4eb21992a6e6e0fcee433409f12c6203c69fac4e3b23c080b94faa1e7ba715b9

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4eb21992a6e6e0fcee433409f12c6203c69fac4e3b23c080b94faa1e7ba715b9.exe
Size

711KB
MD5

0f0b1422b55031e15a0006933c97a64c
SHA1

3a2f7d57f97f52d647a2073984bd117f90edcb52
SHA256

4eb21992a6e6e0fcee433409f12c6203c69fac4e3b23c080b94faa1e7ba715b9
SHA512

98f14907091f314c14efd005efa1d02afad8cbe120364f7823ba4a994fea4617921174fdd92641f91078b372a5ede0511e49b1c2d4b7c19740a0715cabf482b2
SSDEEP

1536:WXworacHmzbVggmmacFiMrNPCQ2N59MeoVkkvq18Hu+cTag8nnouy8:VoxGlggftOgeEkMu8O+cTag8nout

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 18 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-79690717"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-85466109"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-95247237"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-92977218"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Executes dropped EXE 2 IoCs

pid	Process
4592	winlogon.exe
1260	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atwatch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcscanpdsetup.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\route.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirus.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkserv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rapapp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav8.0.0.357es.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kerio-wrp-421-en-win.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcontrol.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vfsetup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w9x.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ewido.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwin95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EHttpSrv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notstart.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcmserv.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonealarm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IEUNATT.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spyxx.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\watchdog.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpupd.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsgk32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pfwadmin.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sphinx.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ss3edit.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alertsvc.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbmenu.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navap.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\evpn.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvsvc32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webtrap.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wradmin.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldpromenu.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netarmor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nmain.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pingscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav8win32eng.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ostronet.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spysweeper.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOSREC.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsuppnt.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iris.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\moolive.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mrflux.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SandboxieDcomLaunch.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpcc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esafe.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibmavsp.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panixk.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\persfw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpcmap.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clean.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fih32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icload95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnpc3000.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avptc32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symproxysvc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1260-143-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/1260-146-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/1260-147-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/1260-156-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/1260-158-0x0000000000400000-0x000000000043E000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	4eb21992a6e6e0fcee433409f12c6203c69fac4e3b23c080b94faa1e7ba715b9.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	winlogon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\44651464F494A585 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\44651464F494A585 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4592 set thread context of 1260	4592	winlogon.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://z0xc7037mc93c29.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "7669"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "8642"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.hugedomains.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C1D883C1-5F51-11ED-AECB-DEF0885D2AEB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30995294"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "8642"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "197"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\hugedomains.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "8705"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "8648"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "9593"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b071e9c75ef3d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "9421"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "197"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "9388"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995294"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000883ed98174fc174d8e18111dae0d9120000000000200000000001066000000010000200000002cafdb4927afdf351f14e21258becc84f72c7037ee01adb4ab21fdf9f426d2fc000000000e8000000002000020000000636b36ded33a00be36f53e38122bc600d25c11298bdcaebab818ca08b6dfc117200000000741c60f04342c1b3fb5ca15f93e6e851cdb7d0c910f045f0991153ac1b66d9f40000000ac3dde83e4539a17611324d586ac6320e0389ab2188703d2f8a4756ca88e6fb11a84c8abd8fc7a916b60f6507efa86a991a58709a10ae17e5933454f0e6ed987	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e139a15ef3d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "197"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e315c95ef3d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "19120"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 505c2fac5ef3d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "8560"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "17796"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "9536"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "197"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995294"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "197"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "9536"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "7669"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "8674"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "9542"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "6"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "8699"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://179pvf84ra5d0bm.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://ruy52dnzm9jdf1c.directorio-w.com"	winlogon.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2891029575-1462575-1165213807-1000\{0F14FD74-553F-4CB8-ACF2-EEAF4D66B7D4}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2891029575-1462575-1165213807-1000\{5EEA080B-D414-48F4-9A8F-D4166464D6EA}	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2891029575-1462575-1165213807-1000\{C55F64D9-D967-4A58-AD3A-C1518705661B}	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe
1260	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	1260	winlogon.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4152	iexplore.exe
4152	iexplore.exe
4152	iexplore.exe
4152	iexplore.exe
4152	iexplore.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
2328	4eb21992a6e6e0fcee433409f12c6203c69fac4e3b23c080b94faa1e7ba715b9.exe
4592	winlogon.exe
1260	winlogon.exe
4152	iexplore.exe
4152	iexplore.exe
5064	IEXPLORE.EXE
5064	IEXPLORE.EXE
4152	iexplore.exe
4152	iexplore.exe
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
4152	iexplore.exe
4152	iexplore.exe
1284	IEXPLORE.EXE
1284	IEXPLORE.EXE
4152	iexplore.exe
4152	iexplore.exe
4452	IEXPLORE.EXE
4452	IEXPLORE.EXE
2420	OpenWith.exe
4152	iexplore.exe
4152	iexplore.exe
3796	IEXPLORE.EXE
3796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 4592	2328	4eb21992a6e6e0fcee433409f12c6203c69fac4e3b23c080b94faa1e7ba715b9.exe	80
PID 2328 wrote to memory of 4592	2328	4eb21992a6e6e0fcee433409f12c6203c69fac4e3b23c080b94faa1e7ba715b9.exe	80
PID 2328 wrote to memory of 4592	2328	4eb21992a6e6e0fcee433409f12c6203c69fac4e3b23c080b94faa1e7ba715b9.exe	80
PID 4592 wrote to memory of 1260	4592	winlogon.exe	81
PID 4592 wrote to memory of 1260	4592	winlogon.exe	81
PID 4592 wrote to memory of 1260	4592	winlogon.exe	81
PID 4592 wrote to memory of 1260	4592	winlogon.exe	81
PID 4592 wrote to memory of 1260	4592	winlogon.exe	81
PID 4592 wrote to memory of 1260	4592	winlogon.exe	81
PID 4592 wrote to memory of 1260	4592	winlogon.exe	81
PID 4592 wrote to memory of 1260	4592	winlogon.exe	81
PID 4152 wrote to memory of 5064	4152	iexplore.exe	86
PID 4152 wrote to memory of 5064	4152	iexplore.exe	86
PID 4152 wrote to memory of 5064	4152	iexplore.exe	86
PID 4152 wrote to memory of 2188	4152	iexplore.exe	96
PID 4152 wrote to memory of 2188	4152	iexplore.exe	96
PID 4152 wrote to memory of 2188	4152	iexplore.exe	96
PID 4152 wrote to memory of 1284	4152	iexplore.exe	97
PID 4152 wrote to memory of 1284	4152	iexplore.exe	97
PID 4152 wrote to memory of 1284	4152	iexplore.exe	97
PID 4152 wrote to memory of 4452	4152	iexplore.exe	98
PID 4152 wrote to memory of 4452	4152	iexplore.exe	98
PID 4152 wrote to memory of 4452	4152	iexplore.exe	98
PID 4152 wrote to memory of 3796	4152	iexplore.exe	100
PID 4152 wrote to memory of 3796	4152	iexplore.exe	100
PID 4152 wrote to memory of 3796	4152	iexplore.exe	100

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\4eb21992a6e6e0fcee433409f12c6203c69fac4e3b23c080b94faa1e7ba715b9.exe
"C:\Users\Admin\AppData\Local\Temp\4eb21992a6e6e0fcee433409f12c6203c69fac4e3b23c080b94faa1e7ba715b9.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\E696D64614\winlogon.exe
  "C:\Users\Admin\E696D64614\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Modifies firewall policy service
    - Modifies security service
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Sets file execution options in registry
    - Drops startup file
    - Windows security modification
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:1260

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:224

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4152 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4152 CREDAT:82952 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4152 CREDAT:82960 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4152 CREDAT:82966 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4452
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4152 CREDAT:82978 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3796

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
0774dce1dca53ce5c4f06846dc34a01a

SHA1
b66a92ae7ae2abc81921ed83fea0886c908b14b3

SHA256
653df1e7ee6eb78011d131d41eebad55a6b11e14073ac204587960c404d2300f

SHA512
43582562e20238142d801d97dee6efff1213d38506dc8e21001517d799e52c5157a0ce814e29045fb267200878e964f04d05bb209ac738d510b48ebd689b82e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
7ed55478d555cb8377ac6f26628056d4

SHA1
fa1b8535c06b30914b4c23b185ac89ea9d884b04

SHA256
4a502dd143766bdf1bc0737a0a2e813abf0003579257e0acd299046091a7ba58

SHA512
34f23c0b850bd69d9a171ffe0b85449d8fe1fe7976e7f363d374f867ee4a7d9f610e0ba06fc5138cb016444b7b2e75c62e266e8a75fd9cd2dd37f55752ffaa17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_27BC849116B1211B0541CD891C1E1E33

Filesize
471B

MD5
a9374206851834987bb6f42fdbde6965

SHA1
1e7632ba7b83a2258cb88662d2fb2783d400dec3

SHA256
854af7f8daaf516b72c709bf1c9e6ba2637431efac48d977c520440cb3b99dca

SHA512
17daab00c305a75cdf26c1ab029faacfba945f13aab1de024a4b8deda67ffe47558436d0f7d9f69471c03a6741c630673b593a1feb0045eef4b4e6ed92c2cc38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_5C3F4CB4665DCF2109A8C91DBA78E447

Filesize
471B

MD5
6e8ee97ec58f7d2991905f88bd3a463f

SHA1
b87a69e7b938d01a4ac7d74ec69bffb4051695f0

SHA256
1fe031e258c6a541e040de89c4ebcdfd9ddf78d391f77e858b44aef18469373d

SHA512
587c8e09a4d3c5f8fbf37e7c4668252571bb02a0f8ac6aa25972f8df304081c0b6c075f592b6b682a375cb87fdbfd49136e36a767d2a1cde304161583f76be39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_CB82BC2C75DF72174C4F73769525F288

Filesize
472B

MD5
d223af7eaee0a915b3ae0d4d89cbf0fd

SHA1
49ea78caedfa17eb5da930b17c466b7bbda5428b

SHA256
78e2e4503cf1664214210314340e48230d9053e61d5bfbf3ab8bc0963f4251dc

SHA512
4e6529e969bc2ec34a3b986af6adcb5726220b4d6c2c4d29df275dcec8fdc8145229e2d332c8d33808706e7f6886ae4043c369f6faa1bb48f3b98e91574b7097

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_FB33DE4BE9BB439EA06A0D7200BF0991

Filesize
471B

MD5
03fc468285706210a3ce339d5a223c61

SHA1
fd32b7fa20b5c53cc2aebc09a3defe4c890f61be

SHA256
9401d1803a9bac1dd2297405f8cf32dffdc375912ccc1c7bcf884f59a0ed64ab

SHA512
5112c2d7b87326b9b1b1fb50933b36805cfaeeedc0a53324f73d846e7a32fd38565554ca3fbdefad624dc06b8c98d33195c4575a76f5f29178ef10fdde542c7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
73681cd446334371ecd8839f0b72fd05

SHA1
457ce3fde7fc0cb7597f0cf83432f543ca94cf38

SHA256
81306fb0d9a7527e4ec0147eebb4c8aa5e90c2fbf19e243237d19dfbfedf6d72

SHA512
1b064a6d184b588181c1bb1f1c573094e0a435335b3c35c2bc46a2dcd93efae3729e63358db769048c5c42ee33f3790d9fc01082507bd5be62fbf0f812bdc569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
5f49b65bdc1713b58ed97d0e9625a968

SHA1
84b74e55478c9abb163aa6629e3fd3b91bed4806

SHA256
a681ab9abc281fd12a7bd06f56e36a21e8ee28b5294815c5e07b781e324a32f9

SHA512
4b502288bef324db8ad33e63c7b6f242ef7954a6fbec3ed012530044c82fee3ad1158febe088bc0deea67ac35646a0a1bd6d961c0f67b11fee584e4f1abd753a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273

Filesize
279B

MD5
8c4f1dfee587d208913516784f6b6fe7

SHA1
d30d5b3ca6d0f37b0cfc0f8116dfcdf000be8a89

SHA256
abdeb231f49ba83b8d9e19092f2b8e8a0f60b6091d15426e7bf24782fc4ff1b6

SHA512
d5546cb9794e77af175dc7d1c74945c86d59bb5f04e02e56f70644702daea672fd6823acb41fc9417cf203959e49193c7080eed7c2b7d20255957a0d35e160dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
be2b5211e42eb9225d21358e7eb3f78f

SHA1
35b1ab3adde0a5f3cad8862897f1ea7a86946349

SHA256
3185aa19aba785efc822b72e3f2959e07343c1935f8f2b46a4438060763c9111

SHA512
9b20c8dceb160aad20de302c2589b86fae64f7842b370812fd8baba3e8154a357c0a1c282ea95fbc5406ab093593637929edaf83c42e19c7b6a011d286b06b6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
471B

MD5
77e9f2cf4e0dc3e404c9525ef9e98c43

SHA1
62bd8b034fd648126d1c917c63d30434dcdce9cc

SHA256
9cc73c0406f499888080c05e46b699d1dd5ff766086b2c964fcca31a95706c6a

SHA512
6c39c55d899c866a6a37176a5effb94288f862f3a0c2da88dfb7f9b577e9c604e90328b875afae469b8f8ff125aa0f9baf8244a0ca103137a78675fe2646348a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C67047FE238D580B731A13BEA5F7481F

Filesize
472B

MD5
348f6c5d513404b3c3c6c27f3de2dfdf

SHA1
acb18df838bf8ddb2667e944a82b2930bdecfad8

SHA256
a46606d9bc72c7330fff6849e1caa6c773c79d66236549408380362d28d892a1

SHA512
79dd389bc9a05312290bf69386faa56fd5a6515a0efd7685249831732f6a7c948ac41f288e038a65929e1b56f8fc615db12b7d3955a5e3279ebc8895fd150cab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_44E069599D24051E9C07CC3CFB965219

Filesize
472B

MD5
ae01ed64a4f624e20c6f7291553e8f41

SHA1
19f849a7a44c682ada07677aceac26edea5c3903

SHA256
f4b572a7585e69b63b520c624067c769ddc108f4b8503554b9f8046c00849dc9

SHA512
cddf97c8d51376fab713d46f048cfea7def965ce76117f1a7823c1c4a084b38f8d10c9b23cf570d92451189a172db34a95b3b1fec8e46667ae03e12ca8ba83cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_450FB595A2B94F541FA38043D90DDD68

Filesize
472B

MD5
d6dbaa7f1a697305cfaabdc859cdb9d3

SHA1
680fa363852fb33b9b76b83d3ba5c0a4c51499cb

SHA256
2ccc20d4d484d91da7e9fb07056d62a620af07b21f495be49f54e7e83c988dda

SHA512
4f95e5dba01b079a79cca956788cf8f5fe20d888a45bb1d397aa6d4eb034fa86486f4e13a73282604f886c1d8ce0436389eba775eb3694768a01acc49a48abef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_98ED45D3A33C2E5FBC678A586886D565

Filesize
472B

MD5
01b86e1c090d19b9ce7317c718aec85d

SHA1
e7c242db9e5a264137a11f669b063f46532a6601

SHA256
19dade05679f4dfaa869338c8362d2067db50626553b255bb6660edd1a38b0ee

SHA512
8e467d989a737d8de18344e8fb7c1232bb3e38bf94bd9d8d799a9be466fc9debdcb0039f6fdc4cd52a581286ccb6af6b742e5338ec9b0701642202ad52e4d85e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_3B0C6F9A5FE4CC35B9E0194525154B89

Filesize
471B

MD5
96791bd486db22c41012d25318835bdf

SHA1
b32c813f16b84a6b2660bd527843da5e368af8eb

SHA256
61a4589c35910af9f8d20ff0c7eca296a77a336ab00730573fe9ce7cf2cc72c5

SHA512
2f5a304602a160dcacbb945fb48b3534093990abe596fbc230f1b4d5f078e485edccbe671b421fb27ceab7da72cfab3ac6344be06bfa8fa0cb5e769fcd35f1a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_543B7BD726970BD166CFFC3B32EE7089

Filesize
472B

MD5
3549d49ec9ef3b66f2f3da1f6172ef93

SHA1
54fa67ac88099ed2d4cdf7e24c8b301c7a098d0b

SHA256
0af6a29f343dcbc612e18ab821ae8555975e27c363d72205366a3c5bb85b7211

SHA512
d67b2a53fcf432166bf06f82312bb71dc15ffec8581028b24265f2b5b6c538c62b4dbe76c79ac0d6e8d8fe77c439537d518b9cb3039d7b52c7aaf5db1ea73883

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
2a8966a1ccf77f329628fc808554e1f3

SHA1
c3b8ee477287a6f842a4eb2491a1678c2deec7e0

SHA256
e38b77cdbf373548abf25b3f2fd5713b78f69d7b65ba9a930270cf56fb61a7ae

SHA512
46eb809864a12736b23ca323a93327e7ed8b3089cddb3b935b334a0ad49949835115efa8834e4bd2e590593adb0217a545ecbb110abe65c4df904f3841fc54b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
6b83cbed3e0d8057d04b26212ac02bd3

SHA1
439590fad25b90b27a4be83c2de455a39cb46fa9

SHA256
6323ca42f68d5aa1419d9f51637341804307a24c97137e2fab4b44a7d919a2d8

SHA512
1f8228d46a1fbcefb201256cf9e6096a40e9f2710e8978dbd6ee9ff71309222f8b572047aa5687398a7b571e9da1ee3d89ebc07633692d9d1371a61ca4c8ddf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_27BC849116B1211B0541CD891C1E1E33

Filesize
410B

MD5
dd55a0be0f2f6d478162d50277a02f58

SHA1
602858309fb33d10b51bccaf72e496ce84458394

SHA256
f48160eb1b86387920f0d712e332081a412b459f36cf7ba961fa00040806323d

SHA512
45f890715f4410de8593c7b0e2e19a0994f2ace8f9f74cde0f58e6a60dea9b152cf9a9ac21566798b122b5315e1d8041c054fbb763abd6b09fe03b655a9eea03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_5C3F4CB4665DCF2109A8C91DBA78E447

Filesize
410B

MD5
89541aa2ee446450d729ff94fc59b540

SHA1
d77e5b429b308b6451556d161569e4d46510baa9

SHA256
a93411cdf8359f87fe99c3973c0e8b0229219e563c1597fb2ffc1b2c26cc47dc

SHA512
d14d87a112691d675a15840141b082a087d2226cc9993f6207b17f1f40e66dfa7fdfcc94353996719a5cedbd5a46beb90edd2a3de054f3402230b73d3df732ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_CB82BC2C75DF72174C4F73769525F288

Filesize
406B

MD5
b66fb0b8e7dd27906e360cb2a0f6ec5b

SHA1
7750a3e25aa7f7b5dac6e545bc31e540abcbc7e2

SHA256
f98c451c5d39aa1cb0282fc658be7f2f3a733165fe9d7a5e504f103f1a204d5f

SHA512
26feedb8128cb98128f5fc994beee86462686812552adb54a1ab9bca9454e95ba95b3e1e74e7d16f66823c57fd870cecffec243a39731ea8cb24d8a87ef45424

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_FB33DE4BE9BB439EA06A0D7200BF0991

Filesize
410B

MD5
f3db52a9d2f6206937c589909184f762

SHA1
435246e5bd5d0304bb2a09e88f5c95495c632d02

SHA256
3f2be125c20936f283a693c7c642ff754aa69dec44c55bdb8d47aa403441af68

SHA512
c093df5e9074cf06c4463202bb59d81cdd8aa4eb2f4a6a576795786d55c08797aa435cb5993cb536006729a44df3ae51b9ec4cfc66679d10f6cdedde6a5fc3d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
438B

MD5
c08aa3f47d389f825cca5ec3830b024b

SHA1
35e7ad38c73e0cac3b1bdeae5bba60a11f03b482

SHA256
a5b17675f8208bbca6da233660b079f38738b1e4d885d8d93d34b341472cf8b2

SHA512
ecf3b4815be2a8843cc2175aeea1c2f3674a35cbb56c054dcf65e8afde1e5100d168f47d3c5f62e5414e1446970b7dfaff123bf8143759a010029c99f178ff62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
bdc24f0d0f2a64132ac96b01ede38417

SHA1
9d7b2b0c0bb90c711d5e58653e13c341908ecf4b

SHA256
a46ee08d7c891ce3ab5fcb56b779bfd01c496aa179fb9f42552cee652010549d

SHA512
df9c23888cc142c1525522e45b152e390e1b9f0a41c66cdd4f4c43858022f20ef5a3d7a1663ee1ed1b89600b126759f140c82866c1438c6c055b3c8aecf0e979

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273

Filesize
426B

MD5
4394ffbddaeeb1f20c30088bb65942bc

SHA1
c00d8fc988543eba12e0da9504d5c4c4afb5ba57

SHA256
1ebd299ee71e43369335513839525ec57a950d98f96343702289192227a3ef2b

SHA512
bf90a3aa00e47225828977133cf9fbaccee8d4fb54bdcf06388a6fa738050bb0c3a3001e139131d30958e8037a48d4df42209606b361969806f8ec10f467933c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
ce2d31fbb9ce47642b4ad47d563580d4

SHA1
6e3b632d4766cc255a38fab163eda1039dbb9ec0

SHA256
dfcba62362a5fc8224e729e7cc962269f4104e5ac939a3287fa7ea0e4f8f403c

SHA512
c75831810e9afe227c5c1a9991b8a7eaedf5b229254b6e4ef7aa210354098eb14871a8e7604fc81cfb0ecea6bafc96b8dff10a0bf98ac0dcce948053deb8c1ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
434B

MD5
12b896d9a717320ce86db6a6c089ee1f

SHA1
a90be8833e4349ebd4f19a2ea531ce369a50b1ba

SHA256
de162e23b643d0f1263463de5ee18e26969db045555c2bd0640222d4e58cbb28

SHA512
cbada2b153b78e6dcdf2c77f36e8724e786f6c1234faf47a86683dd497bc61f183709d12d85c858ea41ad89e2a1a074c96caecdb11f212104d1f19db8574c71b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C67047FE238D580B731A13BEA5F7481F

Filesize
480B

MD5
53fe55e2dab0470d189f6a44fe496f19

SHA1
33b8eb1973e67365980ada4bd25d74f45279965b

SHA256
0860e4121c9437581d602371f35c97af213e1e860cb3c213155c3a2ed6356df7

SHA512
307d5be98ae6d8d79a189e5005ee690e29117e74da57a048104e6bf1c6dfcaf54c229a2bcf91a092b9d867718db36d3dfe8eac15b644e3f70d5a8582ada4de72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
0964e7ddce19caab58a7bfd5d8df87be

SHA1
3d58e03d1aca09714e05b9f4ea1c48064ca21b9a

SHA256
65efeef57b977a8c8ffbd5c616b2982af1a4a3aff23923f792d9501e39cdafba

SHA512
9e78dcb5722f3b8c41a57f52847c11de1f079bc466d246f2e9290652fbf9a1499839cfb47e8945439ab1551c3fbe404ed3680219949d305c1f8c73005a1fb90c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_44E069599D24051E9C07CC3CFB965219

Filesize
402B

MD5
3f0939df9921acabc60e0abdd9d72d54

SHA1
340cd2b4d401eae46f81e7bd5421e60590cb10cb

SHA256
fc642725691b47dc645f9f238239d6fa9a0f2ad266d38ebaf4530abbb7937b9c

SHA512
ab2b2422c27b86b70ab76a5d20baab7f711770f27c051ad40d6d389f658e8519f646c101235f3db9ebf97eacd21209e6445b45b6995624e9fd0586f098dabefe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_450FB595A2B94F541FA38043D90DDD68

Filesize
406B

MD5
862f7f81e71937302fea1be5441a525c

SHA1
9e9e1b785de0b41276676ae4242a1ed4b65eae43

SHA256
1b4aba690e6909f25659267f08247c46a3e0509dfb13329fa89882783f3d7374

SHA512
5e8a057069af27f40b4d00a0acc98489d9f12ef74c6da0d5b6df220c932b34ebe4afc2f5eed5d80f0f2f2b815a1a0cb9281afb9e335773d4f600598304f67b76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_98ED45D3A33C2E5FBC678A586886D565

Filesize
402B

MD5
4a5536b7e9dc480c013ae44cb918a844

SHA1
71e53d604009be8d6932af1bff36a4e6c6a42a02

SHA256
a2b9fb2ecb68d3d213e507d39da0c88f57dce2eb4229066d0fa2c519ea180594

SHA512
3b73f95c6b3a4bd6256ec671fd5af6ab73ec9fad92fd0489315bba3c4df39a96d4d51899fa6dd20e173296ff58bf88778708ec1fd249d30b45655327d8a6fe8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_3B0C6F9A5FE4CC35B9E0194525154B89

Filesize
406B

MD5
839135ad5612d1c6c65185907dc0e0f9

SHA1
5b898bdf165f0525ecf81f1fd40d77f85d6b0670

SHA256
0b972d4d9b29637c2bebac688cfb559dd27f866f98bd5e8a04605749bf8d361d

SHA512
d87d493f1957116d8e97e60c3c9aee21032c96e7150e791e4ebcb0d92ff0618088769c3877660d6617ebcc4563d4d1a10b20e60254569f7fee388d0f965cec57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_543B7BD726970BD166CFFC3B32EE7089

Filesize
402B

MD5
02f72d948515abc9f72406e95452b91b

SHA1
be38f286a6b1eb5a21113d84e8f0b082c0e00565

SHA256
4b701051637ee5dbbb87841fea48df22e70e43a4f00a12aef56fe4cd271a6744

SHA512
f3869d48f6b54c9f5ad0b0af7d761bb236ae58c5d25c824abe8eae3d095dacc0a6ba5dee1c8eec321c29b0b2e3cb901e403e5d96213d1e37c96a8d784dd6b4c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_DE1DF77498CBF96ADA4731798755FDC2

Filesize
410B

MD5
80f09cba4aaa99bb0ba599501b6ff413

SHA1
3721b6f7f6e38171c04a740cf675d6b900ed2342

SHA256
13d185ca8b2374ad7049298ad48e96eb3fb667d02860b5ffc40f68c85f51fc10

SHA512
5722c5fda3156cb239637bbb9e4ef005edec15d2a7e3887ef606a053cdb02deeb0ef6a380852d984439d3003e07a9b7001791c3d0ceb891c92048a5f1f98245e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\817BPCFW\www.youtube[1].xml

Filesize
13KB

MD5
3b5479975a54669deaf04018babf09a2

SHA1
a7500fbbdcd6d7696cfe7aaad76a5ec7d19e30bc

SHA256
56d97f4ec938102bed0e6242bd5e242d9f40601222e6867d3db350ebf4ba993b

SHA512
7b3c69eb102956132ebc355eec8619962085c284f3177acd68274c06448b40344c9581dff16cf54fe76552d9667ac831190b012f5df7a64a929eb3731cef0e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\ASCOKZBD\www.hugedomains[1].xml

Filesize
145B

MD5
9ddc12dd437232eed31a213839a97b6d

SHA1
93376ccddcdfa3345df98490b992f47041c4f8ec

SHA256
f4a8da53d0727f4cb8230b0b6f69d35ecf3c0e8ac3bfa6b15b0574fbef331ca5

SHA512
66d6d2b875ecffd218e2e54f9c3be767c4704e65fecab195984a0bef1aa5a9d8bd2a9b61c3c2015f0a25f514285a691750af24d3082401587cabcc9c9e43d0e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\ASCOKZBD\www.hugedomains[1].xml

Filesize
116B

MD5
b746ca4a8cdc5d5e56aa7eeed230d832

SHA1
8f47552468fd2265e37efcb19bf96bc2eb702292

SHA256
6fc60c07684bce281b98680fb5e1fa0fae0e08e8a6237e341ad7be0a4ca1408b

SHA512
8ba8a28a35d96c88628c21d96efca7a2cd0ae18014934fe021c6f3085379a88e1eb79ce5d1052571f1999d94205adb37bb69ec8212b5b3f33c90dcc55e5837c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\ASCOKZBD\www.hugedomains[1].xml

Filesize
116B

MD5
b746ca4a8cdc5d5e56aa7eeed230d832

SHA1
8f47552468fd2265e37efcb19bf96bc2eb702292

SHA256
6fc60c07684bce281b98680fb5e1fa0fae0e08e8a6237e341ad7be0a4ca1408b

SHA512
8ba8a28a35d96c88628c21d96efca7a2cd0ae18014934fe021c6f3085379a88e1eb79ce5d1052571f1999d94205adb37bb69ec8212b5b3f33c90dcc55e5837c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\JP3RTTBQ\www.google[1].xml

Filesize
99B

MD5
6bf4ef27b1fdbcd4f0b8f73334b58f91

SHA1
7ccfca736d7935a52832fb86dbc462bab3f0e35a

SHA256
6a00c91b7541cb036d7b5438276edb7ed1e1d4f2518d2d1f88b3bd6edb2ba778

SHA512
c2fa97e4c500b18028884d6253820db6c8313e23061b52b0084b305a5973a30254681655da7eef9ca47811423b5dca1d95c767a5cda4b894d7bda8e1e957880c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xml

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8YLPV06K\invisible[1].js

Filesize
34KB

MD5
69126f6a136d87cfec65a275fd9b628e

SHA1
b8b25d9e4ff6143f1df9b9e1f1cdf60cf298aac4

SHA256
64a16022a605f8c2b8e2d6e1c63f052fe11ae6f1cc12305f5ee6afc1b9e633e1

SHA512
7f6629dcde133201889aa74d1a5e4308947ca05caccca7bfd2e406e033b3faf5bf37fdd3980ed34faf29e21b772c6d4b8ef84010fde7dafb0a19b294ae8a34bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8YLPV06K\jquery.min[1].js

Filesize
84KB

MD5
c9f5aeeca3ad37bf2aa006139b935f0a

SHA1
1055018c28ab41087ef9ccefe411606893dabea2

SHA256
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

SHA512
dcff2b5c2b8625d3593a7531ff4ddcd633939cc9f7acfeb79c18a9e6038fdaa99487960075502f159d44f902d965b0b5aed32b41bfa66a1dc07d85b5d5152b58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8YLPV06K\o-0NIpQlx3QUlC5A4PNjXhFVZNyH[1].woff

Filesize
15KB

MD5
8b4d99e44a4941049ba8745dac9a02b9

SHA1
4a8f19832a2ebdf5fe6d908548131629bac0a3c2

SHA256
2f78f2a61dff8a8178f50fae71a82d32bf9b33602300f1f495bbd547ddc5939a

SHA512
a5e1a9f6250f647b3caf0a63b176692a2f8067093ca76c39e9c9810ce8aac12847a0132df44e4c346f3d69b5aeb653afd5bce399aac13fdfaf5523d400a7b3f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8YLPV06K\phone-icon[1].png

Filesize
743B

MD5
bd361461dbc83db995e644e42e59dca9

SHA1
7d3d5350646382e10d1fd84a3489d2eec7f1c651

SHA256
4e5d6e60573346e0eb3e8368ca629af38d0d59f4e51f750724e7f95f8be5917e

SHA512
8b09cd2f95cd9e50a04aca3a57942e565556cefd65d6c903321a45bf4d746f48ca3e0785f2330483a0ed52437631d9bb086e958368c3da44b4bcf3314bfd0f5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8YLPV06K\styles__ltr[1].css

Filesize
51KB

MD5
3624830e05cb492b2f52e5c009a1b51e

SHA1
a67945758aa3fd598caaba5b232be2a9c488c4e6

SHA256
4a59bb42cb945084820cd1eb370a22a68fa9451b9e57abb1daada408d2ff64e1

SHA512
ed0c2bab359f5ffa2c81969e1167f2e5dcf26964af7bf59913783bcbdeb3c4b73054978db6e0e21141dcc93171ded1899a40d28bbad3cee08321107b3c1b4a80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\94PW68LC\domain_profile[1].htm

Filesize
7KB

MD5
4d102a757e40e093ad742391606954e5

SHA1
936db8f97b132a5a93bad646eb9b8097f02e016e

SHA256
086e3da7609fca3392b57bec59c4583830dd900af25a9c50a6d7734e93d76b0b

SHA512
25b9506f8b698be48029c50427a847d7732f866aad74ba1bc343f1f580f1bd9ea5fc8ac5a684413f09920bf03c011a337020d9fae9d7c13613d2ec841b0fc212

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\94PW68LC\o-0IIpQlx3QUlC5A4PNr5TRG[1].woff

Filesize
16KB

MD5
79db7338c58d45690d0c52191565f282

SHA1
be752feda754b6a064fa01c7345d42c731937975

SHA256
2c97a299469742468c68766ff4cc4756329adf6e1849f040e0e0ca69c94bf84f

SHA512
17b1752b8b8cd08c603ce0b31dd9f7a4896c43ba179a982a2ca55954e711e429fee919a0ac24852ae64efc375568f7ed8f89110ba473f9f3661b41e723edcdcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\94PW68LC\reboot.min[1].css

Filesize
3KB

MD5
220e4dc01283a9e9c5c146f984eb8934

SHA1
990f408175caef6b397c247f3aa614692211c5b4

SHA256
740458b82de9774c1affb4781e4b7fb11db37cb1c281b9d5010dac3f084d7b40

SHA512
094deb9ec05b7c0be1ca0130ad5118482888ac9061d293c751a0dc9919b36711e536306540c47e44ec152d6c23c3395fc08962472a1d5cf5fb321ca02408a683

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MWIURFX4\analytics[1].js

Filesize
49KB

MD5
fda30e8a22c9bcd954fd8d0fadd0e77c

SHA1
ae47cd34cbde081a48d7f92fc80aaf06a1381193

SHA256
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

SHA512
bf551c26ecbdbca8d8be0bc05aede18db415318a8143226e03311e235b7d8d497d6e08d73417926c878d253ad38f0dfc11571df2700500d02e68596b903309ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MWIURFX4\css[1].css

Filesize
416B

MD5
f7864e2a2a7d53417a589ce5a6abf257

SHA1
a4c9534e3d07b53b51d5e4ebee3974cc718f857d

SHA256
87a6fb17dd49a08690a2e56d7089a9091ca23c501000c0826298d9dae7a863f3

SHA512
dd53378a595c04dfb4ecc0203a9b3e4b776ef4df68329ea6c075907e28010ca670f1d643c37eb0f0ba7ab91455f5f9e7a61b91a1127e7d8cdcc4dcd4c002395a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MWIURFX4\logo_48[1].png

Filesize
2KB

MD5
ef9941290c50cd3866e2ba6b793f010d

SHA1
4736508c795667dcea21f8d864233031223b7832

SHA256
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

SHA512
a0c69c70117c5713caf8b12f3b6e8bbb9cdaf72768e5db9db5831a3c37541b87613c6b020dd2f9b8760064a8c7337f175e7234bfe776eee5e3588dc5662419d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TQFWGWHN\ad_status[1].js

Filesize
29B

MD5
1fa71744db23d0f8df9cce6719defcb7

SHA1
e4be9b7136697942a036f97cf26ebaf703ad2067

SHA256
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

SHA512
17fa262901b608368eb4b70910da67e1f11b9cfb2c9dc81844f55bee1db3ec11f704d81ab20f2dda973378f9c0df56eaad8111f34b92e4161a4d194ba902f82f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TQFWGWHN\d[1]

Filesize
23KB

MD5
ef76c804c0bc0cb9a96e9b3200b50da5

SHA1
efadb4f24bc5ba2d66c9bf4d76ef71b1b0fde954

SHA256
30024e76936a08c73e918f80e327fff82ee1bd1a25f31f9fce88b4b4d546055d

SHA512
735b6470e4639e2d13d6b8247e948dbd6082650902a9441b439ceacc4dfce12cd6c9840ee4c4dcb8a8f1e22adb80968f63ace0c0051811a8d6d1afb2b3c68d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TQFWGWHN\jquery.fancybox.min[1].css

Filesize
12KB

MD5
a2d42584292f64c5827e8b67b1b38726

SHA1
1be9b79be02a1cfc5d96c4a5e0feb8f472babd95

SHA256
5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0

SHA512
1fd8eb6628a8a5476c2e983de00df7dc47ee9a0501a4ef4c75bc52b5d7884e8f8a10831a35f1cdbf0ca38c325bf8444f6914ba0e9c9194a6ef3d46ac348b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TQFWGWHN\js[1].js

Filesize
108KB

MD5
5d4c724924b4e9a46bf2525f986db1f1

SHA1
dcbd87d13fa413866a1ada51b4eb3c0d400a864a

SHA256
ea1a3146d5c59a36d5f98e5d605d879aeafcdf25c7b06c3f2e07df4cd648b5a7

SHA512
af017b7475bb9c0e22896c6710d1260857831f34ba877f8f060229d3ce2d420f4ed26a54c8c247e7beb59eb6ae9ad424ec58c62098191fe7aed59e8345c9a709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TQFWGWHN\p[1].css

Filesize
5B

MD5
83d24d4b43cc7eef2b61e66c95f3d158

SHA1
f0cafc285ee23bb6c28c5166f305493c4331c84d

SHA256
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

SHA512
e6e84563d3a55767f8e5f36c4e217a0768120d6e15ce4d01aa63d36af7ec8d20b600ce96dcc56de91ec7e55e83a8267baddd68b61447069b82abdb2e92c6acb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TQFWGWHN\recaptcha__en[1].js

Filesize
397KB

MD5
35e20d99f31d725cd04ae5c18176a4cb

SHA1
5388866755fc16c244bebd58fdc732a7035e0818

SHA256
ac5e804e070b663bb35d913da74cb9d61aa24caa2135d0578f6b1b433b975761

SHA512
1ea529d37729010711c528d195d24c7b1a619a50cf1c17c8926813fffb74549a64d20b18ea4390cd3a34fabf12baaa8c75daee28f7d3c93f69249ee80e43deae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TQFWGWHN\zyw6mds[1].css

Filesize
1KB

MD5
9da2b20534822547ab99086173be8d5b

SHA1
05f729ccc7ed1b283a4996a95dc60b3b83d9fea0

SHA256
11b275304b1ae874dd2e20e2cb779e798a5a665728b15e0f9af120729bf2e214

SHA512
5ba9c0c0b44bb7fc5765cff051cc3d5b5d42e1ebef6a0bbb7f279d42b10850b26ea96b02c25eb13fe27943e8550ccff842db8bbf9090a947e26680056815a186

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
711KB

MD5
0f0b1422b55031e15a0006933c97a64c

SHA1
3a2f7d57f97f52d647a2073984bd117f90edcb52

SHA256
4eb21992a6e6e0fcee433409f12c6203c69fac4e3b23c080b94faa1e7ba715b9

SHA512
98f14907091f314c14efd005efa1d02afad8cbe120364f7823ba4a994fea4617921174fdd92641f91078b372a5ede0511e49b1c2d4b7c19740a0715cabf482b2

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
711KB

MD5
0f0b1422b55031e15a0006933c97a64c

SHA1
3a2f7d57f97f52d647a2073984bd117f90edcb52

SHA256
4eb21992a6e6e0fcee433409f12c6203c69fac4e3b23c080b94faa1e7ba715b9

SHA512
98f14907091f314c14efd005efa1d02afad8cbe120364f7823ba4a994fea4617921174fdd92641f91078b372a5ede0511e49b1c2d4b7c19740a0715cabf482b2

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
711KB

MD5
0f0b1422b55031e15a0006933c97a64c

SHA1
3a2f7d57f97f52d647a2073984bd117f90edcb52

SHA256
4eb21992a6e6e0fcee433409f12c6203c69fac4e3b23c080b94faa1e7ba715b9

SHA512
98f14907091f314c14efd005efa1d02afad8cbe120364f7823ba4a994fea4617921174fdd92641f91078b372a5ede0511e49b1c2d4b7c19740a0715cabf482b2

Download Submit
memory/1260-147-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1260-146-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1260-156-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1260-143-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1260-158-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2328-132-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2328-141-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4592-140-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4592-157-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download