1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b

Analysis

max time kernel
151s
max time network
156s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe
Size

704KB
MD5

0654765f5761a0a2e938f77b51c0f62b
SHA1

6fd467aa2879472cdb7cb58f83a55b902000b093
SHA256

1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b
SHA512

b17515fcf0fa004d4a68c79a0614f0058034c493b1a71c592de26212c95e102c0e6a918e17f5048a751c00fb51aca2ba7c6f8afc05be920f181472b197eed00e
SSDEEP

1536:ehqF+u1LAn+5eHByhdNMcmTcHEnStBFwYAuPzJU3LZlYbr5A/zdHnAkUEocqgvJM:xvm4VMcmYAYjPzcfYf5Ard2EorYDk+W

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Executes dropped EXE 3 IoCs

pid	Process
808	winlogon.exe
800	winlogon.exe
864	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsched32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmb32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ping.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rapapp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fast.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtvscn95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symtray.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumphive.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sgssfw32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zatutor.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSHTA.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsupp.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcupdate.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navex15.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pspf.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swxcacls.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fslaunch.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccevtmgr.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfagent.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nc2000.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak5.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Opera_964_int_Setup.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkwctl9.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kerio-wrp-421-en-win.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspatch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjsetup.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vshwin32.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IELOWUTIL.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bipcpevalsetup.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lookout.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\n32scanw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashWebSv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\css1631.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killprocesssetup161.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\processmonitor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winservices.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmsrvc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esafe.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsupp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monsysnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspatch.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npf40_tw_98_nt_me_2k.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lockdown.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\routemon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmiav.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ent.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nui.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panixk.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perswf.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpf202en.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdetect.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxquar.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleaner.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dv95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nisum.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamserv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mghtml.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbust.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wradmin.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2040-55-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/900-57-0x0000000000BB0000-0x0000000000BEB000-memory.dmp	upx
behavioral1/memory/2040-59-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2040-60-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/files/0x000900000001311a-64.dat	upx
behavioral1/files/0x000900000001311a-65.dat	upx
behavioral1/files/0x000900000001311a-67.dat	upx
behavioral1/files/0x000900000001311a-68.dat	upx
behavioral1/memory/2040-71-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2040-70-0x0000000000BB0000-0x0000000000BEB000-memory.dmp	upx
behavioral1/memory/808-76-0x0000000000B00000-0x0000000000B3B000-memory.dmp	upx
behavioral1/files/0x000900000001311a-74.dat	upx
behavioral1/memory/864-81-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/files/0x000900000001311a-83.dat	upx
behavioral1/memory/800-86-0x0000000000B00000-0x0000000000B3B000-memory.dmp	upx
behavioral1/memory/864-87-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/800-88-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/864-89-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/864-93-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/800-94-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/864-95-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
2040	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe
2040	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 2040	900	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe	28
PID 808 set thread context of 800	808	winlogon.exe	31
PID 800 set thread context of 864	800	winlogon.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 62 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000aed4ea6f2d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://gl1l2v0ibt1w6u5.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374589845"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://583234y7f4t0199.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000d4d28a291f61245570f373f5348e6b6faa4a989027cbe8d315b6757e0fdfe583000000000e80000000020000200000007fbab71e3f965c6698428e9a048afcda961e13e99af69f79c25b8657d0b6c0232000000018371de9228d2993b25ef527a6642be8c2a2287b9f3ccb5bd13314ca863cfd6240000000a2e992fc4d02f79a24ad3dfcb6cb83b343a44b9b5677ca1bd9e216e5f4ecdc410418c539ed739f760fa39248573c2fdc25f7a3a251f92b4c3120a221aa9ef139	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://1w7bfri3bjgo5c1.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://72f163sv37y7y81.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74608FF1-5E99-11ED-A6C3-FE72C9E2D9C9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf000000000200000000001066000000010000200000003afd1be3db90cac475803b50d5474b2e32d3e4ce4f08ffde7532bf6db87399d6000000000e800000000200002000000046fd265ac11b4c64c56af33e1fee1a38be51bb0821fb4a3068f9693615eac305900000004b1963687b2d12861df8fa6e2eb655b211bc1d96e432933c4f2d84465932ce2dbd90170f0c2206a8a9eddd926e73d02bc548d89bbd40083c2b6ecf9f656ea0e262585ca9de070b801d09bb6b71001aa43456e911705aa92b900b8ee31814aed4b2df6e7fcbacedd134dd3c20fa6ceee3a00011ade2c450d6e9b150b816e7a379572d2c94b78248c6204af4626e381a0540000000e66c79786b5e8128e15118707aefb60f2ccda5985c32fa36ac9521ade7a51555ebf29428dff61d06ae27a40e9b7d11db54f4c9d1cc6b04448b5814158c03596e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1097"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://90609nq7cgt4hyc.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://q0h75m179p54k34.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://69feg33x8j2c4cc.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://f757nur75t8o1g7.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com\ = "1097"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com\Total = "1097"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://4r556i242653902.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://0zi7c5kf1pv4228.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
864	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	864	winlogon.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1856	iexplore.exe
1856	iexplore.exe
1856	iexplore.exe
1856	iexplore.exe
1856	iexplore.exe
1856	iexplore.exe

Suspicious use of SetWindowsHookEx 29 IoCs

pid	Process
2040	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe
800	winlogon.exe
864	winlogon.exe
1856	iexplore.exe
1856	iexplore.exe
1820	IEXPLORE.EXE
1820	IEXPLORE.EXE
1856	iexplore.exe
1856	iexplore.exe
576	IEXPLORE.EXE
576	IEXPLORE.EXE
1856	iexplore.exe
1856	iexplore.exe
1876	IEXPLORE.EXE
1876	IEXPLORE.EXE
1856	iexplore.exe
1856	iexplore.exe
1500	IEXPLORE.EXE
1500	IEXPLORE.EXE
1856	iexplore.exe
1856	iexplore.exe
1820	IEXPLORE.EXE
1820	IEXPLORE.EXE
1856	iexplore.exe
1856	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
864	winlogon.exe
864	winlogon.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1416	900	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe	27
PID 900 wrote to memory of 1416	900	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe	27
PID 900 wrote to memory of 1416	900	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe	27
PID 900 wrote to memory of 1416	900	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe	27
PID 900 wrote to memory of 2040	900	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe	28
PID 900 wrote to memory of 2040	900	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe	28
PID 900 wrote to memory of 2040	900	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe	28
PID 900 wrote to memory of 2040	900	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe	28
PID 900 wrote to memory of 2040	900	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe	28
PID 900 wrote to memory of 2040	900	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe	28
PID 900 wrote to memory of 2040	900	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe	28
PID 900 wrote to memory of 2040	900	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe	28
PID 900 wrote to memory of 2040	900	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe	28
PID 2040 wrote to memory of 808	2040	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe	29
PID 2040 wrote to memory of 808	2040	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe	29
PID 2040 wrote to memory of 808	2040	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe	29
PID 2040 wrote to memory of 808	2040	1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe	29
PID 808 wrote to memory of 1880	808	winlogon.exe	30
PID 808 wrote to memory of 1880	808	winlogon.exe	30
PID 808 wrote to memory of 1880	808	winlogon.exe	30
PID 808 wrote to memory of 1880	808	winlogon.exe	30
PID 808 wrote to memory of 800	808	winlogon.exe	31
PID 808 wrote to memory of 800	808	winlogon.exe	31
PID 808 wrote to memory of 800	808	winlogon.exe	31
PID 808 wrote to memory of 800	808	winlogon.exe	31
PID 808 wrote to memory of 800	808	winlogon.exe	31
PID 808 wrote to memory of 800	808	winlogon.exe	31
PID 808 wrote to memory of 800	808	winlogon.exe	31
PID 808 wrote to memory of 800	808	winlogon.exe	31
PID 808 wrote to memory of 800	808	winlogon.exe	31
PID 800 wrote to memory of 864	800	winlogon.exe	32
PID 800 wrote to memory of 864	800	winlogon.exe	32
PID 800 wrote to memory of 864	800	winlogon.exe	32
PID 800 wrote to memory of 864	800	winlogon.exe	32
PID 800 wrote to memory of 864	800	winlogon.exe	32
PID 800 wrote to memory of 864	800	winlogon.exe	32
PID 800 wrote to memory of 864	800	winlogon.exe	32
PID 800 wrote to memory of 864	800	winlogon.exe	32
PID 800 wrote to memory of 864	800	winlogon.exe	32
PID 1856 wrote to memory of 1820	1856	iexplore.exe	38
PID 1856 wrote to memory of 1820	1856	iexplore.exe	38
PID 1856 wrote to memory of 1820	1856	iexplore.exe	38
PID 1856 wrote to memory of 1820	1856	iexplore.exe	38
PID 1856 wrote to memory of 576	1856	iexplore.exe	41
PID 1856 wrote to memory of 576	1856	iexplore.exe	41
PID 1856 wrote to memory of 576	1856	iexplore.exe	41
PID 1856 wrote to memory of 576	1856	iexplore.exe	41
PID 1856 wrote to memory of 1876	1856	iexplore.exe	42
PID 1856 wrote to memory of 1876	1856	iexplore.exe	42
PID 1856 wrote to memory of 1876	1856	iexplore.exe	42
PID 1856 wrote to memory of 1876	1856	iexplore.exe	42
PID 1856 wrote to memory of 1500	1856	iexplore.exe	43
PID 1856 wrote to memory of 1500	1856	iexplore.exe	43
PID 1856 wrote to memory of 1500	1856	iexplore.exe	43
PID 1856 wrote to memory of 1500	1856	iexplore.exe	43
PID 1856 wrote to memory of 2732	1856	iexplore.exe	45
PID 1856 wrote to memory of 2732	1856	iexplore.exe	45
PID 1856 wrote to memory of 2732	1856	iexplore.exe	45
PID 1856 wrote to memory of 2732	1856	iexplore.exe	45

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe
"C:\Users\Admin\AppData\Local\Temp\1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:1416
- C:\Users\Admin\AppData\Local\Temp\1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:808
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      PID:1880
  - - C:\Users\Admin\E696D64614\winlogon.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:800
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Modifies firewall policy service
        Modifies security service
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Windows security bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Executes dropped EXE
        Sets file execution options in registry
        Drops startup file
        Windows security modification
        Adds Run key to start application
        Checks whether UAC is enabled
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:864

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:472

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:734217 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:576
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:996363 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:1127444 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1500
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:275494 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\08B8D8C1791AA7714DD4D760C5F42C55

Filesize
503B

MD5
7a0ece602e5d4ef3cc76d0e4b9620588

SHA1
88294173610d098c98c2aaaa4ba82e5690ce118e

SHA256
f20333f02177065679b734b891a65a8ac7d5dbf56f3cba40df34a4db40e0bdc1

SHA512
e2304227790bbfcd99363bc1042b44eb0c140ffe1766ab3d5fe8fa42cfad93a73e2acf43f41939b3f23bb690e1d4244726b5eafcb9e0475db571068b59eebc9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\08B8D8C1791AA7714DD4D760C5F42C55

Filesize
503B

MD5
7a0ece602e5d4ef3cc76d0e4b9620588

SHA1
88294173610d098c98c2aaaa4ba82e5690ce118e

SHA256
f20333f02177065679b734b891a65a8ac7d5dbf56f3cba40df34a4db40e0bdc1

SHA512
e2304227790bbfcd99363bc1042b44eb0c140ffe1766ab3d5fe8fa42cfad93a73e2acf43f41939b3f23bb690e1d4244726b5eafcb9e0475db571068b59eebc9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
c3524ebb4f559c6d3f8fd09a4a51e6e3

SHA1
9a746c6eeef8a53d112779637db97132cd27bd5f

SHA256
97ea352465170638cf52e43ccb4615069a85bbfd9f187d48ec4d870ee1967f1c

SHA512
06048b89cd2839945b17adc399c06eef8f82344e363ba5513bd62749f10c714097013b5c2fb14cd4ff0bd8211d6b00e23ff28e267441f71ab84b400427d6b1bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
1KB

MD5
6769483b05d9dc54fce4e7518d0c0ed9

SHA1
1577b4b90099ea2aeda0114f34b4104f9d20c9d8

SHA256
9e7c3ff8633da3a8e78f40be3c8382fdda0c2c9ac8f08d519f4dce14509fe779

SHA512
dfb7b040e13ba7f00bbf7c34383061d364ffbf27b51dc32c67939a250143303e2235503f2a1911737b4e51a11601119c9a903e8fb1b5440061e82406a1056813

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_C2762C5F6270C1AE65D4E36FC57032D8

Filesize
471B

MD5
68bd9d2746edb43e71250ead78736ef2

SHA1
78991acdc3545abb8a8b2ab2367a6b9723358eee

SHA256
6b1c2becfb5ba87cba41e06a69dfa0235d80a93516eb8b79ab2e85e4714d174b

SHA512
1de2d77733d565a1734735241b7a1ed3a76594766ed8096ba343ca11624909ddc02c3f5bff69e789a325aa9e9059cfaecf0e70a7f0caa133519e56b58aa5b460

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
1KB

MD5
3ba36e8cda4753ac6042753f316abdfc

SHA1
fc74803343254d7aae737a21dd78250ecb8b6cf3

SHA256
ebc09e9247b88bb94512af3141fb704d38aaffedf7dc062f8498580ee6986f67

SHA512
12a26afdb40ea1a26ea6e86f3213aad619e66f00c58130d5228db619eb6c72a433733fa18fc3b9264e04844f9471452e6c0b12a316c691fedcbb5110f9001e36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_543B7BD726970BD166CFFC3B32EE7089

Filesize
472B

MD5
bf55a5e3b388533c18f4eed310ed28b9

SHA1
3d9564cad00a8349f63a5c72118b0776524d0eb7

SHA256
97c32c42968f5f4acf571408533a411b992720182a1477dc95fd792eedbcc624

SHA512
2c6adb06291a54bdecc02c07e715292acf957d544c40e6726e661da6ce20619e9d6c39069a4a9c6d9464746ec09ccbc278a70bf0cba6130195c666b4a9c768dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\08B8D8C1791AA7714DD4D760C5F42C55

Filesize
548B

MD5
2b9b174b3658ac058774199c8933c1c3

SHA1
3d2d83023d09de07548866a113e2f5f0b4a8fad3

SHA256
197e7cfe961bfbe23e9ab26cfe158ab62b6b5b5788538bb546875d7b0fac2bd7

SHA512
62d52e8c88c522d1c50ef37e94494903ae9e98edb727d1594b89d5062ec69f663c6136c87ae6e0509a29cbbd704f734b2a37280f46d4d13211e7c4236249167e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\08B8D8C1791AA7714DD4D760C5F42C55

Filesize
548B

MD5
be347b094e742e284893ebc5e23262e3

SHA1
bacccc6633c5250dd638ac958e4a739a0284f91c

SHA256
65a2220f201f5f607e67c06e647157472d82eb9ddd4baaf4befeea1e1a36b7c8

SHA512
2344e2c38956684e6c20d6e19e6f7d87e4d3709b69b71eaad2f7a8bdaedea473cfafe8aae50a1689a054a32b47d923f4f4aa42ab888fd5ad4a0bcb9af45d2c43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
349012dd76bcccfd816ea533446ef60d

SHA1
4f7e02273a6e63ac9ee8e4691615e608acd745de

SHA256
8fa34bf83f06e7e06964cfa1a778cdb54c369ae83cd78dfd84abf12ebfd3ab3b

SHA512
79e58afe88e27c2f72b7363fd8b2f571f6271bf16627eb08dd7cdc69b74c8b50475bdd4a73b0c70cb37f3823aa0e03336617ad5e3535a0833f19cba1fc269f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
349012dd76bcccfd816ea533446ef60d

SHA1
4f7e02273a6e63ac9ee8e4691615e608acd745de

SHA256
8fa34bf83f06e7e06964cfa1a778cdb54c369ae83cd78dfd84abf12ebfd3ab3b

SHA512
79e58afe88e27c2f72b7363fd8b2f571f6271bf16627eb08dd7cdc69b74c8b50475bdd4a73b0c70cb37f3823aa0e03336617ad5e3535a0833f19cba1fc269f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
76bb8b592061abe1d18f9451c9c09c64

SHA1
deaef992952342a8c31c2bc95abfad9445737b1f

SHA256
f4f801db980eeb484107c19e734be61b65e0219917f9ec1c2d79f6e16202fe9a

SHA512
f0dc394488eb05b1910154f3bcf7811a3b80a9b279e61c32b759e2a10725bf5103fc479c6bb4ccb3a2ae8c9889951068aac89c8743e206134db2cab4b1c91ec6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
466B

MD5
0c0773b45d4fa8ba9ea75f403e3e5878

SHA1
8fef9b104855697a46fd62feb95645dd4c55571c

SHA256
20ea846d137bf50568c3516db5d5a00e882558caadaf0e5e438a1fd438e9789a

SHA512
2c7878dfbe74c902e044a4d9cf001f9920c9dcbd5f9b942fd54172c063b250df48ea578b55ca29094b4b8eca87a1224efbb84a6afb6744ceb92777147ab80afd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
350ad4abc8d0220c5e16a0bc3f3bae18

SHA1
a404f4e7017287dd86fbc0c649babc0a5ace89e7

SHA256
21245133f7b6dfbfab23505ceaccf94220bac4de1d54f369f7a6fd122ef43735

SHA512
73f81e443b8fd650bb2802a9701456ceb70c9d9ab9279c40edd7e0a29f84fe8103d2983a62d9f6fd81466927464aaef469eb7381b0bcb95837b2fb9b56f467a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6364bb9225b11be13498709b11dbd5de

SHA1
fec9d2fd502c51880c52d38475cfa127a20a851a

SHA256
96735ea2bb2c50888ebbcaf4e767435b797c805f3dedd768f8f9b6527fe18c57

SHA512
03a061cab4de9e9ffb322b1b242b91a258d0cfa34bd1f8609608edcc52db1aa25b25fae89e22e6f84f0d6950c7d8161b66635a197bed1d3ed7d7017283966000

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b69e11b6ff60cc63d5ec39b8e8ea1517

SHA1
7cb4a39135c280493758c5cd5650d4a84f06275b

SHA256
e031f70fe3c5a0cf839d9e83673d6d09846d4d33c34c90fa0f26944b49f4b57e

SHA512
c7f4c227d5a054eb593188bb89575ded162a46297714f4ee97c56ce84ad3d2facd1ef9af8cca6c52634170c739d8d5d517d59b8bdd81ece424372d8d251f5327

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7158120193c4f91573ac1c144c47d403

SHA1
2efb30a331bab518bc1a62c6583505fc85c56bbd

SHA256
3b78a2bc671cfcee8ae1a076fe2fd459bdc7baafe4bcda3d76fc35498b2c3f6e

SHA512
e029e0f5797f318d06231656c08738b146bfaad4a02748a30e575e65ed4581b8e26f750dce2b22cef93fe12c85a7b6b6d35202443905ae465def628c88eafee8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cce7878154f8d273745a043c398e55c

SHA1
6e761f7a895d49d7cba47a5ae125965102bbb668

SHA256
db9c2218dda4430c726b8ee36a30a3d2b919fb5f0f5f4ffc53c45d89a69c4f73

SHA512
c9790188a2b5f1693db124ed255d9f67967f252940e7779da4ca06bf1705b738fd0649267dcec38c1fe1143256b9f21fddf6c5f8f90ce6a6148edd158c457755

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67199c947b4fae1e2c919fac64913022

SHA1
b32355b95d2bd0012d9c3081ed6b9ef54afeb499

SHA256
1142ed7cbcdc12b2002b9514ea50e44a0c8350e9661ad5192eeb1c3b88d1315c

SHA512
6f75bcaaf23fb206e81fece5c537f364f879a43439952b67a612fc3064583608e70379ab26bb2cf018bc3d2b99675f936cb0f8a035878ae7cfb289dc391416a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5d75903c48f095730534da9eac75eb7

SHA1
eaa84b55a92513ab9bda517c4872bffe062462ed

SHA256
04d1a785392a46355e832d60ea0cfba9f2b4544b468e92356264706d99a2849f

SHA512
f0cb8ee29d0f6e9a14e4d8ffe0adcab37c967acb422562abb8b763477561dd1e1dfc4784c3d7c87053097a004272b467b6c1e7cbc27080db1322988bae62717a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae37c371379976ac9af01b45c9f6d646

SHA1
504d594e0f290a996cffc2b90acdd6ad3bdb1847

SHA256
86e3ef96938b31f9754574822b79e63cb63fabbd9f0ebb07dbe164ad729deefe

SHA512
cb1cc8c73c1087097a915cd8a609b55c1d3c9ccaaaff8e4d88718f696882ec885d7c661d579d683757761f82a76ca6af9ad18f93fcd5548672e4baae664c8e86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4639b9640a66ecd2d19959829a9358af

SHA1
0551f61132872af6d8f69cbe2912f2efcb45b88a

SHA256
8181e0e24efbe95ce2d3903161617a2a5e37c08006079d6ce1f77632ecad20a5

SHA512
c3ffce8056969855f252da96caea35311712a98132ce4e2bb993002e58f540954778a59eece712db22e4befa46e058a8a0adb15f543132bbb79c0394dcf74c09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38db1a1f8fcba339be63a583fc4bba11

SHA1
44e9e077eb45bf78bd0939b1212ba7bd045914cf

SHA256
eb6ea03c0d5683063400337558839abbbb55860b4074e11fd3c458d9a8592038

SHA512
72c5387155444e56e0745bb840553db0d4693863d91dbf352eaaa58c9bd480264bb64f806ceef68f9014ebc980e176b9dc8840ddebe159eaddaebca652cfd5d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a38c62fb45c7b9f8b64541144d88531

SHA1
4f8f0f4bd826d44bcbdeef141a7b35ef11a67707

SHA256
254e13dc590af8b4d0a549bde2776e26136deeb589a122cbcb3f2bb2fe3901aa

SHA512
a2b9c31713624559432b01bc8532e3b56afeec1dd42c69967fe31e13f4b65f944c9804b31e333b8c7491ccb7b5f312db10d0499d68a1cfeab44a06c37a8124ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69c694c09cb68de08f387adc030e4150

SHA1
6b666c38933430c4694a5dd8cf8a87b4f47bdda8

SHA256
a17c1a388f9569d900ea19a45529e3256789b9edab19ffbf3d041414c6b87928

SHA512
06b36f7382f3e43d5622bfcc59c84798024f0e91b646237f2faba11394bb3606b52cb9a6a334e70f0c09cf6357f0f72711a3e82e8d0893c0edb77142891ce6fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a341cc51714438f34a825b4b972e82a3

SHA1
e10366e61a15b53a775a324ae441db9eb89728a6

SHA256
26db7d1afed7b481ad2a10b3f40f2773e0d774fa51a02a545569b1deedacb789

SHA512
39a47e6e751f76c45d30007bd179117f0c7ff9236d6e89184e8bbec2b99140d6f1b10c2e3be4e77800bda8b4b14b35f700255914988c3e2fbe189e099cbdd307

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6340394d87839aa4cb62ca51022823bb

SHA1
a75b696aa67f148d5e4279fba1ef6b91cb7f27d7

SHA256
5a486a6f0930dcef2f12c09cb96f45aab7c68afd225177ecd38168c0b9160931

SHA512
71a6d964732c27476ddef32ec0f8a002167a599133a68b7a928e59ee532e1623ad546f3aebce38ca5aa78d2cacf81cdcfd375e8b6a8dd0312b8604c5cc66a590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
507f33975a28c845ddd3b69622b39ae1

SHA1
282fd3dd831b6c24dea3b59e9a415a5e6c08162d

SHA256
cd4d8d878df23f46d1be88d4ae5621a23d0ae01d2cf244c53aa12a92c847bc0d

SHA512
d66272ad3e83ec263985502b1dd545f6cb59978291519518d0ddd97d140989c56b00dce5ad9ebaf811570301fc15a6a05cc53cbdb20607d122c2b50fd73b10db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d8eb7160d3c097acc041bfe926ee602

SHA1
2ccfd294680700eff62316967c07734ad595e1eb

SHA256
9c1f7f8086856278c143c5739166cb7c40390010b385f9c79b046f829cad2cfd

SHA512
4eeb9c7b41252925b71c7ac724ac739233125e34e9c39307681b90c32adf16ce8f93de0da2cec4761619299522109659b02ed9c224c554f3d28ccd6c27b5b660

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
141e7f90a2163c7f50ac66c7a26747a7

SHA1
4fe0cfd0a6bd3d99cf3faff0cb26f0101846da29

SHA256
84f66025bd775ca4777ebe60d09d984a17efd3d874db28ecb1b15238ce9bfccf

SHA512
8cdd59c53e2ee15754d189dd2f4f331d8db34ce31aee95e4fd0c94bec0d43cf194595b2713725d4f02d9194fe2a16093feb0610c8508a126695b9d71f6c31dbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baad315d861e5ff95844697998c5dee6

SHA1
8972ed975d4a2ce0f3726010d487159163c49118

SHA256
4f763d88b24e4a53fe4c2f82a4eff3eb4080cecb6fcf3eb7d8ba7f3c59739461

SHA512
94f70c578dc8305096dd830f4d579fcf97b1cd408ec6954e25e80b97b160020711b32f711895455a90a19c4ed0b031645542927e071ca957b13c0f0178f532df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc6cc1137c5af0c8f4f6c223280ead73

SHA1
de140ffb30fb679ffa116899fe01487068468919

SHA256
e97bdaa80094c0780b7b5a760840a60a72c51559e2badd95e6d9565835d70f89

SHA512
b1f88eaf832524df175d036b8a694cc11a93361d0c426d3bdc7fffba85cb5da07c812deb41eca8dfcc8e2a5aa707ffa119d15f2425c485b7ebeba4f951addf6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_C2762C5F6270C1AE65D4E36FC57032D8

Filesize
406B

MD5
3616581e735b616bfc3d826054f266fb

SHA1
743439e8016de049ec7b51c781da897fa2e7fee7

SHA256
a820b319937d923e0c0ce4f28b9f0f93830e8ec050396c104d16f795dd844062

SHA512
05fd194da32955c83f80a0eb62bf923b1efedb0262ded330089260f07d66f524bd1749f4503fe1a8396f4a41f0659a69378747cc13e749f4919bca04c32d759c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
470B

MD5
d7b15a2ad33a41884d7e803432b3d9ce

SHA1
29bdcbbc4314d420954885714bc97e72f8f1bad6

SHA256
36bdb560eac983a63efbf96251418a0e0a212c8dd9b49d72063a9ab77720bc7b

SHA512
7782e8d1219b82bea9ea4921a8a943eb6d7adf943b7ce1047d165e870229ec121393fc691eb9aed255fb66deaa7d43d54fd7615d9e3c597ee1a1a47fb0675687

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
4b1ee33c54400b0fbbdedef269f9880b

SHA1
cb5c01883de7b79e7fca4124e3c8ffb862f9de95

SHA256
84cccd518bce5e2b508daf152d6d2cbbe596047814f9b3e9f76bde4853b745e4

SHA512
76029107e12b803e5291b9333e79ed31a6129fdda4af5a04270b715d48428677e8d392d54c5cbd1dac29b9309731b3f9d9807113e09b2abc33cc029799de7df0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
252B

MD5
fed8147b0216c212cb9235c339e3ff90

SHA1
7e2d3b7f7ed776091409960d5e8e54d22b41b9ec

SHA256
0ee94337c7dbfa17c6f18f1c85103232fe6fa5b20d54c6859445fdd2a6bec487

SHA512
00ea9be700b93de942fda945203cb4defa09b5bb04ad6950b3228d7529e26595fdc38f77bed3a4d0d77d2bd887440a4145cfa84e206ede0188187b7fd3c25691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
af3d1c54040709b6113ba79248052357

SHA1
ead21cb8e6bfeec9ad056a51464154f55ce04209

SHA256
6d13570d3a32e68488e9083c78a401115b40f7cfcb5c0dbc0eb524b6b7941e7c

SHA512
73844a8814c0c6fa05c14531454a5f32c620e1ade2767b24058fd3d12c447c88d754adc2f7da484dc9ff54cb63d16b7001734482e4248c40c22a6f06781857c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e1c5e9e6d65bf229c9aa8a4f71dd0fcd

SHA1
27504a398a20946398e848d3f644a4a08fdb8816

SHA256
2d9ca7d223cbef2b1cbb71e311b8e602a223b448903ba097f82a08c2384366d4

SHA512
c7aaaed014198faa9a1e28afd96bf9587f308644339ce00a309d10aaf3f0f190a387e291fa1df253ea84dfd52c5c63dfa04ddb20b50f54a0bb6b99f6dda1e2bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e1c5e9e6d65bf229c9aa8a4f71dd0fcd

SHA1
27504a398a20946398e848d3f644a4a08fdb8816

SHA256
2d9ca7d223cbef2b1cbb71e311b8e602a223b448903ba097f82a08c2384366d4

SHA512
c7aaaed014198faa9a1e28afd96bf9587f308644339ce00a309d10aaf3f0f190a387e291fa1df253ea84dfd52c5c63dfa04ddb20b50f54a0bb6b99f6dda1e2bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_543B7BD726970BD166CFFC3B32EE7089

Filesize
402B

MD5
45ea1bcfbd8019f78383d9b6992ccea5

SHA1
4739e90417ecbbc2212b752c8ae1c2f930368776

SHA256
4df0d5de0944dc22d5e157a5e9df3aa9fc4c791f3d8675a481670b3bd762f3e6

SHA512
7ca96a963172011019720002ddb8e49200c372cd78e607c367e91572ec3a01bd51ba03e74abf8b550bb822536d191926beab2b28fd7cfbbde470781483d87ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\BOHJJWVV\www6.buscaid[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\BOHJJWVV\www6.buscaid[1].xml

Filesize
1KB

MD5
6b68252b00b122c44cc1321217e66574

SHA1
23a53f680d98eddd29c023dbb34987aa2c17e680

SHA256
f4e5f40dcfdab2d6af6e0785615024bf7fa636dd4e9de25fc2f845a4cb67cbb7

SHA512
e71ce34548456f6ed7d498d167f26b7beef1b992c125dede38e52aacf689dd17b946d91839781d725136af24896103999a694a259fec895f3815355e72465a2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6ORS647J\caf[1].js

Filesize
143KB

MD5
09493d3c5d365834280656ac89a5b702

SHA1
0fbcd1a3a89172ef896f8ab6fc2c5d4f67458020

SHA256
3b2f87ef2f447b429e855109fd3b71078475fcd1619417a86523e59b3fbe11b2

SHA512
4a1ae40bc061115ed0d0d57ad46b8c1ccb107e1b92945d85389f59a0c5f68f0b2c40e0fc555490c4b01f036c7343eacdd08ee5ea001bf26912eed215f4765c25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BG9XQTG0\f[1].txt

Filesize
188B

MD5
5372cddbd3c371dc133f63a37a0e28c3

SHA1
092a17b57b43716fca910337b5eb7606bb520fb1

SHA256
79f37a7a4fba39114d3058026cf737b301bb84143575d62656fd7d7cc8e5b7ae

SHA512
4be67155feba86dc50454f22ba83d67593a27b969fddb44320db5e3fd43bb4d879ab5a8b212117bd97472c3a8633881b418f548b3eacfacffff76f0166991f45

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\3PT1FTE0.txt

Filesize
111B

MD5
1fb05b41308dc06e5d51def0863b6f22

SHA1
cca56e76a34b6db7daac88f06db7478086bce0c5

SHA256
d522c88fb6ddb447a272712fd9142427731ba3d58b0e55fed7714449b29e73c9

SHA512
768a879fd5f3b2c90908e8a389c92b0b708f681463953d2404094b94f532ad4108322007013e6aaaa921aec7351c47f76733950cb09bc46f985a02d26e8f14d3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\OZ6U8327.txt

Filesize
608B

MD5
20ee79671a920881649246dbfedeae3b

SHA1
c83621d555446f67688eb89c6c003caa7667ebe5

SHA256
2a6feb10f10a0566ee7a01b4f7265afebaf23ddece4693fc899d833a790985cc

SHA512
b89255ef6898b8a7c7f0110e4a18ed75cca038a1678fef45d95c9fa666e6e8e1c62beced9eb9889d6f12a8af35d6b703c5b32cee09629709ae5b0f7275878295

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\RAP0EP65.txt

Filesize
430B

MD5
484538347d40c319722dffc6a27d7083

SHA1
8fb8a2d5c0e2912c5ba653cdaffb8f8fc7a949db

SHA256
f95166f079837cd68870949106412b9e19bf1ea242f139b9a35c602c5aa30655

SHA512
ee8270bdeb9b5d8a0417c3c587a32c03795e4f60f9b74a47a97b300dbb6538b746913936f787207a72620d052e572c5c6eb83cbc79de962cc4123f485f70c0b9

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
704KB

MD5
0654765f5761a0a2e938f77b51c0f62b

SHA1
6fd467aa2879472cdb7cb58f83a55b902000b093

SHA256
1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b

SHA512
b17515fcf0fa004d4a68c79a0614f0058034c493b1a71c592de26212c95e102c0e6a918e17f5048a751c00fb51aca2ba7c6f8afc05be920f181472b197eed00e

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
704KB

MD5
0654765f5761a0a2e938f77b51c0f62b

SHA1
6fd467aa2879472cdb7cb58f83a55b902000b093

SHA256
1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b

SHA512
b17515fcf0fa004d4a68c79a0614f0058034c493b1a71c592de26212c95e102c0e6a918e17f5048a751c00fb51aca2ba7c6f8afc05be920f181472b197eed00e

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
704KB

MD5
0654765f5761a0a2e938f77b51c0f62b

SHA1
6fd467aa2879472cdb7cb58f83a55b902000b093

SHA256
1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b

SHA512
b17515fcf0fa004d4a68c79a0614f0058034c493b1a71c592de26212c95e102c0e6a918e17f5048a751c00fb51aca2ba7c6f8afc05be920f181472b197eed00e

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
704KB

MD5
0654765f5761a0a2e938f77b51c0f62b

SHA1
6fd467aa2879472cdb7cb58f83a55b902000b093

SHA256
1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b

SHA512
b17515fcf0fa004d4a68c79a0614f0058034c493b1a71c592de26212c95e102c0e6a918e17f5048a751c00fb51aca2ba7c6f8afc05be920f181472b197eed00e

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
704KB

MD5
0654765f5761a0a2e938f77b51c0f62b

SHA1
6fd467aa2879472cdb7cb58f83a55b902000b093

SHA256
1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b

SHA512
b17515fcf0fa004d4a68c79a0614f0058034c493b1a71c592de26212c95e102c0e6a918e17f5048a751c00fb51aca2ba7c6f8afc05be920f181472b197eed00e

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
704KB

MD5
0654765f5761a0a2e938f77b51c0f62b

SHA1
6fd467aa2879472cdb7cb58f83a55b902000b093

SHA256
1d9d4716e9c1260110c2739172e03503506692382711080798e96a4c1cc8695b

SHA512
b17515fcf0fa004d4a68c79a0614f0058034c493b1a71c592de26212c95e102c0e6a918e17f5048a751c00fb51aca2ba7c6f8afc05be920f181472b197eed00e

Download Submit
memory/800-88-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/800-86-0x0000000000B00000-0x0000000000B3B000-memory.dmp

Filesize
236KB

Download
memory/800-94-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/808-76-0x0000000000B00000-0x0000000000B3B000-memory.dmp

Filesize
236KB

Download
memory/864-95-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/864-81-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/864-89-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/864-151-0x00000000041F0000-0x0000000005252000-memory.dmp

Filesize
16.4MB

Download
memory/864-93-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/864-87-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/900-57-0x0000000000BB0000-0x0000000000BEB000-memory.dmp

Filesize
236KB

Download
memory/2040-60-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2040-70-0x0000000000BB0000-0x0000000000BEB000-memory.dmp

Filesize
236KB

Download
memory/2040-59-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2040-63-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/2040-55-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2040-71-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download