85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56

Analysis

max time kernel
132s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe
Size

490KB
MD5

72ae352492e4cafefa98c8196a719b0f
SHA1

7d3259dde4abc30529a23ad1c5a4ee7b7f43f560
SHA256

85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56
SHA512

b7b8b55cf2c677ad697a3b37eef54049e7ac8d8b7b4940bf6a0236cffc9072955632935ceaa025c8c9adb2b6295e1eae969a08507171723c627026f523849962
SSDEEP

1536:ybcbXVDMo9fgw5Y0ZlUmp/xLVQ8GW9AWPdApTbJ7mLcaQ9yrKYcU:yWMot5Y0Z2enQ8G0AVpTTaOyrv

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Drops file in Drivers directory 1 IoCs

Processes:

winlogon.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts winlogon.exe
Executes dropped EXE 3 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exe

pid process

928 winlogon.exe
1656 winlogon.exe
1496 winlogon.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

pid	process
928	winlogon.exe
1656	winlogon.exe
1496	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpcc.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpdos32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530stbyb.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HJTInstall.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SrchSTS.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\earthagent.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\claw95cf.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luspt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfw2en.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navrunr.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdoc32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbust.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\generics.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppvstop.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswinperse.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfind.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mu0311ad.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npscheck.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcciomon.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkwctl9.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmb32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\proport.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonealarm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pev.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkwctl9.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccpxysvc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mrflux.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsaa.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfagent.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsbgate.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pev.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_findviru.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpfnt206.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\efinet32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luall.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweepnet.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cclaw.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lucomserver.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mdll.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ndd32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wradmin.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsave32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtvscn95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\unzip.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcadmin.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamserv.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsupp.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSACCESS.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luinit.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mrflux.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avshadow.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcc32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwinnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1812-55-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1812-57-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1812-58-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1812-61-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1812-62-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1812-70-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1656-85-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1496-86-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1496-90-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1496-91-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1496-104-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1656-105-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1496-107-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

winlogon.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe winlogon.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	winlogon.exe

Loads dropped DLL 2 IoCs

Processes:

85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe

pid	process
1812	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe
1812	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

winlogon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exewinlogon.exewinlogon.exe

description	pid	process	target process
PID 1600 set thread context of 1812	1600	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe
PID 928 set thread context of 1656	928	winlogon.exe	winlogon.exe
PID 1656 set thread context of 1496	1656	winlogon.exe	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXEwinlogon.exeiexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.hugedomains.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://f806q7nm4a2g56y.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e94c627f02d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1695"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "198"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com\Total = "32"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "254"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "167"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1029"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://20qon1dikkf4zjm.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "197"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "288"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1923"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "8497"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1086"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "947"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000b7820092c37bb9ad7c7c142c3c1d7cd37708cddcb7886095246d1db293c407e6000000000e800000000200002000000049a950f432cdd2348f6280b46fa4dc782732dc9b4a6aec22938e47b18b65c34d90000000cf8a92cab674bcc07df9218256daa97852cb3df5c24c9735b0323ae43b1423a64bc927c0e2a86240d2aa618074e6e813396221d6776286109fd8d2707ecfe64127bd83cf3b437785e88ebcfacb7c1b8d762dd4937d63458e67e2ecaddd5d77ab92e8a98d7f2575087d3a71bd625b886f4e798dc636af1d4ec6be9490c0d2f01da31ce412e587f6eb582d87d1e2e0ef3540000000a362aa833fd0905b7f404292c3a227e4fa8f073c29c42d3a7d480781e66058d599f8e997db5f831178a45c11ee1f7cbed2b2da8bb76869564773aac9e66deee5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "345"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1777"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96805001-6E72-11ED-BB74-42A406F29BB0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.hugedomains.com\ = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1695"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1030"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "3080"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "8497"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "257"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "197"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1980"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://l96i7q60d3xgudy.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://820qms59737915q.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://iecr07wk93z9al0.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

winlogon.exewinlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	winlogon.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	winlogon.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	winlogon.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

winlogon.exe

pid process

1496 winlogon.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

winlogon.exe

description pid process

Token: SeBackupPrivilege 1496 winlogon.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exe

pid process

948 iexplore.exe
948 iexplore.exe
948 iexplore.exe

pid	process
1496	winlogon.exe

description	pid	process
Token: SeBackupPrivilege	1496	winlogon.exe

pid	process
948	iexplore.exe
948	iexplore.exe
948	iexplore.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exewinlogon.exewinlogon.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
1812	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe
1656	winlogon.exe
1496	winlogon.exe
948	iexplore.exe
948	iexplore.exe
592	IEXPLORE.EXE
592	IEXPLORE.EXE
592	IEXPLORE.EXE
592	IEXPLORE.EXE
948	iexplore.exe
948	iexplore.exe
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE
948	iexplore.exe
948	iexplore.exe
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exewinlogon.exewinlogon.exeiexplore.exe

description	pid	process	target process
PID 1600 wrote to memory of 1812	1600	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe
PID 1600 wrote to memory of 1812	1600	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe
PID 1600 wrote to memory of 1812	1600	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe
PID 1600 wrote to memory of 1812	1600	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe
PID 1600 wrote to memory of 1812	1600	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe
PID 1600 wrote to memory of 1812	1600	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe
PID 1600 wrote to memory of 1812	1600	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe
PID 1812 wrote to memory of 928	1812	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe	winlogon.exe
PID 1812 wrote to memory of 928	1812	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe	winlogon.exe
PID 1812 wrote to memory of 928	1812	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe	winlogon.exe
PID 1812 wrote to memory of 928	1812	85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe	winlogon.exe
PID 928 wrote to memory of 1656	928	winlogon.exe	winlogon.exe
PID 928 wrote to memory of 1656	928	winlogon.exe	winlogon.exe
PID 928 wrote to memory of 1656	928	winlogon.exe	winlogon.exe
PID 928 wrote to memory of 1656	928	winlogon.exe	winlogon.exe
PID 928 wrote to memory of 1656	928	winlogon.exe	winlogon.exe
PID 928 wrote to memory of 1656	928	winlogon.exe	winlogon.exe
PID 928 wrote to memory of 1656	928	winlogon.exe	winlogon.exe
PID 1656 wrote to memory of 1496	1656	winlogon.exe	winlogon.exe
PID 1656 wrote to memory of 1496	1656	winlogon.exe	winlogon.exe
PID 1656 wrote to memory of 1496	1656	winlogon.exe	winlogon.exe
PID 1656 wrote to memory of 1496	1656	winlogon.exe	winlogon.exe
PID 1656 wrote to memory of 1496	1656	winlogon.exe	winlogon.exe
PID 1656 wrote to memory of 1496	1656	winlogon.exe	winlogon.exe
PID 1656 wrote to memory of 1496	1656	winlogon.exe	winlogon.exe
PID 1656 wrote to memory of 1496	1656	winlogon.exe	winlogon.exe
PID 1656 wrote to memory of 1496	1656	winlogon.exe	winlogon.exe
PID 948 wrote to memory of 592	948	iexplore.exe	IEXPLORE.EXE
PID 948 wrote to memory of 592	948	iexplore.exe	IEXPLORE.EXE
PID 948 wrote to memory of 592	948	iexplore.exe	IEXPLORE.EXE
PID 948 wrote to memory of 592	948	iexplore.exe	IEXPLORE.EXE
PID 948 wrote to memory of 1672	948	iexplore.exe	IEXPLORE.EXE
PID 948 wrote to memory of 1672	948	iexplore.exe	IEXPLORE.EXE
PID 948 wrote to memory of 1672	948	iexplore.exe	IEXPLORE.EXE
PID 948 wrote to memory of 1672	948	iexplore.exe	IEXPLORE.EXE
PID 948 wrote to memory of 2552	948	iexplore.exe	IEXPLORE.EXE
PID 948 wrote to memory of 2552	948	iexplore.exe	IEXPLORE.EXE
PID 948 wrote to memory of 2552	948	iexplore.exe	IEXPLORE.EXE
PID 948 wrote to memory of 2552	948	iexplore.exe	IEXPLORE.EXE

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe
"C:\Users\Admin\AppData\Local\Temp\85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1600

C:\Users\Admin\AppData\Local\Temp\85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe
C:\Users\Admin\AppData\Local\Temp\85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe
2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:928

C:\Users\Admin\E696D64614\winlogon.exe
C:\Users\Admin\E696D64614\winlogon.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
5⤵
- Modifies firewall policy service
- Modifies security service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1496

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:636

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:948 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:592

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:948 CREDAT:3683338 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1672

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:948 CREDAT:3224596 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
2KB

MD5
76e7d5bf61b2e80d159f88aa9798ce91

SHA1
32a46de50c9c02b068e39cf49b78c7e2d5ace20d

SHA256
280fd6ae3ad21323199759814c4dd82329eb8f9847ed1fa2be145e83b4c88bf3

SHA512
5efd8c64ac40ae006d2ce4509eb9e5f1448fb1156e914d303e8bc4dcfe1d94c57c7eae216b362877e7b644876656cc9e5c4cebfc905bab3f8b09cb1a051d69c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
d01f6845062b8f1cb3ef9fb108c16755

SHA1
0743777e9ebf074330b32dba956a8fbaf1dc4a9a

SHA256
bf61698a982c8c89bfb36fe0d63ce8890de405af4f30ff2c017f3190d48e9a06

SHA512
3b81b9062ea3c2f0240cbc60f800c0aaf495a053385b1b086436c2859cfc622384f60aad9ec287ac93b11fda461246882d3c282dc88be6c474def823a4d6e521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4
Filesize
472B

MD5
9f6cc8d3fe9092a6d3901e873a87fd87

SHA1
2e0aac117a4cc57596efb3d6f6624c269f94b031

SHA256
e73982e62b92abac3d15b161f4525448cc2bc8b9bacefdcbfc6f87b74ec372e4

SHA512
9736a099967d7ad595439768e45c633ff7d34de92f7cb0c19cd3d4590c4a6dd4fedfcd1b5617c81652e61f4ffe919057507f622f4c6d8d626cfc40234ad2c757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_7D0866F648887A7BB8C83FDD7893DE3B
Filesize
472B

MD5
8835f987270c3a6655732a8b9f79019d

SHA1
b526a02966f50407fd20c881616a505ca6693ce3

SHA256
349663442998cf63d2ff77fdfee46ac572703750f977b4f60e9082307309f7c2

SHA512
cf3ec047cfcb755450b568bb802d4767faaa758ed761b4dc74e410f8beaa9981844c97c2dcf1d9e37410e5750a7470f688814a06f712d8ed3ab7fc7c26b06ca8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
1KB

MD5
05f7bf88033198e3e8a17bb18181c284

SHA1
79f25ba7c4d0201afa52520b8116843ed5283717

SHA256
c1c83e400d3ea0543bd1a37834c148d1655011f94f201241fe11c02adb4b775d

SHA512
480487cd31618843159fe70e8315ed4635576dfbf4665281fd81d0561a38b224b21241ce2013ae473bfba04f0b2eb04137dfa351d94049225b29b008a0c82573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273
Filesize
278B

MD5
89956712ce646353cd001bbcc6de72b5

SHA1
628e35e1f699ea71dcab43421a933856847cd292

SHA256
1d8feb574d9a848ac5e671bfdddcaa948d7b1b514d6adc39dd61be53928e05c8

SHA512
35631b10999e7cce8eae0dd54f6fce3b8d11a2edc166bac50764fa36bf5ebf74b2cb81e577beac1ab0e56bf7f54b145fb3f04f8891901925c96ace1f5561ea44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_4A183155DB502CF599F3A8AD6680B8C3
Filesize
472B

MD5
88e42375d2172305f819b892225cf877

SHA1
674324641f82700172e72fe259ee2241361e2ea1

SHA256
6dce3754a67df878b536c368657a492a1f908d408fe7fe5ba43c5d24c44434b3

SHA512
84980b3674b4d081c744521bba50f796ead682fb2d04f509a4fc8a8664539a1ad4d2dfc4895930de5276fbcf6c1bf00f0bb3d3d42c5f2e26aa7a1c495f2aa892

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_5C379F3600DE745720AF61433A9796B2
Filesize
472B

MD5
e9895464b828d538dc654c678c82b181

SHA1
af5791cd48761cb3f3f979b481c23e1508692823

SHA256
c93a71d276aa3f386bef66ed2b4d69e041cccc9a4df5024b14d54ce2569948f0

SHA512
7eaa004920cf778647d071f2074ed39f4fadda3f0436bb3ece34247e8b0a422d913ca254943d085a3044a697da4d93433eea1efa387c6cee92ff41afca8bb968

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_9E03BE143CBB35C01D53F353A29A88B6
Filesize
471B

MD5
b79ac2c19aa63a6aaef3f01896c8d966

SHA1
0e22c512a4d352b2ebe3626da3daccd82aff1a59

SHA256
bbbeab963cb9128c27d6c041896ef82628414151553622d502de3a15b14d632a

SHA512
5fa358be6f4e6fa7b4b82dcb221c8cdfaf64ab5659c102525a7536f50eb17918df2a600c145bda4a0e85712e9883a068d710c30de6a1c1bdcf43aee56b0db229

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
1KB

MD5
8641ac0a62e1e72023be75ceed4638a9

SHA1
a347dbd79e99d81cdd6ec77783008fec9f7e7d42

SHA256
d291f90a287f0bf8702208bab880ef95c5b2bd22a2c21762e828a707a004da2c

SHA512
9a12e4baf2ca8bc5c4ca5a8606a9200241da8fb413e50ef6c0b6b4597c25a2636915bd9dfd7e9a97e0f58a15859629bad9222188dccdaf4efdbb8e14884d0ffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
Filesize
471B

MD5
94d11c3e7fca6a37b603f35b0bfcce8d

SHA1
78e53fedf47fc7c702d43fe3abc1adb346470d0e

SHA256
10e27a694ba4884491d1d470dffdbaf33c139745d087399569f73540d19cd6bc

SHA512
20c9a495739583622b4d95d8eb89cd273c227cbf520bfa995287f4cf50859bd1c697de9eaa6bab4b21319b629c105238ef779b079b5121fbfac1a6f84a07a9e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C67047FE238D580B731A13BEA5F7481F
Filesize
472B

MD5
cfbcb12817712d4f8f816c208590444a

SHA1
9999caeedbb1a95ae4236a5b962c233633df6799

SHA256
b5a41ab77d5ff4ba1a17ff074eb91bc18824d56dfc4b6c3320e900bbd6f3a90a

SHA512
a70eb8c366dfa0226cd62dbffbf51bd2da25571a6ff6b1f2e44dd8d9193a72f79ab7d90367378edf808ff3152ca45bf2a6ba3d64882d0f6d4aa437b6881d13f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_09D967865B5D6CF6242665AF4E214559
Filesize
472B

MD5
9cff2c2ad4207e09e07c017987177850

SHA1
833082ded91a1983a1367c48c8076949e079ce95

SHA256
82b03e92d004f116875ba023a7e8782d3c124a1c499a6328f29cff70f397a6cc

SHA512
ef799c1ff8dc8eac928b4c3377d0fdd4661787e47bf04f0d9de74fe8ef194af2079dc9bf846449e49c096a45d251604a1ee66c03671a3b4a8e5cc4e5d9a3bef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_01B1031F6736E831E4D73D2798F7305E
Filesize
472B

MD5
0ee1d1a60ec1770ec3e880a25c257f5d

SHA1
015b05feff63bdcf8fae4d1a8c0c83c923a2ca67

SHA256
b6845619444a37f322c044933a44cf3fd283a18a54d03bad4f76a2ed8c2cbaf6

SHA512
2cb2f9dfd6ffa79bdadee19b2f9ce11cf93204dca4feca0b7e29af210bd5acf2eeba1687c405012987f977a8dddd0ab481300619deb3bbf936db6676a85f999c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_AED163394DA42A803964AD0D562C1BA5
Filesize
472B

MD5
770555aa8a0a52c611bafb289ca8a650

SHA1
62504cadc49747f328e3c31ad3aa7a740043072c

SHA256
6317c8530220392b1339be640b8c1181c468ff8e3f3d1d5692b39cb32404216f

SHA512
4ca0f5ea46b35f1fc0fdab48c5d4722e5caccc827dc46c9565d1660f119f1b9c7f59426dc942c89d8b2005892e5c3365bba0c2403b70b181af28afe5d9f78f67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_DD5E18651A85E635F184F73BE6D3DB70
Filesize
472B

MD5
5af61422c4eaa1b995ec63e463abda26

SHA1
db75634681ed688840773ce828c169ac9da7d131

SHA256
506791493bb08d458008ad072ac34a26c2170c1e775b83f55f20cd8af97aa895

SHA512
f976074a5287f1c88a6832730476b9ca2519ce4395e197e561a8717f0204531f9d1db87611ac08c001f4e898d6bd14134419fa07ac33ca19492b287814fe5f9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_9314CBFDE0A0789248250741A60DF9F4
Filesize
471B

MD5
463f202e3459fe2f41a8497ad045285d

SHA1
8af5c14682cbc7db37d98455a7b84e67299dd938

SHA256
2ad6cf7761c84f639372165d5940264de82f4f1152a46ec2d102e3a8fcd0e000

SHA512
72348ce2e72e4d7817c0dfecd2f256d16029ab76ed943d0ed5e814800b73e3a25f058226a1819a77277c7280b6017f182b63c1eb863cca505469ba2ae770a965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1
Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
488B

MD5
6b88233b6e0ed1cec647d1e5ceb031e6

SHA1
2ad9fecadd3f9db934d917c32e8f0dbdad7c2b99

SHA256
792ad382737f2801de660c5977692b1608a9b0a53a90899a44e18737b44ca537

SHA512
2d82873ceaaa9241a353b5c125ce5f43750b225b6cbeff4a9a2b3da722033259f22aa337d147e7ac4aba7e74d4f4b2a878835f5fb33b3c33a9a29f9436a188ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
3c7115e5e1bba25f85f890ce415b9973

SHA1
cc1dd224e8422df4b306631db3e07a5eadc5cfe2

SHA256
cad90c42cc2738014f6fdbde7fce8f8d377cef37224457d79514907a9191057c

SHA512
e91ed3943e6e6220a00af8f2ac958926a4bc0bc2fb10a206dc38f2eba1190da925e67c778c6b2648a539e8fd0d55f9a34b02117595e688bf46fa38e2a9c68c62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4
Filesize
402B

MD5
2a70fff96ecde64af1e4cb37037746ca

SHA1
ec787af5ea12ca845d70cefae5aaae492d5400e0

SHA256
e3810b642bc1a7c728e31a7281c4d497494ef7910d7044b17d4cd1b1013d1e99

SHA512
71052fd7d6260bdb1077344c50d61a7eba2c0de6de1742ad616bbd36bcff8c133e3e84660f8111d48fb93bcb75548b0ceb9d65fe016ac93e56d70c7ce7b8f0dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_7D0866F648887A7BB8C83FDD7893DE3B
Filesize
402B

MD5
70eeee7ae88b8fe9c132d5ec0ed21bd9

SHA1
9babf184d15d53acae2a7702b3dcdda7f4119024

SHA256
2332f94f25343652985027557ee048e8abf20c73d53fc952c6f5bbee8facc832

SHA512
7203853af0a60e38017b6faaa5eef1c7d978154888417375a9ade32168ba5685b47f4f98136339fb553f45994cdfcfa8de1b6ff09be03cb43f92b40ec1c0a6b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
408B

MD5
acc5282ed6c738901557da2d8c3dda1e

SHA1
a762ad71663730ac7ae1e339a4c44092e8212741

SHA256
b73ee71570ab3385b39643f422733b78988a6734dd47232d12fb44f538a128e0

SHA512
22fe7b99d76b4016300115414d6b216edbca5a8e7845d7bd0c3bf329043763d6ecc044cc5172220f16290ace51a16f0d832dd59d6958a91e73161accf587f560

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
1fafdee210ad555e1970d4fe4f847493

SHA1
ecea32ca49a85f069658dba6493af769efa65d37

SHA256
e2061c0b936dcce43c15f4ccc362d629fdf33e3ef390b4d391b8c5495bf9ef35

SHA512
a35f7b20ecb788cc26de35856c468979bb0d6ad075a46c9027976f0388c13badccabc9a0398361e1e802a481653d46d2abf0ee479e70d49126ab34c22cdd3741

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
98401335e25815b98e983e35dd685b99

SHA1
a5a38ef6523c7510812ff9ee91ce638e96dfb366

SHA256
0e1b901c8a6e2acc514aa618dc37db14bf564dcbe5b7b801532b3592fe21ba29

SHA512
df127e8a23f78863cc768d3cfcc4e6835204dbabea20a87210ecc301e127ed11af0c5e5953f606e5d060ae1a91dfcf6fa748dfaad6b75c2ad9c3ebc62d8258a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c05cf0153cb66b253b47b58a6c85bde3

SHA1
e3f25691b3eb1357558e447b4fa5de45cc739fb1

SHA256
7acd50a9ca8cbcbabe6a0566d50cf43e1636816e2b64554f8185217fb8e9e6a2

SHA512
c0372d77a04ce9139716990ae4915bf06682326c20cb1aa7673a8a223243c683a01dca24b727af080bff274a0ea267da88426d3dc8cc88612d8211dc1c2d169a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
361614af3bc25689f00d993c7c2d2e51

SHA1
38a909d99079f493b4b6d393d567e8d713682b7b

SHA256
a8dad80e0139cf9642acf986c65f0cc262efc4d85ac6e769d56d79779d07ce31

SHA512
19e30efd428e6e9b158da1bf987ae5a3259e72514d3e5c2d7bcad6a77d3dee1ab88b7e237861a369e37d76ceb2fa96c34f4d5b199294039f108ac53b8d5a3e26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273
Filesize
396B

MD5
8d707778df082a285d23d1c8e6ac3630

SHA1
62ea3b4d64ca7eaa2bd7b293534a57074c6ee6f6

SHA256
794620e5174a5731ee761d1fa44df392d569f673713d78d7d13d406027a67b1b

SHA512
0dd896d55a275b1bfb12ef660c35be562f8ab88e3a1c72884bf784c1f13a838823fda5cb6ca3871172fc2dbfc9858cbd6892619266117a880628079ec5fe6a4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_4A183155DB502CF599F3A8AD6680B8C3
Filesize
402B

MD5
f4c80661af6351da9d53404d07bb898e

SHA1
880ef49da4742abf8e969d1e1fdc6f21e39e0dab

SHA256
1b89de2c7550292c67e3586fd3319f14c1fe18b6a7a17c111d3ed56783642748

SHA512
0c4faea4e1c58d3fd9a5ded99a9813ea5896d2c394c7a24d446fae9a1107312823d4167d172f3ca02927c3c050071f6f45bfe963d6d273727e8e7bd247f57942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_5C379F3600DE745720AF61433A9796B2
Filesize
410B

MD5
78d22a1d5a989d5f3c5c8312432a2c78

SHA1
d026370d02975cd229cbeb763195c7d3c20c8169

SHA256
f3d42558c55a0e0b9beb881076aad23df412f9d692a5c863797546991c5a2142

SHA512
89e5ff09edc8776999d5e17909a2ab5acc99e24750bab97f76cdf690e9ac3de43e306b176fe39137e1a82241bb888c96549ee759921f4171ecd07c15d4a25303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_9E03BE143CBB35C01D53F353A29A88B6
Filesize
406B

MD5
576dd3ce205e74a83121c1c13142699f

SHA1
b20e86ff0a1d02c383fb1a075d667e0631c39a14

SHA256
7a5819518f7e4c7cae537513fdbd8206d671d2ba2f99acc8cd5f3f585c00ac4e

SHA512
bee601921ccd365ad84b02132820d7c379f5ed31f99d31851878db7c5945da2c35752f628e58305df459f425d68479146bff5bc7e9e300f9df6c26a555ac1ad1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
482B

MD5
d348484ade4fdb865408394c72d8ad11

SHA1
77707b18b3e5e05f6dec48827a807cb0b73227fe

SHA256
0078cd217aa2a30fdc63163de29d8891efa6b8ff43dd278c9d4c21a688836c58

SHA512
bac9e9e64d00d45f35448381480b1a660a992d7a0469fa2d1fe29df5253a583f87718da3ff1c68acee03f025ab5307e9a534a760640ca617c871f12272cefe51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
Filesize
434B

MD5
b52df4c607a06e69fa05de9bce2b717c

SHA1
2fb4e8b49f4f099e0111c509f0d439ea671dcc6f

SHA256
b0b51d61acd9ac406e8a985156e38e5f65f97d8602ab8c32be7a2cd892b3d27e

SHA512
0dc3be25273ac03c403b06d900b82abaf7528f63477ce541099be9e52e814b9956baaeca46559c3c4d73a957298e420a99633b14af01c4cd5568f75e4d3b2af5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C67047FE238D580B731A13BEA5F7481F
Filesize
480B

MD5
91ec85bbe129f96088bcec96f43d3019

SHA1
a65230076bea45f5d35b640922ae50ebfe82b2bb

SHA256
55fd15249389a80fc121656a17b8a2760d2dbe388792229cb1d4de5f2f9b2638

SHA512
dacceaf584e3e05fcb871036ecd48c0180976998edc42bfc6985306ca8d350542867345e7bb1964304c464de39f0fc6c53ec66cd002e7c0421484de32c3a84f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize
392B

MD5
9d110f5564d8c1aaa4c225d502daf514

SHA1
1ff28e9ae4286802f6a2dbf99dc921d76e0102b2

SHA256
f085747166b2ce93fe554c925d86a011674d7fe4ce01b713708294e36a7391b7

SHA512
95be5edbb34d567bdb0d699ecbfdac6704eaf6b506597a1bca93ae5bb198206bf40df472b991cbc5c0bd9ff249aa45bf77e195e9ff656c1c0bbdf01ceb372d9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_09D967865B5D6CF6242665AF4E214559
Filesize
402B

MD5
45a98934ecacb7eb9fa5ab3bf62cff13

SHA1
906c8bd2a0d227d3ec8375236bc83837a996e44d

SHA256
a648910710ce8abc9ba26d252cfb9b1367f30a800abb5ab65f87f1ea509405ee

SHA512
b62d740a29dc038cfae50b1db585976579f51a6abdedb1a527bf8606ab983e3fdf423f895650a4fc7ae2991e1a092bccb1a4efba28236935f87d6169238c899f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_01B1031F6736E831E4D73D2798F7305E
Filesize
402B

MD5
99c55125368e8f21ef055d5022f89d51

SHA1
d2d88a51f0a999f8da8c05c09cb87318adf55010

SHA256
679d6817824c25f4c4bff3c497c1572ff9264b83217e360e87d74efaad8f2d63

SHA512
d9bb389bbcfcf9a6fad3d11acca0f1278848fe2e8eaef77e0d4bb56aa40a197f55e8b5b04b688cb531f1d88240efa08caa2c84564cda78bac8237db5e61598e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_AED163394DA42A803964AD0D562C1BA5
Filesize
406B

MD5
f6ba806606b3d99233145ea1cbf362fb

SHA1
11f57e9444180b6d50f1ebf4b6d84f05ea2ad1f8

SHA256
26babe70063976988e67112d2b1f09cb18d9ed4e2b5bb11531a35a1d235fcef1

SHA512
3aef939483939da9428d3c4774ce684b8241fef1c375e620244d57938b4fe5f0f3682283f82701bcf1f3105e86e9809ce83aa531711d591210097a3832b42503

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_DD5E18651A85E635F184F73BE6D3DB70
Filesize
406B

MD5
ea74abd4532c0a3d11cc292c07dfb934

SHA1
fa1ff901d7bcf0853c2cdc3afec6fdaf6264f4a4

SHA256
b4fe6cbfc5c51fa34f009b152f236412d8fca35d30b9ec2009368b7e0159a30a

SHA512
49dd7aba6b7494d8f21c4e009347637853146a6132ffa6b4babaef7f2b7bb397a21e34f1c284917fc7e5ffc14839249f7c0f23529dd2ad7a2f2cbdb8cedd33b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
75d40319a075ea0e7b7dcf0e4a88d448

SHA1
918ac2795c9ce344057608f33318c9aa49293506

SHA256
dc1d978d3675262b1ce3046968464f94e8e7af7ae58fce543b8b27b7c93884f7

SHA512
c638f9d3a28ebf0d8ae20863ff9f3596220622ac2bf3802c5acea13f84c9cd216a81461e0395695c42398ac24729adafd55ad375e791789545fad882ea1a4fdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_9314CBFDE0A0789248250741A60DF9F4
Filesize
406B

MD5
4255c401c4c6b2d84a81db6b364838de

SHA1
3b28d9fbe887af238a986e9777f65803461003f2

SHA256
926415a3c0faac2e5a4ad6d2266bb2d30159c4fc45a3c8ea1e0b4a4121a98f32

SHA512
074ebbf1fed4b7c75787f3506c0ca361cfd075b7d5e62c267aba2f62c491860a4d4ea9187fc10fa673e2848a103d3cbaaacd6c9d3b3ec1957cbb8c6c624b6714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1
Filesize
242B

MD5
492d91954efef93de11be197c981b962

SHA1
747afae006813a8bc24b876edbef7eb7152ff374

SHA256
7991a4f350915022e7a239f885c475dcd376d0ed5748360684505a5a9372fb36

SHA512
e03a6d47f9197e18b17fc6a9a64c426e5396ef52c70bd303004076c9ba6a23fb3185d94353647e841f1921d19e00ff2839e1edf20d6bf468cf89d0864af6e8eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\9XN8LK1A\www.hugedomains[1].xml
Filesize
116B

MD5
854c79b3c6678c6c8979db223b39c13f

SHA1
ba1f919535d1c414ed4c2923185ac145e7f0b832

SHA256
fcb78a6bc4e381fa0964e383dfd5876055fedb3adfa65f861980f7acd08edc15

SHA512
c10eb4ba16d93c0af688c5a3382e2086956bcfecd1e85004adc830b1de1d4754f286e1765a6d8e3a03f209b65ee716450cd40f1a45335e01662d112aa650ed20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\9XN8LK1A\www.hugedomains[1].xml
Filesize
116B

MD5
6b189ea7cc5f1264e21ac2f37be46865

SHA1
855c3d810abef48401b8a8e9db3a21ec987f794e

SHA256
d8edb08197ca3b0eca2ec41ee9d52a21de45d1ae7475126fb5b5cfc6ba307fe2

SHA512
b8156569f44b8a950d1d8a4fa6050149665d9bb603d59c3198e6c63753ba39c2fedde8369c229430164f3a5a12049b371c73787b56486d4cb2d9d3644e230d87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\GQ1S1TPK\www.google[1].xml
Filesize
99B

MD5
983890ab118311d72f1ef37fea40cb07

SHA1
f42fb0bef0393d4a80baf27cb8b6ff35cf9450cf

SHA256
cf47a32baa279e797e5c3942e31e95c69f7889ff74650e2ba1e28aebc592db11

SHA512
0de86b9e837308159947b0c933de5e0d9070f3d51bec0765314b2265c693ccf2e84a9634a45cfaddeb1fb6686054e2e354a8271e6332cf94bafa8a856a83aa5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\JG2O99Z9\www.youtube[1].xml
Filesize
578B

MD5
c45a5f559462c7091015fc9194da88b6

SHA1
0dca897da49a8d6389f7277494b3915ccfd39140

SHA256
93c3bd02abf3585cb9160280d517ed2624a7631561a426594abc7c24a6d40ec5

SHA512
2586f4797b2441b84422a01ecbe0e4f64b01d49a0915205e6ac10d699634a5d795b827f6f01da6444b07f2e9caf6592ec5e88290eaafef67f8d6e864085ba952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.dat
Filesize
5KB

MD5
635fd22e4027d5c12dbaef35bbcf6282

SHA1
98f7875bdaa9d8d29b46dbfa5f2dd22584639159

SHA256
00867787dbd9d92b1272de8a226503ccb7bafce5309c504a34eb2a033f4349ae

SHA512
9f1944724b96888212a07e0246e7ee5fe6f696899a16058bb716ab597fdcb503d10c4de7fb8c26db7e32d71d0cea3872cf86e0ece84d240338e9bb7ad8f30f8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PXJIW9HP\recaptcha__en[1].js
Filesize
399KB

MD5
b2507198388fcc94ca9e94ed4c5561c5

SHA1
8853fc86f1c616bd20a73e3e24442036fd90fd2f

SHA256
02c7565a86d6d3a80295b85161d78fc88d8c79a0e314c0c7777570237a365ed0

SHA512
9461ec9b79eaf72e85744d4fba9f18b3d3f1f9b3fb28f30fc2392f5740e21eb11a73f15700e4d5c4af9f2b582c4efdbb8d3492d4a14e32a1e8715458c9e464d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0UWKZOTW.txt
Filesize
183B

MD5
7e705375a7e363d806f3c22ec5bbd327

SHA1
e0f238088d7542701a5a82d2897454a16de9cd3b

SHA256
3cf22ec155b7a9fb709a5a78d2e6fe143341d73d5eb3c32e00acfcb4f41ab159

SHA512
6adcd23bf21be021f146776624a5eb54a82d950a44df3374722e0eb4a694977f4e19bfd2f388c5003952b3fce2887ba0c599f3dc376351331e39699c578635b7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BJHZ2G4N.txt
Filesize
601B

MD5
028d094642212a6fc7b6c4ec4768a32a

SHA1
643da11fa4f49523f29b02a310b7edf481cbbbd0

SHA256
4054ed73837542e5f483b46a2ed17de8f4f75081fa54df22b32c6e0a4927174b

SHA512
c67aea1f44f62f977eaf6821535a30fe78ddc43ad3ebc24b99d197fce4fc52a31440f8ba647fb38cc85de29c3dd054b860494f8aeed493c85cdcc9ec09214579

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\S1YTVKGT.txt
Filesize
97B

MD5
2dd03941df4ea4baa276b75dea785327

SHA1
7efaca8f411e47b7e74072a84bbd0394eabed194

SHA256
d49c0f7816e222accbe98042aafe32fb8c6c7a1c1ef5580dd4bb5fb51758a172

SHA512
e30ab52a31c85128bd4ffbcb8c02b521b7c2a1393b751d563c809117621a0402e6079686bd155a1cd988d3a994dcbfcd71c9ff214b67b42fdf5a67e86c4b1cb2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Y49FZX7A.txt
Filesize
118B

MD5
c99540eec29fe59eac8f8fc05f81b197

SHA1
a665ff3308a180a1893207ce153e2d6bdd0e94bb

SHA256
2dc017744eef329eeb08c8fd4691573b065fb7cbd485c71edbc3487367e0047d

SHA512
46be6cc6dee27ebf0d32245978ca14eaccd74efd1ad13a02a86e561884fb8dee6c0410999a93f9a4db46cc402f344c54455f8681b3c8ed42fae8b75ab536e765

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
490KB

MD5
72ae352492e4cafefa98c8196a719b0f

SHA1
7d3259dde4abc30529a23ad1c5a4ee7b7f43f560

SHA256
85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56

SHA512
b7b8b55cf2c677ad697a3b37eef54049e7ac8d8b7b4940bf6a0236cffc9072955632935ceaa025c8c9adb2b6295e1eae969a08507171723c627026f523849962

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
490KB

MD5
72ae352492e4cafefa98c8196a719b0f

SHA1
7d3259dde4abc30529a23ad1c5a4ee7b7f43f560

SHA256
85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56

SHA512
b7b8b55cf2c677ad697a3b37eef54049e7ac8d8b7b4940bf6a0236cffc9072955632935ceaa025c8c9adb2b6295e1eae969a08507171723c627026f523849962

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
490KB

MD5
72ae352492e4cafefa98c8196a719b0f

SHA1
7d3259dde4abc30529a23ad1c5a4ee7b7f43f560

SHA256
85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56

SHA512
b7b8b55cf2c677ad697a3b37eef54049e7ac8d8b7b4940bf6a0236cffc9072955632935ceaa025c8c9adb2b6295e1eae969a08507171723c627026f523849962

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
490KB

MD5
72ae352492e4cafefa98c8196a719b0f

SHA1
7d3259dde4abc30529a23ad1c5a4ee7b7f43f560

SHA256
85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56

SHA512
b7b8b55cf2c677ad697a3b37eef54049e7ac8d8b7b4940bf6a0236cffc9072955632935ceaa025c8c9adb2b6295e1eae969a08507171723c627026f523849962

Download Submit
\Users\Admin\E696D64614\winlogon.exe
Filesize
490KB

MD5
72ae352492e4cafefa98c8196a719b0f

SHA1
7d3259dde4abc30529a23ad1c5a4ee7b7f43f560

SHA256
85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56

SHA512
b7b8b55cf2c677ad697a3b37eef54049e7ac8d8b7b4940bf6a0236cffc9072955632935ceaa025c8c9adb2b6295e1eae969a08507171723c627026f523849962

Download Submit
\Users\Admin\E696D64614\winlogon.exe
Filesize
490KB

MD5
72ae352492e4cafefa98c8196a719b0f

SHA1
7d3259dde4abc30529a23ad1c5a4ee7b7f43f560

SHA256
85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56

SHA512
b7b8b55cf2c677ad697a3b37eef54049e7ac8d8b7b4940bf6a0236cffc9072955632935ceaa025c8c9adb2b6295e1eae969a08507171723c627026f523849962

Download Submit
memory/928-68-0x0000000000000000-mapping.dmp

Download
memory/1496-86-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1496-107-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1496-104-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1496-91-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1496-87-0x000000000043AAE0-mapping.dmp

Download
memory/1496-90-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1656-105-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1656-77-0x00000000004176A0-mapping.dmp

Download
memory/1656-85-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1812-54-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1812-59-0x00000000004176A0-mapping.dmp

Download
memory/1812-58-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1812-61-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1812-57-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1812-62-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1812-70-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1812-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1812-65-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download