isrstealer | bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

Analysis

max time kernel
129s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 23:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b.exe
Size

352KB
MD5

c8c6cdeaea4f3940144b5e2fb282f234
SHA1

37afce95c7db06c3d13c80a826bcf53be566f030
SHA256

bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b
SHA512

54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5
SSDEEP

6144:gAsItRdQwMQvw0TLtSv1zzM69R27oQ+O15i+S+BsA9vOD/3xHRJ:gNI/+wNltSb9R28QH15J/m73xxJ

Score

10^/10

isrstealer persistence stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 30 IoCs

resource	yara_rule
behavioral2/memory/4532-137-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/4532-139-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/4532-141-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/4520-149-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/4544-157-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/3916-165-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/3516-172-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/2564-180-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/4368-187-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/2708-195-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/2920-202-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/4332-209-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/1288-216-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/4392-224-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/1964-231-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/2144-238-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/1008-245-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/4412-252-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/4480-259-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/3192-266-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/3040-273-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/3800-280-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/1132-287-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/3536-294-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/3756-301-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/3780-308-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/2604-316-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/2520-323-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/5008-330-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/4820-337-0x0000000000401180-mapping.dmp	family_isrstealer

Executes dropped EXE 35 IoCs

pid	Process
724	winlogon.exe
4532	winlogon.exe
4512	winlogon.exe
4520	winlogon.exe
4544	winlogon.exe
4708	winlogon.exe
3916	winlogon.exe
3516	winlogon.exe
2140	winlogon.exe
2564	winlogon.exe
4368	winlogon.exe
3968	winlogon.exe
2708	winlogon.exe
2920	winlogon.exe
4332	winlogon.exe
1288	winlogon.exe
4424	winlogon.exe
4392	winlogon.exe
1964	winlogon.exe
2144	winlogon.exe
1008	winlogon.exe
4412	winlogon.exe
4480	winlogon.exe
3192	winlogon.exe
3040	winlogon.exe
3800	winlogon.exe
1132	winlogon.exe
3536	winlogon.exe
3756	winlogon.exe
3780	winlogon.exe
3084	winlogon.exe
2604	winlogon.exe
2520	winlogon.exe
5008	winlogon.exe
4820	winlogon.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b.exe

Adds Run key to start application 2 TTPs 56 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe

Suspicious use of SetThreadContext 28 IoCs

description	pid	Process	procid_target
PID 724 set thread context of 4532	724	winlogon.exe	84
PID 4532 set thread context of 4520	4532	winlogon.exe	88
PID 4520 set thread context of 4544	4520	winlogon.exe	89
PID 4544 set thread context of 3916	4544	winlogon.exe	91
PID 3916 set thread context of 3516	3916	winlogon.exe	92
PID 3516 set thread context of 2564	3516	winlogon.exe	93
PID 2564 set thread context of 4368	2564	winlogon.exe	95
PID 4368 set thread context of 2708	4368	winlogon.exe	96
PID 2708 set thread context of 2920	2708	winlogon.exe	98
PID 2920 set thread context of 4332	2920	winlogon.exe	99
PID 4332 set thread context of 1288	4332	winlogon.exe	100
PID 1288 set thread context of 4392	1288	winlogon.exe	102
PID 4392 set thread context of 1964	4392	winlogon.exe	103
PID 1964 set thread context of 2144	1964	winlogon.exe	104
PID 2144 set thread context of 1008	2144	winlogon.exe	105
PID 1008 set thread context of 4412	1008	winlogon.exe	106
PID 4412 set thread context of 4480	4412	winlogon.exe	107
PID 4480 set thread context of 3192	4480	winlogon.exe	108
PID 3192 set thread context of 3040	3192	winlogon.exe	109
PID 3040 set thread context of 3800	3040	winlogon.exe	110
PID 3800 set thread context of 1132	3800	winlogon.exe	111
PID 1132 set thread context of 3536	1132	winlogon.exe	112
PID 3536 set thread context of 3756	3536	winlogon.exe	113
PID 3756 set thread context of 3780	3756	winlogon.exe	114
PID 3780 set thread context of 2604	3780	winlogon.exe	116
PID 2604 set thread context of 2520	2604	winlogon.exe	117
PID 2520 set thread context of 5008	2520	winlogon.exe	118
PID 5008 set thread context of 4820	5008	winlogon.exe	119

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3296	4820	WerFault.exe	119

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4820	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 724	4644	bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b.exe	83
PID 4644 wrote to memory of 724	4644	bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b.exe	83
PID 724 wrote to memory of 4532	724	winlogon.exe	84
PID 724 wrote to memory of 4532	724	winlogon.exe	84
PID 724 wrote to memory of 4532	724	winlogon.exe	84
PID 724 wrote to memory of 4532	724	winlogon.exe	84
PID 724 wrote to memory of 4532	724	winlogon.exe	84
PID 724 wrote to memory of 4532	724	winlogon.exe	84
PID 4532 wrote to memory of 4512	4532	winlogon.exe	87
PID 4532 wrote to memory of 4512	4532	winlogon.exe	87
PID 4532 wrote to memory of 4520	4532	winlogon.exe	88
PID 4532 wrote to memory of 4520	4532	winlogon.exe	88
PID 4532 wrote to memory of 4520	4532	winlogon.exe	88
PID 4532 wrote to memory of 4520	4532	winlogon.exe	88
PID 4532 wrote to memory of 4520	4532	winlogon.exe	88
PID 4532 wrote to memory of 4520	4532	winlogon.exe	88
PID 4520 wrote to memory of 4544	4520	winlogon.exe	89
PID 4520 wrote to memory of 4544	4520	winlogon.exe	89
PID 4520 wrote to memory of 4544	4520	winlogon.exe	89
PID 4520 wrote to memory of 4544	4520	winlogon.exe	89
PID 4520 wrote to memory of 4544	4520	winlogon.exe	89
PID 4520 wrote to memory of 4544	4520	winlogon.exe	89
PID 4544 wrote to memory of 4708	4544	winlogon.exe	90
PID 4544 wrote to memory of 4708	4544	winlogon.exe	90
PID 4544 wrote to memory of 3916	4544	winlogon.exe	91
PID 4544 wrote to memory of 3916	4544	winlogon.exe	91
PID 4544 wrote to memory of 3916	4544	winlogon.exe	91
PID 4544 wrote to memory of 3916	4544	winlogon.exe	91
PID 4544 wrote to memory of 3916	4544	winlogon.exe	91
PID 4544 wrote to memory of 3916	4544	winlogon.exe	91
PID 3916 wrote to memory of 3516	3916	winlogon.exe	92
PID 3916 wrote to memory of 3516	3916	winlogon.exe	92
PID 3916 wrote to memory of 3516	3916	winlogon.exe	92
PID 3916 wrote to memory of 3516	3916	winlogon.exe	92
PID 3916 wrote to memory of 3516	3916	winlogon.exe	92
PID 3916 wrote to memory of 3516	3916	winlogon.exe	92
PID 3516 wrote to memory of 2140	3516	winlogon.exe	94
PID 3516 wrote to memory of 2140	3516	winlogon.exe	94
PID 3516 wrote to memory of 2564	3516	winlogon.exe	93
PID 3516 wrote to memory of 2564	3516	winlogon.exe	93
PID 3516 wrote to memory of 2564	3516	winlogon.exe	93
PID 3516 wrote to memory of 2564	3516	winlogon.exe	93
PID 3516 wrote to memory of 2564	3516	winlogon.exe	93
PID 3516 wrote to memory of 2564	3516	winlogon.exe	93
PID 2564 wrote to memory of 4368	2564	winlogon.exe	95
PID 2564 wrote to memory of 4368	2564	winlogon.exe	95
PID 2564 wrote to memory of 4368	2564	winlogon.exe	95
PID 2564 wrote to memory of 4368	2564	winlogon.exe	95
PID 2564 wrote to memory of 4368	2564	winlogon.exe	95
PID 2564 wrote to memory of 4368	2564	winlogon.exe	95
PID 4368 wrote to memory of 3968	4368	winlogon.exe	97
PID 4368 wrote to memory of 3968	4368	winlogon.exe	97
PID 4368 wrote to memory of 2708	4368	winlogon.exe	96
PID 4368 wrote to memory of 2708	4368	winlogon.exe	96
PID 4368 wrote to memory of 2708	4368	winlogon.exe	96
PID 4368 wrote to memory of 2708	4368	winlogon.exe	96
PID 4368 wrote to memory of 2708	4368	winlogon.exe	96
PID 4368 wrote to memory of 2708	4368	winlogon.exe	96
PID 2708 wrote to memory of 2920	2708	winlogon.exe	98
PID 2708 wrote to memory of 2920	2708	winlogon.exe	98
PID 2708 wrote to memory of 2920	2708	winlogon.exe	98
PID 2708 wrote to memory of 2920	2708	winlogon.exe	98
PID 2708 wrote to memory of 2920	2708	winlogon.exe	98
PID 2708 wrote to memory of 2920	2708	winlogon.exe	98

C:\Users\Admin\AppData\Local\Temp\bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b.exe
"C:\Users\Admin\AppData\Local\Temp\bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
  "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:724
- - C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
    "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
      "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
      4⤵
      Executes dropped EXE
      PID:4512
  - - C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
      "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4520
    - - C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4544
      - C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        6⤵
        Executes dropped EXE
        
        PID:4708
      - C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3516
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2920
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:4332
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1288
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        14⤵
        Executes dropped EXE
        
        PID:4424
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        14⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:4392
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1964
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        16⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2144
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1008
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        18⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:4412
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:4480
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        20⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3192
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3040
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        22⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3800
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        23⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1132
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        24⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3536
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3756
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        26⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3780
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        27⤵
        Executes dropped EXE
        
        PID:3084
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        27⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2604
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        28⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2520
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        29⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:5008
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of UnmapMainImage
        
        PID:4820
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4820 -s 12
        31⤵
        Program crash
        
        PID:3296
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        10⤵
        Executes dropped EXE
        
        PID:3968
        
        C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        8⤵
        Executes dropped EXE
        
        PID:2140

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 4820 -ip 4820
1⤵
PID:32

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\winlogon.exe.log

Filesize
400B

MD5
439e141bc7a5ab7e1283bdc65dd112cf

SHA1
9b59a2c694e7abc97e408840bd77e7d1a4c01f33

SHA256
1cecfee344b4fc6b819aed73bd23339cc797acdf18c91c9b2e36f52bf046d573

SHA512
bcc040f0eacd5ffd58174c36c9e9da15941c08f30f883430de10668a729253bc87bcb5a6a3381b0e96e5d95bca9f1123d0a8cd92433b6f578e3c485af40f87be

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

Filesize
352KB

MD5
c8c6cdeaea4f3940144b5e2fb282f234

SHA1
37afce95c7db06c3d13c80a826bcf53be566f030

SHA256
bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

SHA512
54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

Download Submit
memory/724-136-0x00007FFF7F900000-0x00007FFF80336000-memory.dmp

Filesize
10.2MB

Download
memory/1288-218-0x00007FFF7F900000-0x00007FFF80336000-memory.dmp

Filesize
10.2MB

Download
memory/2564-182-0x00007FFF7F900000-0x00007FFF80336000-memory.dmp

Filesize
10.2MB

Download
memory/2708-197-0x00007FFF7F900000-0x00007FFF80336000-memory.dmp

Filesize
10.2MB

Download
memory/2920-204-0x00007FFF7F900000-0x00007FFF80336000-memory.dmp

Filesize
10.2MB

Download
memory/3516-174-0x00007FFF7F900000-0x00007FFF80336000-memory.dmp

Filesize
10.2MB

Download
memory/3916-167-0x00007FFF7F900000-0x00007FFF80336000-memory.dmp

Filesize
10.2MB

Download
memory/4332-211-0x00007FFF7F900000-0x00007FFF80336000-memory.dmp

Filesize
10.2MB

Download
memory/4368-189-0x00007FFF7F900000-0x00007FFF80336000-memory.dmp

Filesize
10.2MB

Download
memory/4392-226-0x00007FFF7F900000-0x00007FFF80336000-memory.dmp

Filesize
10.2MB

Download
memory/4520-152-0x00007FFF7F900000-0x00007FFF80336000-memory.dmp

Filesize
10.2MB

Download
memory/4532-143-0x00007FFF7F900000-0x00007FFF80336000-memory.dmp

Filesize
10.2MB

Download
memory/4532-139-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4532-137-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4544-159-0x00007FFF7F900000-0x00007FFF80336000-memory.dmp

Filesize
10.2MB

Download
memory/4644-132-0x00007FFF7F900000-0x00007FFF80336000-memory.dmp

Filesize
10.2MB

Download