672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe
Size

1.9MB
MD5

4600f3fefc27a218542df4a1f207b9e0
SHA1

14d425be26dec14c5738a046bbe2500683d4861b
SHA256

672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f
SHA512

bf94493894e5453002a5bda61c992610042f724337e2c50026e5cd621588860a509e2c08cf3f873ce784d9eb7071f4b5e58d4e9c4adcab7e73ca18aa1290d45b
SSDEEP

3072:1+kZqVeInSk82TfatZ9mD5fvNj6kECsjZ:1jaSk8iCtPmD5Hl6ysN

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion
Drops file in Drivers directory 1 IoCs

Processes:

winlogon.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts winlogon.exe
Executes dropped EXE 3 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exe

pid process

1172 winlogon.exe
1876 winlogon.exe
1160 winlogon.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

pid	process
1172	winlogon.exe
1876	winlogon.exe
1160	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sofi.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tracerpt.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fameh32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hacktracersetup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsgk32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nc2000.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccntmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcm.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonalm2601.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GenericRenosFix.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanh95.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firewall.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweep.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\earthagent.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nui.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qconsole.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswinntse.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlh.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fameh32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcscanpdsetup.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleToolbarInstaller_download_signed.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WerFault.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bisp.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppvstop.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netstat.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvsvc32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ACCICONS.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpfnt206.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpexec.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavproxy.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\platin.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexplorerv1.0.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectx.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmitfraudFix.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UCCLSID.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navsched.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fslaunch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fssm32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luinit.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpostinstall.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vfsetup.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ave32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwinnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Diskmon.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lockdown2000.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\periscope.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\titaninxp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbust.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zatutorzauinst.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpcmap.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfiadmin.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwtool16.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wrctrl.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\moolive.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwinntw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fprot.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jedi.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldpro.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjscan.exe	winlogon.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1312-56-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1312-58-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1312-59-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1312-62-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1312-63-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1312-64-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1312-75-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1876-88-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1160-89-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1160-93-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1160-94-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1160-98-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1160-100-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

winlogon.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Loads dropped DLL 2 IoCs

Processes:

672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe

pid	process
1312	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe
1312	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exewinlogon.exewinlogon.exe

description	pid	process	target process
PID 1984 set thread context of 1312	1984	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe
PID 1172 set thread context of 1876	1172	winlogon.exe	winlogon.exe
PID 1876 set thread context of 1160	1876	winlogon.exe	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exewinlogon.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://us82280994n9306.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://k9g32k552j0lp18.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://97nx4wvk9769i3m.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1097"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://v93805p866p8k3p.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://42389orizy0nb1g.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da0000000002000000000010660000000100002000000065304a330b3664c5dd90c2390a3c78ef19db881464a753979af7075f4a2e9c9f000000000e8000000002000020000000b6b40cd409a552f51a543f49b3f6b72cdd35f36fa4dadd54bb8bd1ced4e1fd66200000008a2b00ca200372f46d3f9012197f49aab7c71b394b3daac24c8fabd93f238dbd40000000795707e1e218a45f1368e0ab70e7830949d6631d5554b04d67e1f6ee8b45a91122e060d8a90595ff4dcef5a8994467626ab2be9a059f779a66a8aedde348392b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375967291"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://i83j3nclrkn4h0q.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com\Total = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da0000000002000000000010660000000100002000000007bd3d8e27a0bd5530b864f407adc3705afcb2e2bd916785918c8f03a73b0d22000000000e80000000020000200000002fe595e348f9cbda793d414c19adead4eb1e0a9e8884b3dd47868fbf9e3ae1cd90000000a0a32da3da7c57063e185246956b554aab20ac5ef3fcfec9f88b7cc1a3c3c1cfe6dd033756c5a9ef6c7485859eee7d557bd79990b639189309f56d10b658d81845a2088289cb6c0f94968874b488bd7aad0625d0a950b604cba381552ca3f4152d2b1dab40d40b2a9e0b97d6e2a43b191084a6bb704ec34b3702a79a631241ba9ba300e2875de362f05ad0b68b8419ef40000000ca8a0881ee6f40e1950e92e8d10ff3cd438ad9555cd615a44b74fb1df66f55032399dff646a10ec6c5c25062a78d963de8dc95a2c7a0c37b075e49b0a5d0f73a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://139n5ndj82xndp6.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com\ = "1097"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f056d3652dffd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com\ = "0"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://9y69yz7fx17q5yk.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://9yeir3gc03vl7h3.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

winlogon.exe

pid process

1160 winlogon.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

winlogon.exe

description pid process

Token: SeBackupPrivilege 1160 winlogon.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exe

pid process

1548 iexplore.exe
1548 iexplore.exe
1548 iexplore.exe
1548 iexplore.exe
1548 iexplore.exe

pid	process
1160	winlogon.exe

description	pid	process
Token: SeBackupPrivilege	1160	winlogon.exe

pid	process
1548	iexplore.exe
1548	iexplore.exe
1548	iexplore.exe
1548	iexplore.exe
1548	iexplore.exe

Suspicious use of SetWindowsHookEx 25 IoCs

Processes:

672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exewinlogon.exewinlogon.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
1312	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe
1876	winlogon.exe
1160	winlogon.exe
1548	iexplore.exe
1548	iexplore.exe
904	IEXPLORE.EXE
904	IEXPLORE.EXE
1548	iexplore.exe
1548	iexplore.exe
1456	IEXPLORE.EXE
1456	IEXPLORE.EXE
1548	iexplore.exe
1548	iexplore.exe
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
1548	iexplore.exe
1548	iexplore.exe
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE
1548	iexplore.exe
1548	iexplore.exe
904	IEXPLORE.EXE
904	IEXPLORE.EXE
1160	winlogon.exe
1160	winlogon.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exewinlogon.exewinlogon.exeiexplore.exe

description	pid	process	target process
PID 1984 wrote to memory of 1976	1984	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe	svchost.exe
PID 1984 wrote to memory of 1976	1984	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe	svchost.exe
PID 1984 wrote to memory of 1976	1984	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe	svchost.exe
PID 1984 wrote to memory of 1976	1984	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe	svchost.exe
PID 1984 wrote to memory of 1312	1984	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe
PID 1984 wrote to memory of 1312	1984	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe
PID 1984 wrote to memory of 1312	1984	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe
PID 1984 wrote to memory of 1312	1984	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe
PID 1984 wrote to memory of 1312	1984	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe
PID 1984 wrote to memory of 1312	1984	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe
PID 1984 wrote to memory of 1312	1984	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe
PID 1984 wrote to memory of 1312	1984	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe
PID 1312 wrote to memory of 1172	1312	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe	winlogon.exe
PID 1312 wrote to memory of 1172	1312	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe	winlogon.exe
PID 1312 wrote to memory of 1172	1312	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe	winlogon.exe
PID 1312 wrote to memory of 1172	1312	672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe	winlogon.exe
PID 1172 wrote to memory of 1508	1172	winlogon.exe	svchost.exe
PID 1172 wrote to memory of 1508	1172	winlogon.exe	svchost.exe
PID 1172 wrote to memory of 1508	1172	winlogon.exe	svchost.exe
PID 1172 wrote to memory of 1508	1172	winlogon.exe	svchost.exe
PID 1172 wrote to memory of 1876	1172	winlogon.exe	winlogon.exe
PID 1172 wrote to memory of 1876	1172	winlogon.exe	winlogon.exe
PID 1172 wrote to memory of 1876	1172	winlogon.exe	winlogon.exe
PID 1172 wrote to memory of 1876	1172	winlogon.exe	winlogon.exe
PID 1172 wrote to memory of 1876	1172	winlogon.exe	winlogon.exe
PID 1172 wrote to memory of 1876	1172	winlogon.exe	winlogon.exe
PID 1172 wrote to memory of 1876	1172	winlogon.exe	winlogon.exe
PID 1172 wrote to memory of 1876	1172	winlogon.exe	winlogon.exe
PID 1876 wrote to memory of 1160	1876	winlogon.exe	winlogon.exe
PID 1876 wrote to memory of 1160	1876	winlogon.exe	winlogon.exe
PID 1876 wrote to memory of 1160	1876	winlogon.exe	winlogon.exe
PID 1876 wrote to memory of 1160	1876	winlogon.exe	winlogon.exe
PID 1876 wrote to memory of 1160	1876	winlogon.exe	winlogon.exe
PID 1876 wrote to memory of 1160	1876	winlogon.exe	winlogon.exe
PID 1876 wrote to memory of 1160	1876	winlogon.exe	winlogon.exe
PID 1876 wrote to memory of 1160	1876	winlogon.exe	winlogon.exe
PID 1876 wrote to memory of 1160	1876	winlogon.exe	winlogon.exe
PID 1548 wrote to memory of 904	1548	iexplore.exe	IEXPLORE.EXE
PID 1548 wrote to memory of 904	1548	iexplore.exe	IEXPLORE.EXE
PID 1548 wrote to memory of 904	1548	iexplore.exe	IEXPLORE.EXE
PID 1548 wrote to memory of 904	1548	iexplore.exe	IEXPLORE.EXE
PID 1548 wrote to memory of 1456	1548	iexplore.exe	IEXPLORE.EXE
PID 1548 wrote to memory of 1456	1548	iexplore.exe	IEXPLORE.EXE
PID 1548 wrote to memory of 1456	1548	iexplore.exe	IEXPLORE.EXE
PID 1548 wrote to memory of 1456	1548	iexplore.exe	IEXPLORE.EXE
PID 1548 wrote to memory of 2312	1548	iexplore.exe	IEXPLORE.EXE
PID 1548 wrote to memory of 2312	1548	iexplore.exe	IEXPLORE.EXE
PID 1548 wrote to memory of 2312	1548	iexplore.exe	IEXPLORE.EXE
PID 1548 wrote to memory of 2312	1548	iexplore.exe	IEXPLORE.EXE
PID 1548 wrote to memory of 2880	1548	iexplore.exe	IEXPLORE.EXE
PID 1548 wrote to memory of 2880	1548	iexplore.exe	IEXPLORE.EXE
PID 1548 wrote to memory of 2880	1548	iexplore.exe	IEXPLORE.EXE
PID 1548 wrote to memory of 2880	1548	iexplore.exe	IEXPLORE.EXE

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe
"C:\Users\Admin\AppData\Local\Temp\672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\\svchost.exe
2⤵
PID:1976

C:\Users\Admin\AppData\Local\Temp\672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f.exe
2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\\svchost.exe
4⤵
PID:1508

C:\Users\Admin\E696D64614\winlogon.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
5⤵
- Modifies firewall policy service
- Modifies security service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1160

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1996

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:904

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:603142 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1456

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:603151 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2312

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:209947 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\08B8D8C1791AA7714DD4D760C5F42C55

Filesize
503B

MD5
dc3df51988ec3854fe426af76baa687b

SHA1
bf1f577821052c75b6ed3672d27cfb3111a4f708

SHA256
475623fae8d02c065b3cc5c840742f2cbb8a2ea7824d95ca93c94cf48b0e8c66

SHA512
6f9c5216a7a4f5e6bd56bfff4a33fa6e049bf3182c7a8d3447df1fc349c565fb83a98c505da5d1d21ae8a78a715a84dbe049c9baff05f98ed46ee81d72246c43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
9c094971a27ff86a263ae18cf5a0ff14

SHA1
368624fab92930f3edd9818b82341a152e72a162

SHA256
078a8257a7f0fe4fd6eb28f408e8ac24b0b018aaa023b37b1db23005ce91bd63

SHA512
236c9a1af251eb8175c25718f724fb564c6dd3aa48330641c0fa2bc2885c29d40f8cc504d1e68e5d9b4983760497b02aba396675deeaddeefce2214a3e6a82d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
ae7674294f5a17ef8761b33ac4dad848

SHA1
30a771e623dd1e3cb8694bb5f71393aaa9e87b6a

SHA256
cac85ed50ce25c45d5093aaaa231a0d1cd9667f47bd2312947070ba202c5d96b

SHA512
ab4a0adbe606ac6b1b8c87fb24fa23c7fdd23fbdcfb616f24fe1269dd4d409c45d7b64cdf65b08caa13e88b4461b29d2bded7e197120a7f65a525c2c5e905a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
1KB

MD5
bf2e7be3084ff4a3dd2414c954266132

SHA1
b407a494cd28b982e607f85ae1000e0b5d29d119

SHA256
42291d85698183c0df519ff0e74a50d04807cb3a9c2753d8fb837ff76f212962

SHA512
36579179442777636f7cfdfb909770499a6f86753c4fc80c403352d214582d6defed003fe19bf54973e77de515c14b632d0e494bf6b30135dde060804418be3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
1KB

MD5
e2d1277dde67909496116488b2656572

SHA1
627e6efc9f6dd6dbf16576402e8ee25102bb23b1

SHA256
5d5db82b5372b891947da1bfef7dccee7f97cf90a0f263c45ee8b086c13fc26d

SHA512
74638eca50ac2baf6edc599b634229f0a18371f2a30f99389a076a14a3ca561044db1f80fef9af58ad79bf55b3a55c2bd37ec76ff7b451d69844ecc453b6cb0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_B49B51C2F61192D2C0D20E671D9EF51E

Filesize
472B

MD5
942e48a42959a84a8fb01744fd2caf86

SHA1
a3659e206ba81e8549afa2d9138060148883ba90

SHA256
7b84fbd99ebee52b8eb3b3d506ffc4ff9d15bd2bd211fc4003a20fe3ef171501

SHA512
924f681dd75a06bd57987ebdaa2dd7f5699dfbcc33388eb51368f907d583b40c8a62524a984550902d2b26831517c6aeb75683a3282f1bd5c256d80d55731138

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\08B8D8C1791AA7714DD4D760C5F42C55

Filesize
548B

MD5
6fa77fc5fe132bb3d4128b69ce691cf1

SHA1
29ec257e35506eac1a4f5e8a14a91a1970f16d61

SHA256
c080715669823ad9cea2f80386f7623983190bd845f615533da37373770ed566

SHA512
78797fb7dc5b171ac499eb8b3cc306b68ce5aca03f1e55bef40d93338f4cad0410bb00fc1f176976d4a22b656e72bfdd1a25129c0fc72d4f9e11337c1cd0e16c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
34d72bfa8e7176d05949a44cc5dbec04

SHA1
f92b57963699a3103b082bf4b78cb519c63c14b3

SHA256
06d45478f03499921dddba480f92818e1f3bab7c6cf175ad3c3ee88739e883e8

SHA512
2d0180c1799c6937bae03ca74437a7ea35cf058e891bf421db4afea21d88e9e9923325138f767f1c07b8125b480814a003d9e2f3eb4ee7190f0bbc291f7a45c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
a47a75750b40315499d913c154e78f7b

SHA1
73ea636cac6727a5108aa87647b5784e4d334fdc

SHA256
3605078d9acaa5c46665431e109c3a960cbe29d986b115d4469b885c7829d6fb

SHA512
c09555488244b3f24ab9dbb75f0bfeb5786564300a45ac874ae6d5d233ae925ff14d6cd84ebc17a2dd0fc269c86e247cda305ec3bf57c4134931e411cf2853db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
b4afee56dbca94e90adceb4f70e581bc

SHA1
a48d2a54f2c6e729ddc930782b33a13d6f070f0e

SHA256
9845b11124530983cd672af5011234d8eb7f9f100e997f6e3ed1c1f13316abcd

SHA512
60f0310cc029de5c19e5d5132b586f09af75d3edac8ac07ff3892d0e7e9f3b53933a65422afa7e6328ff807e71e8b46fdc82ddacdf1f7301601d8680d560240f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
466B

MD5
d83d724382df96fef7ca899454b1122f

SHA1
a69145aa3c7849b1e5c0f6e374bfb3ff700f281c

SHA256
9b3cb5f4b9fd1926ea3da51b98e1091c0c2941519e32dd05b2fc4e6381f4df62

SHA512
8cf49cea3ce3050c92c999f65e57a4b042e80aed51e33665350ed538cc70304fc74c0ccea835a219b47abc01cb0831ce6557672bb86f6bd8bf75de0a032e6f6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ac790263f28a80ae13aa4ec4e90ff15

SHA1
e905629e66b629965c8eb5c155a00a94bac3b4c0

SHA256
73d4150e40af0f22582b768b4b130779bc432f27f2b02dacdf740d7d6154f133

SHA512
8c2a3e1cd3eb9db108e90f270b81b50aedb556a7ccd1429c0014439af5714a330a5c53f82f71c2c5ae6e525d57c123dd1d0b4e6c28d84bbfab261cd985165965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e09eeb397f905da4d4c2fd91946b784

SHA1
8ff21c68ea339cd7899f38f8f9c276fb36a0c31f

SHA256
5c06d0a7b22e64806d839b118661fac7aa11410f139e198a0d09a0f879cdc895

SHA512
14897cd27b36074a6dac452c8dc489f5d02db64fb983144076625bccb5a5e00bd9ec58e380dd2ceaf3890206d0d49c09dde9e0ef8496ba86a0d60620670152a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e09eeb397f905da4d4c2fd91946b784

SHA1
8ff21c68ea339cd7899f38f8f9c276fb36a0c31f

SHA256
5c06d0a7b22e64806d839b118661fac7aa11410f139e198a0d09a0f879cdc895

SHA512
14897cd27b36074a6dac452c8dc489f5d02db64fb983144076625bccb5a5e00bd9ec58e380dd2ceaf3890206d0d49c09dde9e0ef8496ba86a0d60620670152a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdf64f466b60d757a89408b6549dae6f

SHA1
ee374cdcfc2ffd5b7190ffdf27392cb1744de9df

SHA256
700bd552b6c138bd15ff51c5e4d7ef825d23b8247fb0dadaaad9b2d95bf639ce

SHA512
04e3e510b514ed414d5b7d99642422d8cee2da9f2f0e3409f2387702b8da0d656c55b55fe1412917c2b9fb2dbcb0028b677e436b281b785aa599d329e9780092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fb05aa6dc0332d4602747e07d05c2af

SHA1
5be46bbafea4d18f5ec24663509eec5f367b8c85

SHA256
c3370b47692d5b7e9e5ca8a405d97fc0705f9eab96730872f0c3fa6a39a276a1

SHA512
c4904bd348c84281a8043b3d55d41020003fd7eb35f3f4f196bd426a582c0b9cf0e032615afd93c0db4e55f100ba2ee61b7d1e6ddc7947ce7e13fb7b8a6034ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1d7737b6b709a57384ac9dd7af886e6

SHA1
e53b9bea5e523adff64d811f0018c6deec5a425c

SHA256
17e1aa67f75c06a1cdfae2548c1ec8808fcf2a86b48c959704d253e293dc2035

SHA512
6d02068d78a602e02aa5b4165429fc6b6c660718598bd88b6c73643a3b7df1327d46e6081872577542dd43fe4b443b43f3ac8581f053bc771ed1fbd2f07ff92c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5cf7e394a01ab66fcc12cc04d27f762

SHA1
4dcc545c7324461f04c0d65d75329fe01f50254b

SHA256
6b5dd81573d071eeb476d169fda46d794fe24dcfdbb290d58205e912fe045b56

SHA512
86ff52c0edbf6ac56c490d299bed76769c277493dcbfa54624647a443e8def47e2871c30fe0579b0996fc32b4e555fd24a9d29ab2511e324bae38ed1b0640ed9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a55fcaee407791a8bd872e389a61b30

SHA1
b0e0f8dd7c7d81273fbecbbf3d096ee872520869

SHA256
a70a253121a1dbc458e5403ca23e1ea6bd13a0b9bf412be4466e51701cf37e11

SHA512
cfb3a1c4823e44948fb369dd72557c4e0cf038fee82c6008cbfb92d2fa2855a3ac15e978e32b8ca9158f3d559a7adf9391b9f6aeefea75a1498ae73ff844bdfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
775dff91a7d681ba98a4227daa00cc47

SHA1
525ab650f49de2d9b8dd2f3e3a04941fcb7663e7

SHA256
6694c4a97bcad487ce4cc2bde97db1a5cc81548dcc527ca5ef87dee731f10da6

SHA512
61b7ccefa468aa7cbfc5003ad93df228c86a0045eefce4b9a0fd6adc2211ca2c9654d148c372b393394a8317f71e98ba4ac7558c15ae52798faa3979d6bc7a7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f8884bed037ce37d6086ba0cf7e8e2e

SHA1
34081442bf2b07681f4204b89427eeb52e2a07dd

SHA256
dfca03aa567ab29003d3cd2508fc233fbedbc8a4668bb3030db3d01525ef97e2

SHA512
84f9132bca07b577a52c4e66d10640553f126abbad97ddff540a7ccd2fd7a68c222e978bcaec83e9544cb00ccbc2b443ff0e78f50b2078ffe8b8c3660f87ba5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb389cb1cbc0cf8cecce468d0e2944b2

SHA1
0881e3a34769debdf96456b558677911ec4c650f

SHA256
971110932b537859329e0d490f4fb86df3d6e38cc05f0c79a549e855212ba28a

SHA512
e1f6e0ba3c2f22bc5b2c51de430a7950356b602056858d486531acf677a01f24fa859ea4e9a1d510a48b332e9e94f6951f92eed788bbc2a7f640722f02b02892

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae52036c983d04402f89ab58a9b41f9b

SHA1
5a00176ad84a9c0daa72c675d73355cdc8fc95f9

SHA256
be92f74acd584c40b492d142c8330adb64256eba967f6ae9050212c663dbc590

SHA512
cf98f12f930b9f2026b257f576a4d218be4f555ba26973ea60e60e9fd66b9b1901d0dbd40eaa6567709067be401a6d28e9d66d2abf27d234c5d43bbc725345b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4776a2559148d50c31cfbb16d916a384

SHA1
74619f054fd1186fb9ca0477798b2102cc0a299f

SHA256
d081486e25dedb70c305873e284d17ec3e76c9597ff7f9a8843ba3fd56597f24

SHA512
da6a1e15ea80ca90cc4ae473a918f4b39f35e27a8e56396dc1fe0c542937c894a8f3e2e4f6487496e9cc75dd0ad3ef6a41b011e43c0e546577db5dc785b0ef79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e49ce705b523e87ae79ebc507c20905

SHA1
1c7ea35140714ea962a512f9470e4ea7fa0e8b15

SHA256
af511582dd564ec31e74bd7d308799bb38f810e19535fa2ee69bda8de9361185

SHA512
96c33307c1170eb95ad61843d672ef2f4d605af6290314ef783d48c99fe4896b63b4d16c434eee4e883b483713ee8cfcd0af310ce5d493f814276794a6351dd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0933378f717af67b867686a6e2e58845

SHA1
b040eb0d6fae70caec1245f24440f227b8d5da50

SHA256
96c0497e5862726440a6fa9c854ed79a7d739a46266f8ff72e4d844a8e3e8c9b

SHA512
f6446b536030d06feea01a830448d4565e02ed324253bcb19a0ea764ddd13c7bcc553c2dbe57a7a76cbd02a1a0b6edf3816c5a7967e0836010e31959dd6b768b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
522f9222c80575096faa36e7e04a36b9

SHA1
0392b490292768d770f9a573dc079b34e5b2d2da

SHA256
81725292b84917f23df4ea0a55853b271cf689e631a6bda90f763653d71683ef

SHA512
481ed1bc3174dde2297a87cf6d2fb722f5d1dc2fcabada1aa62f20dfe3f1f6ec8966a1b1ac9f15cf1beaeb7414b0ea6fbb5b7a733da6432cd9a3518b372cbdcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd329910bcdcdd767acc291d68bddd1e

SHA1
9b7a6303429f3379e133483416d036678d604277

SHA256
fda2b7ca0bef25824723dbfc4b31ea03a84edcd62f60074f29c8e5930f40babb

SHA512
3803cb8306a9c0c8482b800561968190fc43142a6fc51693bf876c2ecbc2e9b8ccae7dd78ba723340388165db9d927a4c126e682d0d124a9c3ea0cf2ed8b39e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fb6b50f02adbd720e435bc1a3cc5d29

SHA1
22d756165d32f2d9c407fcc41344a008c5ba5e6d

SHA256
3bc1641a7ed395ef680ab70da96b11a77d23ad1c4cf77249cf432d52bfa14ea9

SHA512
6a463576c041bdef9e6860736074723ca1601212cae4cba9d3cb7d8a8c93d1f4d320ce4758f23a37ff8edc52ad0612d7d344d3081c8627196e314a5792cf5f85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b6305590d72108271ecd6c1a21f6721

SHA1
7c66dc2fe4648ba1def4e0e2239985349f952dd5

SHA256
0cae375764c69c9801d2db7f5c89b23779e839a60d5d43872db7577fa9fe7f23

SHA512
6374346ce56b108601985bb360fe78fab46063d686a9575a46bf899213d5152d11e1bc3c1c3803e03e442b7704047c766d8bb1f8b8158125cef365ae5940ec96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d262b05529edda1ef8e4a47f1d96c029

SHA1
798b491664997478fe9c51777202aa5427ff4b38

SHA256
1f3535d1ca567354e27188004aef6dff0a4ef6bd968ec9dbecdd08c4ad2cbcaa

SHA512
0025e4ff15ee35c90df64b7f992171e20d89f6620a3be4dc13701fcaa0fdf804089107c7532cf8c24759e9225097bab57c12d78fb55ec8ddaee4ec72244ba9ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10884b40ef7bae64e41ddbdf86775c34

SHA1
cfdf35ae0faaa333c73a9db9f1ba9184deaeda0b

SHA256
0505e5b951328b20cc6332f8a697a71a9133fbf82228cf7b8b94552673e7126d

SHA512
658aa182f97c631363c0c8346d474cef71f0b6b8fcf288f5af5e12a9f7c41491b07bd28f9241a0d63785b1988f8301697cf7e636cd125cbd7c66736ac50c277c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3762ab3e8c25f98bc759129a6ff1bf1

SHA1
4384c880445324a157705eed947cb27cd7e930ca

SHA256
0c709a982e467203addd1e5932fdba7e927e76876b05086039aad7f0ddf63e72

SHA512
23f61e7eaf6b3ab1e42aecc3880201a987adf55aed8c1f5ceee8b92e77896fb663341a5e111d5d412666a3bc34c776b081f80cc5ec300344f2ca06b434a14699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6106f335e6e025aea836684bdd77d87

SHA1
349ccb6a809d75ebd76f740948784a654a9412bc

SHA256
60fc926b25d495c1a16fa2e12f455a9d3d326bde98c926834dfe09a7dd33f109

SHA512
9939255745b32c3da25d61510584b28b1d16f4d2eb10fd7986d398cca346673437f777d03fda613eae114b3928b4a7de600f73df5e224855d060aa7e4f162009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
470B

MD5
f88f97557a97d32a7bb6c77ae4f9e888

SHA1
c872b80b08ddb507f4f44af9d3584807e3028037

SHA256
37060a202dcfa2497163a31a267467ceb8ecb3ecd6709100d7854b986ffbdd0c

SHA512
725596b550a37a79f1cd9f55c5d0a9c07fd4a7c44d4bba66eba5a249d7225251f805d1afb5da0e0c76d33c76b2da79eb2295ea9d4a7019cdebb4ab9a02c3c6ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
4cbcedd9439d2b870c5d6a15e583325a

SHA1
ad304aed5190c83b33132445a87cab8c23df0410

SHA256
0fb8ca49df81271d1a5ac77f44dd2662c7197ee17fd17848e088d7e6bdb82ed9

SHA512
631ef4141b3d9b7a11ca089109c7d5921c96253e900f8ea987647ced3a9ef2c0e9f7ba1bcf3193622fc36065705c1959d0dc629db2a9f39853473f8e3c1c4c07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
252B

MD5
bc19dc7d42077c09f1660277b117258c

SHA1
a7824afdd3768e2be3127900260549c5e778046c

SHA256
cfef497e6cbeab8687af86ce478c588b1403d8513b0903cbb08c98e085d70c27

SHA512
e7544e64fc0c677ae69175df68b41aa6cbf6e3a82d3000e338b527a8d146c0d0274dde55c50b6b6aeb6d7c1bb62d633aaff4fafaa5fe80640ee2624e587e3212

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_B49B51C2F61192D2C0D20E671D9EF51E

Filesize
402B

MD5
582ea529c97acfa984ec0f49936c2bad

SHA1
cf10f8a0d3bb94273d36a62ead69c6fe9377fe94

SHA256
f699cca8278c46cc6dd312511e9165db79656b68aaf8603391141578fb869e53

SHA512
3e8e7af6df1b892ee5a19d8b2d728d781f6d2262dbed2112430eec23a90345065f9b7c2e9e3857f7f5907024c2069fdac0795ab502c5caa3f201c4311a4e9205

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YRN25NCT\www6.buscaid[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\YRN25NCT\www6.buscaid[1].xml

Filesize
1KB

MD5
53c77e07d20ded140dc994df2886fff4

SHA1
22428c938f4afb605efa79381fcd43db439f0eb6

SHA256
ca6e60b016d8d5306597d7a08224aa100a85f86f609e4aec2c470ed89727c984

SHA512
5fe7be6a016fd81f6b18ced75f37aae17b6500d2dff06bce45050d8429ab613e29503979345b7d9848e85149613066bf6d8c17354f6b9bfc0d482110762b9a7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EF53UGF7\caf[1].js

Filesize
143KB

MD5
4b4e058e39e6b36cef760592a4634db5

SHA1
5321d0f813cc20d39837e5f573bfd1934fb9a412

SHA256
47bb2ce5f9670fa4b98955e60e2e1cea01cea3d8806bf809d029a6759455b23d

SHA512
3630856ec77c8380438b4a4dcca0e3aff133f11de1fb5e6ee74c722d6180c23cb589a7fbe3299b36adf8f6900091eb4e517683f691f8920bd400ba482c1d624f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\70K0TGSO.txt

Filesize
85B

MD5
7fb094374e7b3186ffd03c56befc99f1

SHA1
3077864af955b73ae06185e7359bfdc0481da198

SHA256
0c22fe1bfe3ae7aba9eb0ca3a574db706795ddfd749823e0785ae5905b892da1

SHA512
971ffd1ee05116bd36e3fe1ab59256db4ba1a5388fb1ebae193388111bb5cf62943f9ab9e225a88c9a61b40ed241d3625c20f5df4677b4622630d4bd3b2253ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\7KKAYR3D.txt

Filesize
430B

MD5
58c279b39cfbbef944940cfdfe21dd89

SHA1
501c4d3efca074e9c493f49b7675dddb50d9abe0

SHA256
a3bebc85eebd97f58ec4a4f938a060c3dee52ad88c23e9003278c3a005a5f3d8

SHA512
11adb651f6a41171710af868c37dd11f9f921d5c42b425870e4aeeb417227b421f4b3964884d70f0258a478e4744feb51528c692087ae8657d220e05ac926cde

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BVVUZABR.txt

Filesize
137B

MD5
b53ffd7675bfa9bf2ee5d8849dc641d3

SHA1
22d629730ecb3f4c3ce85e9f681461abf7f741c5

SHA256
c02f4f985796fde06d5b2a9dd1480734e583c1b73ea8a2bc9a2ee02861458106

SHA512
cebd5cd223d152edf0e3450928ecab6b4828d49cb277ddcd82047fa495f13af9a6f3434b538abb14de5f6248e029aee7ebb322e65c269797ee5f159ffcae959a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\E4C136AX.txt

Filesize
111B

MD5
70bd8024d9a1cc2ac6bde66e09e92fe3

SHA1
e5668ff4172a0d1704ee6b412c6c363c859b593a

SHA256
e8b159b5c42547d5115b975fd283eb1fe91cfdac75b64d4dc03d02aa3fe37abe

SHA512
f6d9df6ad80616d7b8ea2937ff7a5e5d7f5746fed5bf22f55da3a725a5d92aa21fff8dbe3b5df91afcfe7dd520c44d54f1958dd2b7edadcccaa7331137075019

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\IMOHWOVY.txt

Filesize
111B

MD5
8902ae3fa945db2006173efb8229ebb9

SHA1
0319120c3fc7aa98f29ff17345a230b2ab6f30cb

SHA256
1de7d8df61dcb205530c62a71fcdcf0814ba8ce766483369c40c23aa0475d3c8

SHA512
311134c973823fdba1d7875c6281cba5dfcc38d6820867485130f5456dec294d97e20793cd5de0f8adc710ef7bb46b4cad9d4bb4cbabf433c93e1553cbe48ae1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\LMSOZYR5.txt

Filesize
608B

MD5
cccb9fd94aa3f788ad7fa2b2210a40f2

SHA1
13cf09af4d06add01129e2a5643e467cab9aa5e6

SHA256
47504159fdab18be4527d6292cf5a76d5c58074e05e29ab3d97d65409b5322a0

SHA512
74853d77214de4e155fac56019fb67c64aa6be46b3fcb3ef2887a94c1a24dcd95833cc0dccd52bef013bb284199540f62174c63c599dda515c174f5dcbc52e19

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VBEDYN7F.txt

Filesize
430B

MD5
128a755732a1c3009eb3f373a53e11e6

SHA1
67d7c80b911627cd1d4d98e35da2bc75d0d562ff

SHA256
364bfed9c34faa14009977e3c840022516f460a7b4ba139e035ea83029b083fa

SHA512
f24ecfe968d2bf0d0e92b59cf79101fd7d71c81f46b29d2f7470547322a6cd0b85ec55f59311eee2954f5c2a250cd79e2ebdf9c8b5976c1e37e5391458702835

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.9MB

MD5
4600f3fefc27a218542df4a1f207b9e0

SHA1
14d425be26dec14c5738a046bbe2500683d4861b

SHA256
672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f

SHA512
bf94493894e5453002a5bda61c992610042f724337e2c50026e5cd621588860a509e2c08cf3f873ce784d9eb7071f4b5e58d4e9c4adcab7e73ca18aa1290d45b

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.9MB

MD5
4600f3fefc27a218542df4a1f207b9e0

SHA1
14d425be26dec14c5738a046bbe2500683d4861b

SHA256
672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f

SHA512
bf94493894e5453002a5bda61c992610042f724337e2c50026e5cd621588860a509e2c08cf3f873ce784d9eb7071f4b5e58d4e9c4adcab7e73ca18aa1290d45b

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.9MB

MD5
4600f3fefc27a218542df4a1f207b9e0

SHA1
14d425be26dec14c5738a046bbe2500683d4861b

SHA256
672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f

SHA512
bf94493894e5453002a5bda61c992610042f724337e2c50026e5cd621588860a509e2c08cf3f873ce784d9eb7071f4b5e58d4e9c4adcab7e73ca18aa1290d45b

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.9MB

MD5
4600f3fefc27a218542df4a1f207b9e0

SHA1
14d425be26dec14c5738a046bbe2500683d4861b

SHA256
672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f

SHA512
bf94493894e5453002a5bda61c992610042f724337e2c50026e5cd621588860a509e2c08cf3f873ce784d9eb7071f4b5e58d4e9c4adcab7e73ca18aa1290d45b

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
1.9MB

MD5
4600f3fefc27a218542df4a1f207b9e0

SHA1
14d425be26dec14c5738a046bbe2500683d4861b

SHA256
672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f

SHA512
bf94493894e5453002a5bda61c992610042f724337e2c50026e5cd621588860a509e2c08cf3f873ce784d9eb7071f4b5e58d4e9c4adcab7e73ca18aa1290d45b

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
1.9MB

MD5
4600f3fefc27a218542df4a1f207b9e0

SHA1
14d425be26dec14c5738a046bbe2500683d4861b

SHA256
672ddc8560117901848158f7ed21dddb8beff6c47a6af031e1c9828505e8fc9f

SHA512
bf94493894e5453002a5bda61c992610042f724337e2c50026e5cd621588860a509e2c08cf3f873ce784d9eb7071f4b5e58d4e9c4adcab7e73ca18aa1290d45b

Download Submit
memory/1160-151-0x00000000039F0000-0x0000000004A52000-memory.dmp

Filesize
16.4MB

Download
memory/1160-89-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1160-90-0x00000000004417D0-mapping.dmp

Download
memory/1160-93-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1160-100-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1160-98-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1160-94-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1172-70-0x0000000000000000-mapping.dmp

Download
memory/1312-67-0x0000000075761000-0x0000000075763000-memory.dmp

Filesize
8KB

Download
memory/1312-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1312-58-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1312-55-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1312-60-0x000000000041AC00-mapping.dmp

Download
memory/1312-75-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1312-59-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1312-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1312-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1312-64-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1508-72-0x0000000000000000-mapping.dmp

Download
memory/1876-80-0x000000000041AC00-mapping.dmp

Download
memory/1876-88-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1976-54-0x0000000000000000-mapping.dmp

Download