d998f682326c290c8896a935537f9858ce

SHA512
f488d8782e184aea26bf92ef9a34d526b8ba2b71caa6d68202c2497d766c56250b2c4d6f3e629f0261c57b15c21adad34b1516be2b5bff3a08f984c5b3435e1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b260f17c0af0cf689ad014168a204115

SHA1
42a1e63587e2d7dc06ffbf60e9507b64a7154349

SHA256
3f098b583cb5c8191ec54a78e968e9403d31162805ec0e2902e327ea7e82a6c2

SHA512
7cd1960536d7046e78ef476e1910197b4c632218f8d891210cde19966893431f1e1a5ad7c878acbaee84cec3c6772a4b5afe29ef6165da7956e70e09a3024d81

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC5FE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC680.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\B1113\3231.111

Filesize
600B

MD5
36dafe670c9c01ba84d5a7a232e08349

SHA1
5c99702c8ce77d2a10a4cef5c7fcb3049c076ecc

SHA256
f23386f3ade7c5d531afc4837d0a17de936f41b0b83c0a23e9278cade78c42c6

SHA512
daa67492f63119f686c01f5606819eee38820baad4ae112d64a4fdaa84d8229e5d039c8011c4987e389c26e95e0b3ed38ff1eac9803c0acbfa5b08103f382865

Download Submit
C:\Users\Admin\AppData\Roaming\B1113\3231.111

Filesize
300B

MD5
23f0ddebe08cddd4b1d9ef30d03ffebf

SHA1
362c765b401cd21ce75dab6aa066e0662c910095

SHA256
49245102e34cabf3133b177db0bcfc17c38fb0532f704dcc44a523b0b2ae9cc0

SHA512
0b3d3de1f7c0ded9c29918770972f05b48bb2e33434e38453ce8b3c31282cec370c00d7e85a00af97192f559adfadaaef7c04a70637b89ef4c80c4eab99d6b5a

Download Submit
C:\Users\Admin\AppData\Roaming\B1113\3231.111

Filesize
996B

MD5
b0c092f0b88aecf8dec2704be372c721

SHA1
441ca39b252bcd1d43a6b3922e89c2d62832bede

SHA256
78c624c6ad385697ab2c0a7ef8eb0ea63e50c24d9ecedb0c868c2bff06cf0281

SHA512
32783fe8db3664bd5cc5e31af9ea84a764340c3d64861319970eb164eea9294e5f4aa605d8a5371a055312ffaf9a18ec4f27136f61b8808e9490d1d84cff9c63

Download Submit
C:\Users\Admin\AppData\Roaming\B1113\3231.111

Filesize
1KB

MD5
4b5b45ec0ce6b2365d06eb9c9372b55c

SHA1
d2c785ac28ad653ed1cfc740f0f930e7129f8b4f

SHA256
2d283004d836fc40860571024d5e25ea7c17305dab59c688015c43b7a197b05e

SHA512
cd71c82ce514c74ae9ef2c7a2a4dfe1680c2fb2384b362d6d327f3745d2c694e7fd348de88fe18984c5da37ff7a8774cd0d357d3d0fefee31c9f66b17055b3ad

Download Submit
\Program Files (x86)\LP\AE1B\18BE.tmp

Filesize
101KB

MD5
6e32a83f88c3f7451bbcc0da23219fb5

SHA1
dc462732e400a99b88cb4f9204e7541dd929b00a

SHA256
932318cb8016c148cc6326b76184e1834b5135347b5d54782bad361e4e0950c5

SHA512
e9597f623ea7541a17473cf19f164dec7925347ed04de724e69e766f5b5439e871b915bda953daaf58f7fa14e3c0145bac638a6d4404ffcf2f86a60620771b1e

Download Submit
memory/952-716-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/952-717-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/952-715-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1996-117-0x0000000000480000-0x00000000004D0000-memory.dmp

Filesize
320KB

Download
memory/1996-713-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1996-118-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1996-116-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2240-897-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2588-896-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2588-1-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2588-900-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2588-712-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2588-115-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2588-113-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2588-112-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2588-880-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2588-2-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download