aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe
Size

839KB
MD5

844b6c7b3782956a323f6065b413e82f
SHA1

20f02e581a987af40e2895742447e17d869aa6a5
SHA256

aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68
SHA512

64217b5d8d8506f8f5b4d3fcbfc03ae64554c8b4ea278213b935f6c4ec3bdb3d2eab23b345ae065f7e301fbb5866ff8a93d68e67002718351b7a827b8d2539e0
SSDEEP

3072:iyf8n+BnNpiXN5U+M/hQuaCA3VMxDJAQO7LN:i/+BnNpCqP/hQuavirOH

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion
Drops file in Drivers directory 1 IoCs

Processes:

winlogon.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts winlogon.exe
Executes dropped EXE 3 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exe

pid process

1500 winlogon.exe
1488 winlogon.exe
1508 winlogon.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

pid	process
1500	winlogon.exe
1488	winlogon.exe
1508	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwinnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\etrustcipe.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostsChk.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgw.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkwctl9.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defalert.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ecmd.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\expert.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpostproinstall.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTEM.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navwnt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccwin98.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rulaunch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sharedaccess.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symproxysvc.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXTEXPORT.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sd.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgemc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ave32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swxcacls.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkserv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iomon98.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kerio-wrp-421-en-win.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msn.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcleaner.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsrte.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nai_vs_stat.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpostinstall.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monitor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\purge.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpfw30s.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w32dsm89.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wrctrl.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsbgate.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\unzip.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxmonitornt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mu0311ad.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav8.0.0.357es.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwebloader.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpcmap.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GRAPH.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lockdown2000.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\virusmdpersonalfirewall.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsisetup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Diskmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmlisten.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WerFault.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FirewallSettings.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\proport.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scrscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsched.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msblast.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nmain.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfmessenger.exe	winlogon.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1296-56-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1296-59-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1296-58-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1296-62-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1296-63-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1296-70-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1488-87-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1508-88-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1508-92-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1508-93-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1508-97-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1508-98-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

winlogon.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Loads dropped DLL 2 IoCs

Processes:

aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe

pid	process
1296	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe
1296	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exewinlogon.exewinlogon.exe

description	pid	process	target process
PID 1052 set thread context of 1296	1052	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe
PID 1500 set thread context of 1488	1500	winlogon.exe	winlogon.exe
PID 1488 set thread context of 1508	1488	winlogon.exe	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Sound\Beep = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Sound	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 55 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEwinlogon.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://9gbd25m2p163f90.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://68ln7qxskm36ltz.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5092b4624fffd801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{70D1A351-6B42-11ED-9916-DE5CC620A9B4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://7q65d9e2t6js37x.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://83f2889y95h0147.directorio-w.com"	winlogon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3ac5eea6fd9cb46806af9fcbb9e679b000000000200000000001066000000010000200000001fe659c351d6826f19618b17118fc6cfca275a0b5307e0dea8d2d41bc2b36ca8000000000e800000000200002000000011f68424379d56564a6396c6db3e66790462816f77f1faa1f612b57bba967eca200000008564aff2f204669d1269ba19cd9ef0ff206742173c142c28b128ed83d87cc836400000002e7d97c984b0d8ea3d20a97d0c886cb96a669dcff4975959dd7c11990ced261c3f582f225ffe83dd7183d995b813e67d1fa87ec29bd9cfcf302886285173fee6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3ac5eea6fd9cb46806af9fcbb9e679b00000000020000000000106600000001000020000000392c15cf93559ac515ede9cf7ae59a53b346e95acf7e159b58aa6e935a23d7bb000000000e80000000020000200000003cea169d9d60198d2f056e7a802922374f7ed4d94db4b9aa49eb12a8ec22feb7900000009452d354d3de12c8eb295b07bd53b85c30dcea432d2742751ade259dfdeb84f1f1500685408d9295aab6cb5dcfa27f48c5e31b0e8de27b3ec92a2e2828b28f343b5f1594573acb898b2455d0b930583cf45c32010eb7058ecf4152317abde520d5d147b73876f3bef1ee68564eeeed317edc3ca18b2602f9226e3804256d5a092e4888315d1d11988f741c027e80db4140000000aee86c1a1350be28bb22683ca3eab38e75c3778679fcc2e15cf406fb2c82b047a023a01cbb002b273c2406a7aaaea3e3ba047bd2cf7cc7f484c77fb7dab25b2d	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://2fkmp6z178v3cpq.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375981851"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://ct4095l34hhgila.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://evizx4w4b2vgqp2.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://56yx9x4u722sll0.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://7wspq010ran453u.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://7w2934o9wf5g7r7.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

winlogon.exe

pid process

1508 winlogon.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

winlogon.exe

description pid process

Token: SeBackupPrivilege 1508 winlogon.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

iexplore.exe

pid process

560 iexplore.exe
560 iexplore.exe
560 iexplore.exe
560 iexplore.exe

pid	process
1508	winlogon.exe

description	pid	process
Token: SeBackupPrivilege	1508	winlogon.exe

pid	process
560	iexplore.exe
560	iexplore.exe
560	iexplore.exe
560	iexplore.exe

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exewinlogon.exewinlogon.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
1296	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe
1488	winlogon.exe
1508	winlogon.exe
560	iexplore.exe
560	iexplore.exe
272	IEXPLORE.EXE
272	IEXPLORE.EXE
560	iexplore.exe
560	iexplore.exe
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE
560	iexplore.exe
560	iexplore.exe
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE
560	iexplore.exe
560	iexplore.exe
756	IEXPLORE.EXE
756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exeaaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exewinlogon.exewinlogon.exeiexplore.exe

description	pid	process	target process
PID 1052 wrote to memory of 1752	1052	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe	svchost.exe
PID 1052 wrote to memory of 1752	1052	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe	svchost.exe
PID 1052 wrote to memory of 1752	1052	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe	svchost.exe
PID 1052 wrote to memory of 1752	1052	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe	svchost.exe
PID 1052 wrote to memory of 1296	1052	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe
PID 1052 wrote to memory of 1296	1052	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe
PID 1052 wrote to memory of 1296	1052	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe
PID 1052 wrote to memory of 1296	1052	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe
PID 1052 wrote to memory of 1296	1052	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe
PID 1052 wrote to memory of 1296	1052	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe
PID 1052 wrote to memory of 1296	1052	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe
PID 1052 wrote to memory of 1296	1052	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe
PID 1296 wrote to memory of 1500	1296	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe	winlogon.exe
PID 1296 wrote to memory of 1500	1296	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe	winlogon.exe
PID 1296 wrote to memory of 1500	1296	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe	winlogon.exe
PID 1296 wrote to memory of 1500	1296	aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe	winlogon.exe
PID 1500 wrote to memory of 1172	1500	winlogon.exe	svchost.exe
PID 1500 wrote to memory of 1172	1500	winlogon.exe	svchost.exe
PID 1500 wrote to memory of 1172	1500	winlogon.exe	svchost.exe
PID 1500 wrote to memory of 1172	1500	winlogon.exe	svchost.exe
PID 1500 wrote to memory of 1488	1500	winlogon.exe	winlogon.exe
PID 1500 wrote to memory of 1488	1500	winlogon.exe	winlogon.exe
PID 1500 wrote to memory of 1488	1500	winlogon.exe	winlogon.exe
PID 1500 wrote to memory of 1488	1500	winlogon.exe	winlogon.exe
PID 1500 wrote to memory of 1488	1500	winlogon.exe	winlogon.exe
PID 1500 wrote to memory of 1488	1500	winlogon.exe	winlogon.exe
PID 1500 wrote to memory of 1488	1500	winlogon.exe	winlogon.exe
PID 1500 wrote to memory of 1488	1500	winlogon.exe	winlogon.exe
PID 1488 wrote to memory of 1508	1488	winlogon.exe	winlogon.exe
PID 1488 wrote to memory of 1508	1488	winlogon.exe	winlogon.exe
PID 1488 wrote to memory of 1508	1488	winlogon.exe	winlogon.exe
PID 1488 wrote to memory of 1508	1488	winlogon.exe	winlogon.exe
PID 1488 wrote to memory of 1508	1488	winlogon.exe	winlogon.exe
PID 1488 wrote to memory of 1508	1488	winlogon.exe	winlogon.exe
PID 1488 wrote to memory of 1508	1488	winlogon.exe	winlogon.exe
PID 1488 wrote to memory of 1508	1488	winlogon.exe	winlogon.exe
PID 1488 wrote to memory of 1508	1488	winlogon.exe	winlogon.exe
PID 560 wrote to memory of 272	560	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 272	560	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 272	560	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 272	560	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 1648	560	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 1648	560	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 1648	560	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 1648	560	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 1996	560	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 1996	560	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 1996	560	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 1996	560	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 756	560	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 756	560	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 756	560	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 756	560	iexplore.exe	IEXPLORE.EXE

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe
"C:\Users\Admin\AppData\Local\Temp\aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\\svchost.exe
  2⤵
  PID:1752
- C:\Users\Admin\AppData\Local\Temp\aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\\svchost.exe
      4⤵
      PID:1172
  - - C:\Users\Admin\E696D64614\winlogon.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1488
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Modifies firewall policy service
        Modifies security service
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Windows security bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Executes dropped EXE
        Sets file execution options in registry
        Drops startup file
        Windows security modification
        Adds Run key to start application
        Checks whether UAC is enabled
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1508

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:960

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:560 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:272
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:560 CREDAT:799752 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:560 CREDAT:1061895 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:560 CREDAT:996370 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
9c094971a27ff86a263ae18cf5a0ff14

SHA1
368624fab92930f3edd9818b82341a152e72a162

SHA256
078a8257a7f0fe4fd6eb28f408e8ac24b0b018aaa023b37b1db23005ce91bd63

SHA512
236c9a1af251eb8175c25718f724fb564c6dd3aa48330641c0fa2bc2885c29d40f8cc504d1e68e5d9b4983760497b02aba396675deeaddeefce2214a3e6a82d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
ae7674294f5a17ef8761b33ac4dad848

SHA1
30a771e623dd1e3cb8694bb5f71393aaa9e87b6a

SHA256
cac85ed50ce25c45d5093aaaa231a0d1cd9667f47bd2312947070ba202c5d96b

SHA512
ab4a0adbe606ac6b1b8c87fb24fa23c7fdd23fbdcfb616f24fe1269dd4d409c45d7b64cdf65b08caa13e88b4461b29d2bded7e197120a7f65a525c2c5e905a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
1KB

MD5
bf2e7be3084ff4a3dd2414c954266132

SHA1
b407a494cd28b982e607f85ae1000e0b5d29d119

SHA256
42291d85698183c0df519ff0e74a50d04807cb3a9c2753d8fb837ff76f212962

SHA512
36579179442777636f7cfdfb909770499a6f86753c4fc80c403352d214582d6defed003fe19bf54973e77de515c14b632d0e494bf6b30135dde060804418be3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
1KB

MD5
e2d1277dde67909496116488b2656572

SHA1
627e6efc9f6dd6dbf16576402e8ee25102bb23b1

SHA256
5d5db82b5372b891947da1bfef7dccee7f97cf90a0f263c45ee8b086c13fc26d

SHA512
74638eca50ac2baf6edc599b634229f0a18371f2a30f99389a076a14a3ca561044db1f80fef9af58ad79bf55b3a55c2bd37ec76ff7b451d69844ecc453b6cb0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
bdfdd9ca3b9cd0ef92bc765f88dd56b2

SHA1
632043d00b9377a2014ceced9105ba8484da2123

SHA256
3e3b3130da4984f09601313c4cfd2b7465ac0a64b2c558d4e41461f3780c34d7

SHA512
b83b32f002d91af65789ce9334536985619966f7170944c0ff4fcff1e5c34fb9a0b74ab3785df410efe7dc2050349f3e161386a4a0a8670d4c7eb946b537b30f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
44fe2583f5142dd2860a2f1d54c3c6b6

SHA1
d4ee134a4022b08945f80024eecce95c2cf8bd40

SHA256
c5d7b38fdcb8bce3cc76e7ec02e619767d7d042465109277fc7a0519a9c6e7a2

SHA512
a0480e85bce2aa781b121488aa44904e23e205048fa0ffd9b205d6378cef76712e25683712ff61a85a1a3de5ffe7847a607c763672ab18bc5ed68349564b2235

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
466B

MD5
f4b25d9d9cd50c6ada6123c95e826fd0

SHA1
37306ba05689bbcddc999757f2dcd57d8f4f0a56

SHA256
602f50cd47c88e283ca8ae3d4aa07363b55010fb9811af4ee2aae691c3dfa912

SHA512
491a7690fdc2c249136b8f632f22ad0b84114af08d15accfade74a71b01b5dd1a6d5c47370b3c36ea4ab9b7fbf490cb236f9828ebb67f07edcfa7eb4da243046

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f19a509f9ad58177a5bce66f6067959b

SHA1
182d62fe42dd61809d5f3091543be38493ded023

SHA256
a5a4b8764a7f2024858f1aa50513a2d5ea7e20c194ff09049a360ce3f68de749

SHA512
7fea8ea9bd7783265e2a06880913341faca9575b5bbf18fcfea5098118cb5953e72f195d5544ed1eaaec9683d40a360e039461cec9e94e35bf44d089c34f2cea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1498c66659ff0750eaf5d34fc1a6207b

SHA1
6999684a03eda00fb3a123477e9bed359eea694f

SHA256
4cad671a4defe7bb12150358d3272f72287821612a744509771c1a917986184e

SHA512
e172531998174db084ab8a20781cc245c4283540bb9dee90ec2711441bcdd12507b9dd7c8e0a515b15b563cbd82c80f9e946b23329496c3f3f02e61349e1d47c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8060ec1a10aab63df2ed72dffd32fa5

SHA1
d2b1d2ac4ba196e859e02160d796d630b731d997

SHA256
e59af72e2ddcdba591ecd51fccd3288cb9f38a8e91b992df3b1c70d12bd412b2

SHA512
aa58c6a7d36e11df563f52582988f647aaabd35d3245020326d3d101b4f04bbf293dba2141a1e89c6dd65d59f4a8e69f873f243020be653a09a3d40d05fa47a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55981f2f42ae980c086e0fff54c24f3a

SHA1
2724c560624632b1a20be7c02699fe018c654f5e

SHA256
2fab741451117245bdba526c3556965777ed8357717322dbab21418c20ecb752

SHA512
fc9fdf5518684391ac770bdbfb35ec9ba78d831963a356da01860631a5aefed8f0aa936ab5717da0dbc68a733ed993ed582d430ea654aaeee47ea94aa26ec9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
470B

MD5
da3bece32190d1f965dd48de0f0bc663

SHA1
93e539e36216d38402a0065f7dadf68698400e4e

SHA256
7531552442373364d9db76cda7e6024f0f366a918d46eb9d76eaa62eacd2e180

SHA512
726466465b81086451172ce5c451eec71f490ab9d102c755ed2bf58216e7d23272261b3248eba2a12b2f18d8dd167feed3bc65df2e22fc1929e5cf6e843190a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
cefd8d55ff3dda627f8d1da4ec394902

SHA1
afe3fdb7bb289e183e99146d4af586ddb952342d

SHA256
b1ea3f148e2b57b54163dfa936de52c4be3510c62759328fee262114dfabf271

SHA512
1f933b18be50179caf1cab33f02c7da258c8a09f7b49c0de0d3311211d9f9ad6ec100ce6146e8fb5d9c02334663d1c284f909db35c5cf1a991c327f080cf4209

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
3175756f46c83d402505e9879c04c05a

SHA1
7e069160a79b319353f690baa93dd931413bf5ff

SHA256
e6e28cb23ddb8bfe0c912ad9569bfa012211a010875e28bac25f4600435ea4a7

SHA512
b5023e20bee1cae24c40eb87b340cf3d26795ad56f467c437c2759cf4d7ee544f2164bc056cf1fb1aacaf90c19c1db733f006e81271448736d9d27567d2540fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\ZG4LAS5P\www6.buscaid[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0E8P6D14.txt

Filesize
608B

MD5
15ab931110f579d470c95e9c608c1620

SHA1
5703bc47ddce128cb23a8fc1cab6f97411bffce6

SHA256
750411ed1ac6ccabf87c1d92e92de167f12a83cf7fd72d54bbaabda52597c401

SHA512
d9a965e61e2b126ab6ffc0793ef71cee0c1b58cda020984b0dc2548f75c2b7c81032348cecf0a5296543a824f738e4781ee257394146b2ac6e7af137c94a29f0

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
839KB

MD5
844b6c7b3782956a323f6065b413e82f

SHA1
20f02e581a987af40e2895742447e17d869aa6a5

SHA256
aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68

SHA512
64217b5d8d8506f8f5b4d3fcbfc03ae64554c8b4ea278213b935f6c4ec3bdb3d2eab23b345ae065f7e301fbb5866ff8a93d68e67002718351b7a827b8d2539e0

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
839KB

MD5
844b6c7b3782956a323f6065b413e82f

SHA1
20f02e581a987af40e2895742447e17d869aa6a5

SHA256
aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68

SHA512
64217b5d8d8506f8f5b4d3fcbfc03ae64554c8b4ea278213b935f6c4ec3bdb3d2eab23b345ae065f7e301fbb5866ff8a93d68e67002718351b7a827b8d2539e0

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
839KB

MD5
844b6c7b3782956a323f6065b413e82f

SHA1
20f02e581a987af40e2895742447e17d869aa6a5

SHA256
aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68

SHA512
64217b5d8d8506f8f5b4d3fcbfc03ae64554c8b4ea278213b935f6c4ec3bdb3d2eab23b345ae065f7e301fbb5866ff8a93d68e67002718351b7a827b8d2539e0

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
839KB

MD5
844b6c7b3782956a323f6065b413e82f

SHA1
20f02e581a987af40e2895742447e17d869aa6a5

SHA256
aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68

SHA512
64217b5d8d8506f8f5b4d3fcbfc03ae64554c8b4ea278213b935f6c4ec3bdb3d2eab23b345ae065f7e301fbb5866ff8a93d68e67002718351b7a827b8d2539e0

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
839KB

MD5
844b6c7b3782956a323f6065b413e82f

SHA1
20f02e581a987af40e2895742447e17d869aa6a5

SHA256
aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68

SHA512
64217b5d8d8506f8f5b4d3fcbfc03ae64554c8b4ea278213b935f6c4ec3bdb3d2eab23b345ae065f7e301fbb5866ff8a93d68e67002718351b7a827b8d2539e0

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
839KB

MD5
844b6c7b3782956a323f6065b413e82f

SHA1
20f02e581a987af40e2895742447e17d869aa6a5

SHA256
aaf2e62ee2465031be3cee82585545bba2eec90593cb859321dca647cda43d68

SHA512
64217b5d8d8506f8f5b4d3fcbfc03ae64554c8b4ea278213b935f6c4ec3bdb3d2eab23b345ae065f7e301fbb5866ff8a93d68e67002718351b7a827b8d2539e0

Download Submit
memory/1172-72-0x0000000000000000-mapping.dmp

Download
memory/1296-70-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1296-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1296-59-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1296-58-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1296-60-0x000000000041ABB0-mapping.dmp

Download
memory/1296-55-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1296-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1296-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1296-66-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1488-87-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1488-79-0x000000000041ABB0-mapping.dmp

Download
memory/1500-69-0x0000000000000000-mapping.dmp

Download
memory/1508-88-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1508-98-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1508-89-0x0000000000441740-mapping.dmp

Download
memory/1508-92-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1508-93-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1508-97-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1752-54-0x0000000000000000-mapping.dmp

Download