95c4037d17ce1b7b134ed8e97cc39c9d263ac866bec9ff7fdfcf36e49704ee37

Analysis

max time kernel
148s
max time network
156s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

95c4037d17ce1b7b134ed8e97cc39c9d263ac866bec9ff7fdfcf36e49704ee37.exe
Size

229KB
MD5

6c7954215645d6137b9f94f26db92673
SHA1

3cfa469d13fa84d97e617bb39683f4257ee6add2
SHA256

95c4037d17ce1b7b134ed8e97cc39c9d263ac866bec9ff7fdfcf36e49704ee37
SHA512

1d514bfce6cc2f43e842204e9b584d2353e77ea655cbde4e1b1a37508bf1188671e9723d015a7961159e53e831ac82c04b4c10f9ca63318ba1a22e78b2e4aec9
SSDEEP

3072:XglLKFmWP9Uwim7ZnnFs8z5Qnbk11E9f3V9tout:UoS

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-56358503"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-39340561"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-29748642"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-30442124"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Executes dropped EXE 2 IoCs

pid	Process
1132	winlogon.exe
552	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINWORD.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv9.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwin95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsupp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcc2002s902.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmgm32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bisp.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanhnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lockdown2000.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navstub.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcfwallicon.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-nt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wfindv32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Process.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumphive.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwebloader.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panixk.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pop3trap.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scrscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjsetup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsgk32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\supporter5.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wimmun32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winsfcm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HiJackThis.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpnt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanv95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnotify.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashWebSv.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuard.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\anti-trojan.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwinst4.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\purge.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjscan.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpfw30s.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctrl.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsupp95.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\route.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlh.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SandboxieCrypto.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navengnavex15.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapro.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkserv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avrescue.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\claw95ct.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonalarm.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regmon.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanh95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fnrb32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netstat.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwsc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clamauto.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfind.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luau.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/552-67-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/552-71-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/552-72-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/552-76-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/552-89-0x0000000000400000-0x0000000000430000-memory.dmp	upx

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
1112	95c4037d17ce1b7b134ed8e97cc39c9d263ac866bec9ff7fdfcf36e49704ee37.exe
1112	95c4037d17ce1b7b134ed8e97cc39c9d263ac866bec9ff7fdfcf36e49704ee37.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\34A5B4B4748525F4 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\34A5B4B4748525F4 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1132 set thread context of 552	1132	winlogon.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2048"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "5539"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9032"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "10775"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "3845"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "9032"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2755"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "5467"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3971"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "3928"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "11869"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "11869"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "8252"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8252"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "3786"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "13480"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1951"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2835"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "10775"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02c922921d6d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "11023"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "4589"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "2988"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "3781"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2755"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "3792"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3829"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "3786"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "5456"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "3787"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2878"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "2054"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "2835"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1090"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1090"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2048"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "2722"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com\Total = "18"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2988"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2899"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "197"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3824"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "5499"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "198"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "10921"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3856"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1951"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1096"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c000000000200000000001066000000010000200000007cba3175e8acf393edd8a5f40f42704ade5189bd068c09dea27e791c6667d213000000000e800000000200002000000055370a7e4604750dc7f55ccae16d41c53598d580a252f5f1b90d98625f44cb0a20000000f6fecfd6cfd89a3c06460951bde4bc408439dd600482087c13135941a22e2efd40000000cfea214289855a196aa889b02aeecca0b56b051500f4073e972637c5d7e71abf7ab336885d6f691df4853f3d243ddb9cbbaf54a47bb8f6207330bf503137b019	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3835"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "3934"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://bz327874z1f0f0t.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://5y3h2yb9ed40cye.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe
552	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	552	winlogon.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
960	iexplore.exe
960	iexplore.exe
960	iexplore.exe
960	iexplore.exe
960	iexplore.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
1112	95c4037d17ce1b7b134ed8e97cc39c9d263ac866bec9ff7fdfcf36e49704ee37.exe
1132	winlogon.exe
552	winlogon.exe
960	iexplore.exe
960	iexplore.exe
1008	IEXPLORE.EXE
1008	IEXPLORE.EXE
960	iexplore.exe
960	iexplore.exe
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
960	iexplore.exe
960	iexplore.exe
1008	IEXPLORE.EXE
1008	IEXPLORE.EXE
960	iexplore.exe
960	iexplore.exe
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
960	iexplore.exe
960	iexplore.exe
1008	IEXPLORE.EXE
1008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1132	1112	95c4037d17ce1b7b134ed8e97cc39c9d263ac866bec9ff7fdfcf36e49704ee37.exe	26
PID 1112 wrote to memory of 1132	1112	95c4037d17ce1b7b134ed8e97cc39c9d263ac866bec9ff7fdfcf36e49704ee37.exe	26
PID 1112 wrote to memory of 1132	1112	95c4037d17ce1b7b134ed8e97cc39c9d263ac866bec9ff7fdfcf36e49704ee37.exe	26
PID 1112 wrote to memory of 1132	1112	95c4037d17ce1b7b134ed8e97cc39c9d263ac866bec9ff7fdfcf36e49704ee37.exe	26
PID 1132 wrote to memory of 552	1132	winlogon.exe	29
PID 1132 wrote to memory of 552	1132	winlogon.exe	29
PID 1132 wrote to memory of 552	1132	winlogon.exe	29
PID 1132 wrote to memory of 552	1132	winlogon.exe	29
PID 1132 wrote to memory of 552	1132	winlogon.exe	29
PID 1132 wrote to memory of 552	1132	winlogon.exe	29
PID 1132 wrote to memory of 552	1132	winlogon.exe	29
PID 1132 wrote to memory of 552	1132	winlogon.exe	29
PID 1132 wrote to memory of 552	1132	winlogon.exe	29
PID 960 wrote to memory of 1008	960	iexplore.exe	31
PID 960 wrote to memory of 1008	960	iexplore.exe	31
PID 960 wrote to memory of 1008	960	iexplore.exe	31
PID 960 wrote to memory of 1008	960	iexplore.exe	31
PID 960 wrote to memory of 1724	960	iexplore.exe	34
PID 960 wrote to memory of 1724	960	iexplore.exe	34
PID 960 wrote to memory of 1724	960	iexplore.exe	34
PID 960 wrote to memory of 1724	960	iexplore.exe	34

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\95c4037d17ce1b7b134ed8e97cc39c9d263ac866bec9ff7fdfcf36e49704ee37.exe
"C:\Users\Admin\AppData\Local\Temp\95c4037d17ce1b7b134ed8e97cc39c9d263ac866bec9ff7fdfcf36e49704ee37.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Users\Admin\E696D64614\winlogon.exe
  "C:\Users\Admin\E696D64614\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Modifies firewall policy service
    - Modifies security service
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Sets file execution options in registry
    - Drops startup file
    - Windows security modification
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:552

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:960 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:960 CREDAT:472083 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
da04e7f3a2abffae30c2249110138683

SHA1
8d7f0f120f3d5f117d3e750918e65e259bc3eab5

SHA256
82ecd308ad6605a9cc6b3873651f3a73feb6c89e32f5311131f813e4f432c360

SHA512
d22e2b065f3a103982d8bac62dde5e6ea03bd571ff2c2f32185eee0944d2b5e34ef56b57ffd86959c330b4714261119f4a0b65cb7e1ca61e1b25b7ede22335c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_14F2E352CCFE495001982FFDAAC3BE84

Filesize
471B

MD5
eb2de1a6c4c76b62bd9b5844ac8f0711

SHA1
205f8666f86cf5f699ed5c8252c46004492fa88e

SHA256
d0f5a54640474e3d0383d5302a9899e8060456287379906d2359925c6d36c46b

SHA512
73ee31557c3aeb79493ba51cba02823bbd9fa518c0e676c5b22398cd78149b9fb8c067069ce69d7738e63ee1792becff084bc759319e45404586b2a3100e7ff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_1ACD2B4A039DF3260017F7BF28EE7323

Filesize
471B

MD5
ab779588f01243aca896d41395f8bd90

SHA1
b8ef2d7cdc6366c283db0d608766a126dce37164

SHA256
5531deca73d8380883740395d82457f4d39761134404876881242e2135b1546a

SHA512
07491f64438cb412b98fc2255ff7f25de4ee4ba730d45116f9d136e4733ee48cb9e296758d4fd0aec71b8c5200fff3e5e493f79eeb76760b7688d5cb109e2397

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
6699b92648930b72d3334324c6fdaab3

SHA1
8735957aba2a618fb73ed101e976f6e0e437563c

SHA256
497220fa0f2e9b5cb01c76e3fa2df51e73aa5a79ccc22d4ba82bbbc4ac301764

SHA512
c4fab20442a6c4f0b88150232342b1ca568d942198a158d91e33d1fa3325141e922f8ee01c68b1278378d0ced751bb6ebe1c193deef75830489ccc58bd84e2e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
60KB

MD5
d15aaa7c9be910a9898260767e2490e1

SHA1
2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

SHA256
f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

SHA512
7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_6C3CF1E05107F711011D20B3C3CC240B

Filesize
471B

MD5
acc6d30b2a700501317a6f710448c9c7

SHA1
36ed01969a43314f517bc70578bf626bb4ee690c

SHA256
e6152d8d9bb2fd4c72cf23f38d9f7fb2f471f14a475ac459e84d49fc970f8353

SHA512
0ab171c03327c943e68950cb3a86a0cb7276da28662103c47e91ad99d1c7d9aa64272c442e8ebf0860e027f8efbaeb75c2f44aa205fad540c6b8faf6065d3885

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_F9FD6C5DCD91B9F3B4E38CA6D81CA790

Filesize
472B

MD5
965a43dfae645e95ef92ec6fa232661e

SHA1
f4032a0c7ab75037730d8b8865e50788f353e971

SHA256
8b456c52e93958769d377cc84748653ecc99726d5a9a5cf282c02133384f28bb

SHA512
e5f6bbe5a998dd62a2e615b0ca6ec4d32dcde5b2010f6b4222d4020a1b6bfa6fe05f25b52c4c39f5d27b53c27d562c67c2527b56fa90d88b47685415ee46f0c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
471B

MD5
d8011049eb378c35d9b281b7c7dddd99

SHA1
d82d8d9b06f9972e3690ef6f02c8ba7eb8094dd0

SHA256
54a7c32f637fc225492bf9476094cf588b33215e349a1f983a6c90c4890e26ac

SHA512
4f11e36f49bf0702c640cddc1988ad794136d50576d5099338ba47444ce9751ca76e7791fa762744d0248170fb47a6dc14a55c068a7e54e23f1e81f324956e83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
5a11c6099b9e5808dfb08c5c9570c92f

SHA1
e5dc219641146d1839557973f348037fa589fd18

SHA256
91291a5edc4e10a225d3c23265d236ecc74473d9893be5bd07e202d95b3fb172

SHA512
c2435b6619464a14c65ab116ab83a6e0568bdf7abc5e5a5e19f3deaf56c70a46360965da8b60e1256e9c8656aef9751adb9e762731bb8dbab145f1c8224ac8f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_871E11B76822F93FE2DBF907A5A1D9A8

Filesize
472B

MD5
ceb7f2392dd816131e0001a76cb54e19

SHA1
6416c2a788f016ff94f0a10616e443e47890e97f

SHA256
517337577ada3f7f9e3da9c42ce722b5a760721d59a0404afdb2810fe252245e

SHA512
765bd7e6da177e78016d7788231ba4d19f1fed3b7e86e6964abd3ed3358ba5ecd413a442043eee753a800c9784971186a5d2c707a71691b2d793c1640b8534c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_CD6513E45B8AAEA8DF3E8B0C926693B8

Filesize
472B

MD5
c57a62fb230234e53b81a5603d3dce29

SHA1
b6646ed0fd7416598a3b4137a17af8380428d277

SHA256
e411e0959fc27b02f074b3bd685a9cb507dceb7295258b05577f481b03d3d36c

SHA512
9c38be22f859a63910bf01b0a8a7e862e16164979aef80e4b313b45ebc8ccf7d56999a7041ebfee7d11c29d2f97aeaf49b3a7c1849cd1372dfdc40f952f83dde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_3FAEF9C2ED8948153EF5C4A9CFFD2F19

Filesize
471B

MD5
8dada68884138da54b838679e1559b90

SHA1
b4c37df199a034046baea490613619805ebcdcfb

SHA256
3afb9e1ef48ee709b19957dcb06c854a7161c82dd5f7331874f6ca38ad68f261

SHA512
a775dc81319145156862620dfa519bdcab6b0be5bc5efcce0a19774fd204722b4d23b87d668ebffe174a2b81c177022be243e8bbf60e418aa407a31cacaa429b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_7F226C0974B745C5C054D4151A363D5C

Filesize
472B

MD5
c120ef4802f4eb64e93225496ba6944a

SHA1
cdebb30349fa79f7ddb7d13aac47735565ac0ba2

SHA256
1bcd7dc722018962f16783f0f888742a7926c0a7e466deef174f0f4fc5eb4a4e

SHA512
5b8e0794569e0160999b6e846511288ffb5ae881d843e965ba84969fbff47dbde6e3adcbd42226a28efbfa16b62099c645898910c3078c1bdf514887015c6bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_D4DDF242A8972F898C0FE0D6EA6919E3

Filesize
471B

MD5
83f9407574c75ca600c57af0637cb200

SHA1
4ebabbc1900b8f575e90186e2024e48097b0c8d2

SHA256
1e166ac737e5c3c015e0dc0c68115ebc5eeb53958682a9b77928ddb647137ac1

SHA512
20cb6c089707e4f96180da9372bc45a3f56928f46cc5c36df723e3b42c4cd6e0063bde7ff337f79f5d39d6ca0b109f77d58ac6910f61a44f37aaebcba074228f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_C89A7CE86B947A5BDDEC66331470004A

Filesize
471B

MD5
a2d3925dad8ae1248c7b5d96220bd00a

SHA1
8b6326da45860d5f480504e23864de0c28523b61

SHA256
421d30a538dc347afc7fc8eee0fa6502aa65d789eb2353eb9c9f8bd0c5f3b3d5

SHA512
18785c6472c386415fe73c6ff975797e0a0c652a7e46a899f1b3d06743d5239d74cfd7393d94f49ddf9782e11807de7523292cd02d7f957ba7cc94c1a30d6565

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
65ea3710575c057ceeb637b099c22661

SHA1
0b4837cc1fc3f4eaef93a5b21d97b82112e57266

SHA256
80d4767dbf0d151182a17a6fdeabf9dc62aae1ab9558cd7717f5dd3c9631ee94

SHA512
8478b1e5b04225c174b0def1ded79709ff22832c6e03fc417e342b80641a870fa194c5b03e85e021460b280e705183fc26b0107237f6bb93ac3752f576421bcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_14F2E352CCFE495001982FFDAAC3BE84

Filesize
406B

MD5
fb9aa1bf3182ffca42d5ff4d8b82e8cb

SHA1
0f54398e5e57b7287717b5cf408c8f1ceb905e92

SHA256
7a394917386fa3a0dd4d4e92f9811fbd95917b8110267fe1d60025e7a8930e71

SHA512
abffd9cbe4bf1628f7ba9a4ea726700d0cff04b4d2db6c0ad0b2f79e7fe4c80f3467968a7c1d5115c346328ec37e422ec6b37bdd0ef0d18179c576ff8b7750c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_1ACD2B4A039DF3260017F7BF28EE7323

Filesize
414B

MD5
b23d35e09e3ec92d4e89aa0fa79c033e

SHA1
798fcfa1d820f63532b8c7d4cc9b25c0e5aa12b0

SHA256
3d5126dd6b3290fbc48597f90b6c9b57070cd2c5af0a9c240cefcb0203a6a065

SHA512
7698ea36dd2d3e458cf1453895f4229ec95d655312abfa0979ce033dd45c88dd981d7476da9451016c356248dc6a3fb05ffca448f7017525c1a585ba740c9c9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
408B

MD5
4f893042047849e6aeaf12b82b84b3e3

SHA1
f3a6bdd901ec924aed9c5c100717120d642ea8d4

SHA256
b2efa5ea30bf0f5c5b730f06a203f8d4272366085ec26edd0c832dac0036329d

SHA512
8475375e0763a0965fe0a1d4eeac634c859418dcfff21e7006a09f1e6453738e4e8dfe8f3c367a5d753d157707a567dc0c07eb083b04820633b03c1f701bf562

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
517f2e37679801346dab84de81efad1f

SHA1
907c05ed9b5b4897007a2d7e35f949dd07540878

SHA256
afaec1cf97f1c4fdfb01de9b6d741c56f65e73ee1051cad14ee912aba9f13ff1

SHA512
cd17fbea75c3d488bb79f11796224838db6f2b1e0b42e52c9c1da9d9b8fd4349c8329ea2aa52981f2f5418f318e31523a23d57758ebb8d86b3c960259d1793e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
340B

MD5
984e0186824021eb813ecd17f794ac73

SHA1
cbb8f2f43d4a21623ca826257c09736dc5f02b0a

SHA256
bf585764e845bda04a997c4993c2c6baf3f8eb76f95e1af3a1d309bcc1ce9e01

SHA512
a23143bdc6d7b17226d508c3e914845203264b583fec0f38a695037a200624d63c7fe9e8792b1ebc0ceaf70c1563118b4bb7097439e1551f5998e18973013c59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_6C3CF1E05107F711011D20B3C3CC240B

Filesize
410B

MD5
bf6503bb868dfc4877d9a0cbd582de3f

SHA1
462333ad01c9f6631ba7da26467e862bc7a2fe7e

SHA256
4f0db4850e37ceaf4adf806e421c3d05e00965cf4f1a9c0e089a622703679024

SHA512
3674b58943b2d06ea5775042e0c2a9a98d89acb42d482e0983e0950fb0634f3f3fed1c691160f38605f6758f9c5b340584fb76d38cfa334c4664cfc80e627496

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_F9FD6C5DCD91B9F3B4E38CA6D81CA790

Filesize
402B

MD5
991a34017822acbe1e6ec800c5d75f7a

SHA1
8299ee310bba480ff5327445ca27afa859e5cda1

SHA256
d728421bac6f3d062cf2f55cb34f76cea05912a37035ef2e8d29549238909308

SHA512
1f1582dac0f808cdb1b90d2cea22e02780e1166b9baacda918c153a441789f3b8522ae6745bd5fba44718598c956d17c4b3ab7a124727cf689f7d3ba6a807d7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
404B

MD5
a34d7a4c588da188ce6c8351ad051607

SHA1
86108c6623fb00f17f14528b20ab0c486e833bb1

SHA256
ee9aed76aa4cf8a449045f743771efb8a62b96b8f9aeb82b9448727dd2d02809

SHA512
310a4fbd65bb71c832d832fce9ba863d67b0915b5b644413b3082ff2effa750fab5908cdf1c6df830503ac48206b6c7fd07c8a505ea33773ff48d37d60be5832

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
2e31df9ca210268301903462ab6576d0

SHA1
22278a798140dc9eb698f50b52ee63bb168958d0

SHA256
e34b962a400acdb258548cf5411b05c6700cddde3460955604b6c8d41803a213

SHA512
af39399bcfa6f7bb1695511e89393974311f92f29bd27acc5d4c871098a26108f9478b7373b7de42a291936185b5f257a2eb34e6ff9326d0c2adcfbf581fff82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_871E11B76822F93FE2DBF907A5A1D9A8

Filesize
402B

MD5
88725dd05ec4654eb1e35c680be17413

SHA1
61bdc9380a47931911a36fe477e416d3a2509e60

SHA256
053a2d62b61339b0dbfb098014b09dd03394053845fdcc48065a19960c3f980c

SHA512
68947fd454d36bcc694423416eb1750f4c3a5b0f9e70729b504e76fdc3153014a508412dd5c09b943b599ec0eadea3e1db2cf81c0a46095d3c2b353b3ad9be09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_CD6513E45B8AAEA8DF3E8B0C926693B8

Filesize
402B

MD5
4ec6214a1a5eef638e284941cdf21464

SHA1
9595b2ca64b84459f3609737042614990fdbd83b

SHA256
2765f647b3828bd428bc2a12cfba81e291c7c41314a28769121cf05913260079

SHA512
b9242a23c205e6ae2e215c9078b614201eba256fe702f85cd412d03f074359bfe95bcd90d4335e1b3264fa8b1356e334861b25672671d020ee65c707b9db3cdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_3FAEF9C2ED8948153EF5C4A9CFFD2F19

Filesize
410B

MD5
aad9b59d22c1db9a7e5c9ea95a0e088c

SHA1
d41f9f83c739587b8ff4f1bf87f8fdf1a1a9bb6e

SHA256
ab69be610fd9773cacf5b2013aa1cd29560ecb15969f5e7d1129fb9c6bcdb9ab

SHA512
637909330213748eea69b6cfced23b414835c452332e001d1a3cf63f2883b80f371e512efbcd7c8595c9f6dbdfcf9d09d1301904b62f201e239166634bfb2988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_7F226C0974B745C5C054D4151A363D5C

Filesize
406B

MD5
3c8792bb01d1110617f68c84f6946adb

SHA1
229024fa6fa1546b7ee59e95fd93e2d79eb61e81

SHA256
eba896ebb1a378e16c6992d33e02c208f931cc0ce70890bb456e6a7d437aafaa

SHA512
181b7e02eeb9cd512c231ecbcf5a18c8a448bd06cc1917f71c69da9dded973aa056cbec3bb1127f1c7fd9cc6a48041b9a826873cd879cb061b20e2455bfdfae6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_D4DDF242A8972F898C0FE0D6EA6919E3

Filesize
414B

MD5
a3196b93dc1f01195ef3a4ed0e34d46b

SHA1
df396df3810c32f4f63d1af218d7fa67d55ac82d

SHA256
9193cd77d5d3357ebc11c9aa936e4f4cfa935f754006790a1c99b9a41f85ff81

SHA512
f8047825f76c5ab004533768fd01bb1a253637226660b8732134ff414a608223dd692484dc1c4f926947028804cac3a5563b41d303fff4872a0737f4e41afc0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ed8f8379bf4f850d5f52e16096fa9568

SHA1
a99e866d53016c2f1096c62f3bac589f8293c4ee

SHA256
765bd926f9ede11ab37abb0a6954369e5a7d1a2b58c0fe734ef8cbbd349ac268

SHA512
6ecd845b0b5770267d16fda05109d4a0e4465b11cbbaf8c1f1a0ac35b4a7c2da923d6f583a48bb4a2d0a47feb299edf50ee0b94e7942e874f5dbe468a0b423ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_C89A7CE86B947A5BDDEC66331470004A

Filesize
406B

MD5
a7ccd2ee309602bd4cf66a5a87ec25a9

SHA1
931b07cc0968601a2b5b9f21b87d2551063080c2

SHA256
bc6c8478bb6154d77979ab7ff9ce05e676af0000ad049cd8f579fee27ba67ea1

SHA512
bf701b70634d225b8dc7a3f333247a5aee9af1fb5984dcb56a7cdd01d0b6c85f8dd3457e656c01652333997a98693644429a2e9044ee5649f453461259565b80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\02W4OYBM\www.youtube[1].xml

Filesize
1KB

MD5
ee8ff131e3274a4688c7430c180aa4f6

SHA1
3ed8cdffb45edc68ed172a69f23d630cde3d44e8

SHA256
18cba1413dc31843d5f5e8ad4b79788fec5b3f2a13a2ac04cc7a279a92bc4985

SHA512
1bf3944feb4953999b58b76e00388ab89022689765a9dc1d2f1e70296d073b1fb0fd0c0f165ba4ac03119539e852b5a7f80f5527e20a81a236cabef4479ca12c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\02W4OYBM\www.youtube[1].xml

Filesize
3KB

MD5
02604c04577f85ee7153f1bf9f16598f

SHA1
73d6c319481bbdebddb660ced53e33c67f7c7b9e

SHA256
4b5c410ed5127ae983d9a1da95b3aabff38181a3697d98f2b6e130d19045bdbf

SHA512
82ed8892362db487211829d96998c10711278c8c720c10a2baa601f4e34c6c115f948eba52ff7b2d4631426a1de364cdcaba331ba4369bb49ab1adcda34d1c1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\02W4OYBM\www.youtube[1].xml

Filesize
14KB

MD5
4a119128777d9f705b5e18d58ac8ae09

SHA1
809f730731a85d7faeb84adddea5cd9edd66a6af

SHA256
893e0d76278cfa30212a11c1a8f2c173ab3373a2f7523bea3abe8216136019fe

SHA512
6a21dbb4166e056f4e2df4e3d8fd76ef43473268794470645150af9f4bc47af05f0be4e416a05a982d14e6f78ff9f9aa251dcccdef137e210804dcf3dc39b737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\02W4OYBM\www.youtube[1].xml

Filesize
4KB

MD5
e8328afd93bca2b14dcd9c068c06cdad

SHA1
239735f29e8fd8608b59dfb9ca589f5a301f7071

SHA256
8b5a9788c1ff1f649bfa43bedfede933c4203edde6afd72909db7800b8997ea6

SHA512
761f1019ad2f09aa4669dbb230a0247ed531ced35f835277f18a520461dfc480cb70ca82987f8b12f1f15e513aaa95268f9f1cc9ffc9c654b4b1dd2bf3322d71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\02W4OYBM\www.youtube[1].xml

Filesize
5KB

MD5
3ef14ab3765a59b7afffefb1c1f5dae4

SHA1
3f6e1a9bc3ffb1399617b7b1d8d80e8f92def443

SHA256
f70be7b8af0803398c050d6ac9d96cb521628b5e78de2ca3151fad670a51076a

SHA512
d462397aa74be5694f88ff47b64fc6ec7f12e04b45f147c1b71bc799ab9d62ad8c161c4b37dff5fa4d4484096918db7355c3d707f757a406e0b203081a815aea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\02W4OYBM\www.youtube[1].xml

Filesize
8KB

MD5
b3c6bdd63b5d47bb23023ae6ad114253

SHA1
975427677cd86151808dbae88a8a957e81106e23

SHA256
31cdecc242af031af217d4cd455cfadf214eb853081f7272dfd4644f417c1243

SHA512
9311c6c756d470d1977a82386e0fd050ed9a4bc06aee9927f9e334bd1ed4094ae685414cb5d3ff81a0b5582bd4a8595cf0972193e82cbf1478fc3f418cba6818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\O6QCF9AM\www.hugedomains[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\O6QCF9AM\www.hugedomains[1].xml

Filesize
91B

MD5
f195a9e42fa7f53406fc5f58d82c6dbe

SHA1
586bc0c83e4d1cceef0964f61935a3cf6de52ce0

SHA256
bf92f79c706929058e355537f7bc33e5603f889656b9a87ed4fc67053afeb9db

SHA512
0bd791868b9909ec769b3edcfd35fc5e0574493f7fc286070c06f774906da147d91637885d697e49d7823bc7403ad94e6fec396fcf385ce7000da940190fb6b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0G5NCZDO.txt

Filesize
180B

MD5
79ddb03dc8181022b602c38a8dc442e3

SHA1
a443f79f1e57835b7068012cfc6d5ee970125c2a

SHA256
4bef1151c8cd1a878683a5ed042016bfb27e931bf21c1501469661b4ca16b711

SHA512
62a1bc4b36bfa22d31caa8bb6f1a0a60e05a391a5e555015c10d2a95534d77956ffbbdde2a331e023ac90d9b159024f267791f5acb080c96d2df297ce58c8ddf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6AT5R8AU.txt

Filesize
601B

MD5
e7a3bde2d9b59efb3825860a221d6d66

SHA1
dcda52a9f9806fda55a51b989396f041f334b5e0

SHA256
f00131bf6c6c3b84d80aa1c64bc8b4f54662938ddc0f56e75774adc5c7688efa

SHA512
3c65aa65dc5f42019423c6f43e8ac3ee84170628eb508cdafb44519f7cbb91926dff04c5527b38088ae76db735082f3867a8edfbc43403a3e518abbbf7de6d31

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
229KB

MD5
6c7954215645d6137b9f94f26db92673

SHA1
3cfa469d13fa84d97e617bb39683f4257ee6add2

SHA256
95c4037d17ce1b7b134ed8e97cc39c9d263ac866bec9ff7fdfcf36e49704ee37

SHA512
1d514bfce6cc2f43e842204e9b584d2353e77ea655cbde4e1b1a37508bf1188671e9723d015a7961159e53e831ac82c04b4c10f9ca63318ba1a22e78b2e4aec9

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
229KB

MD5
6c7954215645d6137b9f94f26db92673

SHA1
3cfa469d13fa84d97e617bb39683f4257ee6add2

SHA256
95c4037d17ce1b7b134ed8e97cc39c9d263ac866bec9ff7fdfcf36e49704ee37

SHA512
1d514bfce6cc2f43e842204e9b584d2353e77ea655cbde4e1b1a37508bf1188671e9723d015a7961159e53e831ac82c04b4c10f9ca63318ba1a22e78b2e4aec9

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
229KB

MD5
6c7954215645d6137b9f94f26db92673

SHA1
3cfa469d13fa84d97e617bb39683f4257ee6add2

SHA256
95c4037d17ce1b7b134ed8e97cc39c9d263ac866bec9ff7fdfcf36e49704ee37

SHA512
1d514bfce6cc2f43e842204e9b584d2353e77ea655cbde4e1b1a37508bf1188671e9723d015a7961159e53e831ac82c04b4c10f9ca63318ba1a22e78b2e4aec9

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
229KB

MD5
6c7954215645d6137b9f94f26db92673

SHA1
3cfa469d13fa84d97e617bb39683f4257ee6add2

SHA256
95c4037d17ce1b7b134ed8e97cc39c9d263ac866bec9ff7fdfcf36e49704ee37

SHA512
1d514bfce6cc2f43e842204e9b584d2353e77ea655cbde4e1b1a37508bf1188671e9723d015a7961159e53e831ac82c04b4c10f9ca63318ba1a22e78b2e4aec9

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
229KB

MD5
6c7954215645d6137b9f94f26db92673

SHA1
3cfa469d13fa84d97e617bb39683f4257ee6add2

SHA256
95c4037d17ce1b7b134ed8e97cc39c9d263ac866bec9ff7fdfcf36e49704ee37

SHA512
1d514bfce6cc2f43e842204e9b584d2353e77ea655cbde4e1b1a37508bf1188671e9723d015a7961159e53e831ac82c04b4c10f9ca63318ba1a22e78b2e4aec9

Download Submit
memory/552-71-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/552-67-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/552-72-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/552-76-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/552-89-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1112-63-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1112-56-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/1132-65-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1132-77-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download