ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e

Analysis

max time kernel
146s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe
Size

1.1MB
MD5

922f13354a57e00020a78680d844dc0a
SHA1

c2e6c1bdfec4593c6d30ac3cdc530be2fc6b35d6
SHA256

ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e
SHA512

b78f8f3bcb6202e0456efaeb379f3c39b637c74203a13278204aa20a3a9c57e77926d678bbc047af0eca3285b1397999cc7dd73739ef85d9841289b6f2a823a0
SSDEEP

1536:7I17SYMoQEeZ3tmnunbHq7eOHc3Hbuk93VMjBmGQSbcW+gZ372Fc0h:i4otehtmnuLqdHguq3pGz4W+g

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Executes dropped EXE 3 IoCs

pid	Process
804	winlogon.exe
1776	winlogon.exe
1964	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bs120.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gibe.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweep95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc42.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonealarm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostsChk.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GRAPH.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsynmgr.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldscan.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sd.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweepsrv.sys.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2Fix.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ave32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwin9x.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscanx.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsched32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleaner3.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fch32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvarch16.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardgui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleaner.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntrtscan.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\proport.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmnhdlr.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ecmd.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ecengine.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcscanpdsetup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcleaner.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spysweeper.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSHTA.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirus.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxmonitornt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dvp95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luall.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trojantrap3.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOSYNC.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SandboxieDcomLaunch.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonalarm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monwow.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Process.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2servic.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jedi.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\platin.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spyxx.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\undoboot.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hacktracersetup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpf.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsgk32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\realmon.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deputy.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	winlogon.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2040-55-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2040-58-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2040-57-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2040-61-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2040-62-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2040-70-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1776-85-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1964-86-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1964-90-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1964-91-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1964-104-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1776-105-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1964-107-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
2040	ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe
2040	ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1228 set thread context of 2040	1228	ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe	27
PID 804 set thread context of 1776	804	winlogon.exe	29
PID 1776 set thread context of 1964	1776	winlogon.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://7ri784un539i995.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1174"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1966"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "282"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1092"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1245"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "282"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1029"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1993"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1936"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "254"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1059"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "197"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "9461"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2138"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "9351"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1999"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000008b6cd2b7aed36394858d00c1d4545c9be026de8824d61f9d3159857495201255000000000e8000000002000020000000765812882780ba273d4b90236ad66b36916d789fec8ce067b8609c73fb78510c200000003d2e064ec45329699bafff8698372113f7052e07c830b7d9389a955a99de0331400000007e63abd15ef822ff3487a982152a81de941e18e68ad15fb1be2ba7d21a4b7291de129bb20e31ed920724a4128bf3074941cb037571fd339bd69c1bda9a012c4b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1149"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1180"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1149"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1092"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "10377"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "254"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "2081"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com\Total = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1180"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1029"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9408"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9518"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com\NumberOfSubdomains = "1"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://clpc733r7p9qqx2.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://b99ll599cara49m.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	winlogon.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	winlogon.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1964	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	1964	winlogon.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
2040	ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe
1776	winlogon.exe
1964	winlogon.exe
2012	iexplore.exe
2012	iexplore.exe
456	IEXPLORE.EXE
456	IEXPLORE.EXE
456	IEXPLORE.EXE
456	IEXPLORE.EXE
2012	iexplore.exe
2012	iexplore.exe
1464	IEXPLORE.EXE
1464	IEXPLORE.EXE
2012	iexplore.exe
2012	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2040	1228	ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe	27
PID 1228 wrote to memory of 2040	1228	ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe	27
PID 1228 wrote to memory of 2040	1228	ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe	27
PID 1228 wrote to memory of 2040	1228	ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe	27
PID 1228 wrote to memory of 2040	1228	ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe	27
PID 1228 wrote to memory of 2040	1228	ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe	27
PID 1228 wrote to memory of 2040	1228	ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe	27
PID 1228 wrote to memory of 2040	1228	ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe	27
PID 2040 wrote to memory of 804	2040	ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe	28
PID 2040 wrote to memory of 804	2040	ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe	28
PID 2040 wrote to memory of 804	2040	ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe	28
PID 2040 wrote to memory of 804	2040	ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe	28
PID 804 wrote to memory of 1776	804	winlogon.exe	29
PID 804 wrote to memory of 1776	804	winlogon.exe	29
PID 804 wrote to memory of 1776	804	winlogon.exe	29
PID 804 wrote to memory of 1776	804	winlogon.exe	29
PID 804 wrote to memory of 1776	804	winlogon.exe	29
PID 804 wrote to memory of 1776	804	winlogon.exe	29
PID 804 wrote to memory of 1776	804	winlogon.exe	29
PID 804 wrote to memory of 1776	804	winlogon.exe	29
PID 1776 wrote to memory of 1964	1776	winlogon.exe	32
PID 1776 wrote to memory of 1964	1776	winlogon.exe	32
PID 1776 wrote to memory of 1964	1776	winlogon.exe	32
PID 1776 wrote to memory of 1964	1776	winlogon.exe	32
PID 1776 wrote to memory of 1964	1776	winlogon.exe	32
PID 1776 wrote to memory of 1964	1776	winlogon.exe	32
PID 1776 wrote to memory of 1964	1776	winlogon.exe	32
PID 1776 wrote to memory of 1964	1776	winlogon.exe	32
PID 1776 wrote to memory of 1964	1776	winlogon.exe	32
PID 2012 wrote to memory of 456	2012	iexplore.exe	36
PID 2012 wrote to memory of 456	2012	iexplore.exe	36
PID 2012 wrote to memory of 456	2012	iexplore.exe	36
PID 2012 wrote to memory of 456	2012	iexplore.exe	36
PID 2012 wrote to memory of 1464	2012	iexplore.exe	44
PID 2012 wrote to memory of 1464	2012	iexplore.exe	44
PID 2012 wrote to memory of 1464	2012	iexplore.exe	44
PID 2012 wrote to memory of 1464	2012	iexplore.exe	44
PID 2012 wrote to memory of 2540	2012	iexplore.exe	48
PID 2012 wrote to memory of 2540	2012	iexplore.exe	48
PID 2012 wrote to memory of 2540	2012	iexplore.exe	48
PID 2012 wrote to memory of 2540	2012	iexplore.exe	48

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe
"C:\Users\Admin\AppData\Local\Temp\ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Local\Temp\ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe
  "C:\Users\Admin\AppData\Local\Temp\ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:804
  - - C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Modifies system certificate store
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1776
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Modifies firewall policy service
        Modifies security service
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Windows security bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Executes dropped EXE
        Sets file execution options in registry
        Drops startup file
        Windows security modification
        Adds Run key to start application
        Checks whether UAC is enabled
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Modifies registry class
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1964

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1820

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:456
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:4076554 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1464
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:4011051 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
76e7d5bf61b2e80d159f88aa9798ce91

SHA1
32a46de50c9c02b068e39cf49b78c7e2d5ace20d

SHA256
280fd6ae3ad21323199759814c4dd82329eb8f9847ed1fa2be145e83b4c88bf3

SHA512
5efd8c64ac40ae006d2ce4509eb9e5f1448fb1156e914d303e8bc4dcfe1d94c57c7eae216b362877e7b644876656cc9e5c4cebfc905bab3f8b09cb1a051d69c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
1449add840e9160cae5f5b565c634b70

SHA1
dc889a8567e97e99d8b3186975f6b969de5aad6c

SHA256
ab53d0cb3f95f86c66a7e43185e7abce5c80b18270ebe804cfd73a7249174d36

SHA512
192c3eee32ad50022f2f561f4e08c03bfacd7a891e7709e5528ff2641d02a84deafdfd9deb0d086c02b4bedcf8ebf802746f1814a3b8f70afd309695181f4d83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
a0fe20d41a043db700a84924cd9793f3

SHA1
c0da481fef6cd00558f6e68b074acb34bef8292f

SHA256
03caeb65ab9e22f6d6fe0d344d327950d20ee9ed144e2da0e5e062943a03fc56

SHA512
f9de5b16bd1312dcab9ae06c0a39a295a79354821552b39ee48bb456b42b7302d27e9d063243d3766cd0c2bc47255dee21eee7036b99e1c4df02f1c335e204e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_7D0866F648887A7BB8C83FDD7893DE3B

Filesize
472B

MD5
79840cac9f5ae1a38c0faaaf59e7fe82

SHA1
f76a3e50f566269c574e7f8904021640366dcc56

SHA256
1f39ccbd6ad4a9c8fcc3e4d7d83c4c21f9e9fd9fd0d98c6b70cd1bbbdfeb7798

SHA512
acbe9b65b51869d0001dc17eb39f805ce432b42852a9a64700ff6ae4dc4047eb3ab56ab84fadb62869dea523a5090232dd214be158044053c9fdc5f71ba6dd3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
49e0088d07f2111450eb49fc09d0d5af

SHA1
bc9ac6080bdede0b82956839a50119ccc0dfa814

SHA256
fdf1f917e45da0c06722f174bd2ff3f82ce95587bfb117d296f0e6a64b697198

SHA512
865242e5298ec34105538ec27967111a6845c6f02d6f53789d25133333379e612569d2baeca80d70bbf63f64d9bc1e203c657d2e3761de4a141ded3ac95f86dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273

Filesize
278B

MD5
356592e4277d070ccdf9234c8256b15c

SHA1
2585ebeb3edbfc1456e2c7295b3dd28aa93ea0e0

SHA256
8fc1811ac03a8555bd01ed178aec1164d7dc1ed0e1a68f9405f7eb2b83ee816f

SHA512
4dc925c1dbf405fd8a76a1772bf05386d9df5aa39c863cc38660eb095ae9a85d029ea5fe3e7b555aed649a176266925a86d8ddad0e0179ce4a73713e5fb00a14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_4A183155DB502CF599F3A8AD6680B8C3

Filesize
472B

MD5
abd55ecd24d357a9f02612558f723a90

SHA1
6a1e6963864f0b53ddc6205d35225e6cf0bcbeec

SHA256
195fa531e0462be58d5c62ebbe6060e147c94bdb1d38ff46c341c74e0ab2671a

SHA512
cb3c686d37ff9a745dc1f9911e1d96a190663901c924427bea181c306c97e7b848dafc2bdeb0fe74a5dd9d2410f0b3bdcfca6c7452bb94f8f3dc246117d993e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_5C379F3600DE745720AF61433A9796B2

Filesize
472B

MD5
49eee25f3ccd585a29e34e80cf5bb160

SHA1
73eca8be91deedd049304862759a3d8084c0b07e

SHA256
531e5685527861b3ed7e8e3865c5a6a40d3f92f5c9d89df3f385dab72406fb56

SHA512
cea31266e051a008b3f83db472133c935c678a39ffd67d4120e9e57003ced14edca570f91c64d4f5bb01e0a04f36938626fd78793047eb389c13cda98820dacb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_9E03BE143CBB35C01D53F353A29A88B6

Filesize
471B

MD5
adfbda7064ce1af33c79082f19313ef7

SHA1
bbebe430db09713237a6d65a8aa444fa57085030

SHA256
1a3245b91bd33b605b9cfec7c8419d22a1c72b4432e44bde7ac7941653ec3aa9

SHA512
27fdd3b1ff410f2130a97877f3f53fd78dd49dc33ff3cebc062f107a221b1d6fae6a7b1215b9046f60f88fe2c367577caacd693290dd78eef0c8f685e6c910a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
916c512d221c683beeea9d5cb311b0b0

SHA1
bf0db4b1c4566275b629efb095b6ff8857b5748e

SHA256
64a36c1637d0a111152002a2c0385b0df9dd81b616b3f2073fbbe3f2975aa4d8

SHA512
af32cffea722438e9b17b08062dc2e209edc5417418964ead0b392bd502e1a647a8456b2ee2ea59faf69f93d0c6ea6f15949b6c30924db7da65b91cb18e8dc6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
471B

MD5
0d675e3a5e6e3cef2a9a20bbbbc6bfec

SHA1
31a2eaaf5bb232d7e59a5c8563825fbc166c602a

SHA256
c3a70ceff41527f057ec6bb029fb199b11243f9356858958255e6ef3c93313cb

SHA512
3fa118db0bbbcd4f5343f0063550cf9fce29f853ceeca0f5dd49f2119daf8f0d7adbb101167722112d932cf2db8d3320dc863a84b2bea6684bb278e52f5d049e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C67047FE238D580B731A13BEA5F7481F

Filesize
472B

MD5
cfbcb12817712d4f8f816c208590444a

SHA1
9999caeedbb1a95ae4236a5b962c233633df6799

SHA256
b5a41ab77d5ff4ba1a17ff074eb91bc18824d56dfc4b6c3320e900bbd6f3a90a

SHA512
a70eb8c366dfa0226cd62dbffbf51bd2da25571a6ff6b1f2e44dd8d9193a72f79ab7d90367378edf808ff3152ca45bf2a6ba3d64882d0f6d4aa437b6881d13f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_09D967865B5D6CF6242665AF4E214559

Filesize
472B

MD5
30462b52571c91f089bed4de98462a46

SHA1
7e2b322ea5b8f97b2fa76751bcffe2a420f872eb

SHA256
c5403dfefa9d043ac501963ff09a6d3d70e21f6e6a1b9728183a3490060a4bfc

SHA512
dcdf248ca5a98017f5de9160c15b51c16a4ef358dc0580aab15acdad62c9256a33203b1624d46d6ecbd37139b4ff7e03f28a94f5b2ebb52ab49cdb96b6b4eb8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_01B1031F6736E831E4D73D2798F7305E

Filesize
472B

MD5
f50fd635895870df33a17fe377a6a038

SHA1
dd65dfbbc810b095432cfd59f971af04a9e31ab7

SHA256
ebd9b6c3f67865c297d08802839c940994424000df3bf8a3f1316b8e13666e94

SHA512
944ca1f8f6057ff1238d7704f5b9b69d26f747326ba2fb1594f0c52c0abbee97b9e38e424efd6b1772c99007d238a25113d7890873cd7f7c7ad590b09b265fb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_AED163394DA42A803964AD0D562C1BA5

Filesize
472B

MD5
f1cfa609ebdf236e2f3e3ff25dd05caf

SHA1
c8117b0187d4d9021ed1a42907bd93d24ed4ebf0

SHA256
7a2761aa36168d4f2c9034486777f5588aaf0fa1f7d1e55006db7320259303b3

SHA512
986b429c2370146c707e96292da19cbb6ba3e8033f749489114cebb9df7c6d5760b7cd8314ae2bbe67f4c09241e90779cdd59a14d27b88a3e7497e54366987c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_DD5E18651A85E635F184F73BE6D3DB70

Filesize
472B

MD5
07b8296613be09905e34b09dce4a203f

SHA1
c97c67e8c4b1247423d089c028c31e05734f124e

SHA256
c8c7b7cd00d5818bbe4a4ddb1b734a1b766dc6474cce300171bd5a0947adc6b2

SHA512
7e9fc9826fdd1a31719cb45f9ac4ae3969f711ea77cbef66e627003613710710c14a208576fa3db38f729a91b5782fd38d5fbdf9b6c89e95a9d946410b9cceac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_9314CBFDE0A0789248250741A60DF9F4

Filesize
471B

MD5
998e0b25e77b8c23e52ea918d3fc2a29

SHA1
0f684f95e3c60ef17ff082bfda21de480eff9fb4

SHA256
360e9b02287b38174bb5bfb64862d049d9e4f998ef8aba036a1bc97bbf30d606

SHA512
8e195bbd52662b07183232a9e7b1616709474a79c6261c49f230c08e9076e4a47d60231caafbcfe0c70a6b4081137b5a75cb40d06196f8345d2e8b796a68e7cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
183838e58adb6173ef45d2754b361a39

SHA1
3e198ade9197fe5e5e4e81082fcf288c57a28cc2

SHA256
5772cba4ec128e938900290e3dbd2c0124b72f3a6a348d78172a5d29a27a091b

SHA512
8f1b5a6d864b546d7d87f882d3e698ae51154ece2bc6cd50a969c98c90802b298f4a94c45998b22ffa276ec50d5c95d513bb118f3eabfbb2d14e887814325736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
11e8e1ee36437bcc3cb037b75fc31305

SHA1
63bd5c51f17fb0123397ca5e5e0b366651ac1ea3

SHA256
8025303c52c6e3015bd6d183456f23464a5708fe44e727baae58a764e9d5f5b4

SHA512
86b0f4ecc75c7c99ed966b06f325aeeded5cf4202e156f760dd7eca4591f90001a872885880d403095b3c0b5760fe46f48631a794a0a1f0a86f3533c5668d80d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
2e89923ed5707816415fd10cde793529

SHA1
64d695c826e8baa3556457ac1ae01a200acd36b9

SHA256
9b19c1b749e822dd140768529ca65991e7c3092bb392b53e88b8fda67df2d434

SHA512
2151f5186cfe4689d94b1c564ab057a146ab4627883b7e8e401a1bde6d5f8e2a7b73f5b6cde4a37c7bdbe3011d25ce76e55abf495e339b7d8d8bb4515ad8c1a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_7D0866F648887A7BB8C83FDD7893DE3B

Filesize
402B

MD5
6ad41a766693a1212aa691d6eeed906a

SHA1
009e2b1db4d915d82e29b061146832293896d366

SHA256
c97cc19a50351304438fa1e20320f18caff3112a05560d0d2baee5fa4f974260

SHA512
7a93079656c417aa1cc4fb3e4c38841b9e0980da37be322a5d3463c54a25f5f51f635b93c61e50a346f24765c5ef5fba4841cbecbdf8b1c3a3a211144671eb12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
438B

MD5
503ed06c3d944b83103163c5ebda0220

SHA1
a1f6bc472823fa3de8665a452317aac6888128c8

SHA256
098030bb232450156641e1c39f83204c1fc3d2d9fc262a37d431ff7b88140c56

SHA512
46cde9c93b1d899d9f73dc4667cdfd8b41949d30cf1f37dd0d8f7073f7f026913e9858359780d405a6f073a6b2a76bf08be2bd47fc1b09d104f79e0d77bde250

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a302979d3541e47747e7af24c01d9be1

SHA1
94f8b06f63ebff181a3bdae84a3a668d28f6b567

SHA256
b4be6a5743ae8354ffacd3354c90ab979583da36c221df877f5474728b7f4b69

SHA512
7716e21be46e4989305463bb05bccd2a70a6f29b6512aad3778a871bbe69b9405cad8de8c79d961f190ce87b5cac22a05ddea33cedb5079685c8fff372889098

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f6f62de8cf3603f12344b6494da8e63

SHA1
91c3144a54b12012cd2b8210cdd2f125d330f1fe

SHA256
97d90035eb78036cbaad1eeed8004973258f44159abfd529a53745de6117133b

SHA512
7341f4164d853d17f95c63176deb18da65589e1f7144057d07bc93550a8f932dbb6e28dac3aa90eba06c46f52067a90d71db5407dedd3fb5138a65e8642ec86e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
984e3c263acd4d4cb49bd3ea300708d9

SHA1
ee64b2f0a15c610710ee18747ea52b159b6b05ad

SHA256
8297aca722853fe47283e448579e155b702a7c49bc4fb1db1631aba81679864a

SHA512
36d8e91100da09535e015200c2b2768a331f2301d5a2d29d3261155f784067dfd4e322f1b19d2cf46b52969282f9e094788acbbe271f1fec25e6b4800144118d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
606de47bb389f990b2f109f5ffbf0872

SHA1
c24d96862ae6c36373af8643b4e3f3398488aecc

SHA256
af460735b9feabd8b84f203835df48cde71b884ab9039916c6c726157bcb1566

SHA512
7c54e3a6e915aca79ba1be3ea49e3ba96d74815bd93388104e2d5cbb1584d90ab65e09451dc7be95a85cf1e0c3013a8cee6d510f258d968e71572a88aa672147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273

Filesize
426B

MD5
f6c2fcd581480a40a1c12bce2a915866

SHA1
e70770be7680283d71720b7a61d9ceffbbdf0d03

SHA256
8d924af09eea2578d6a1ae75290f0bcc0e9a5485ad22f238ceb1eb50605220bc

SHA512
e29c018aed68701ddd0f3b1c7f78962afa3d8da1282ac8c881189719e327f294752d94aae3dce82622bd0818e5b0058cace35ce826b6fc5f429263ddb0a9b4da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_4A183155DB502CF599F3A8AD6680B8C3

Filesize
402B

MD5
e6eb6e0307cc359891f82e08061b953a

SHA1
5df322bc7f924e2b4fb6e02b12d0aaa5273d1d9c

SHA256
821b88f65a31affd672c5f5a4e840c40b4db79a1772ef69fe2bd4391e5b6e32a

SHA512
c821b9f2b0408ede2f06bacebe5861d6589520720b850b7a7d13145cb3462f133e3dd1fc89b70b0b8584ba0a9a652c45fb81f758b2960831ffb51419436e5eba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_5C379F3600DE745720AF61433A9796B2

Filesize
410B

MD5
8d5dc6d757c5d5128c0c2e2dd45ba50a

SHA1
66cddac525febc4becff49586629281467125a04

SHA256
077b79b0247679d709dcc415e6345e509aff156a188264c40aeb396fc40daf32

SHA512
05af2339b21e3e0a4cb2c1d66471f21cb2c308e0e48cb7f4469250a6bc2d3f5b3a232a418384985d29fad1b7d53a53908964e04bc4b3168d531c4dc77244de1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_9E03BE143CBB35C01D53F353A29A88B6

Filesize
406B

MD5
2978bd789a6040d48ee61bb9ae13a1d6

SHA1
335bc32a597da7496337ca5069c5571e3c06c957

SHA256
31ddab962ea3af8b51b5009f867eee0312d4caa667c25cfb0c06c01fc28c4e10

SHA512
408756ed0f602dea2d95cd204b85f29b7006301855c9b2a7b4dcd5957f355e527d174a6589d134a5234e67e2974416e5a547871c704b9cb9dc3fa495fe46b112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
f1abdbd3d4a171d00eb77af5d09e9c8f

SHA1
9418a10aaf3386f1b648ec394d46eb60010ac4c4

SHA256
50450067d6c07d861bdc3e9c647bc497d4995a15fc073996dde7b64e8a6f85d0

SHA512
8f88e95a73e9910df5814b4d527d530f0ba022230d507b64aaaf53d379a26739218b8aafe396caac29798321786c63ab34ebe5a6056f14a759022d656e2e15c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
434B

MD5
742afc7dd9a57585c43fe9d4047e90fe

SHA1
8d228e6e98fce34355c4dd44cb885933d675d503

SHA256
614919021f0ffa3b7f2c8b064cb177999f69c604f48b8161f4dd08c02380f78c

SHA512
3a2294b3285a06a04b2f4eaec081d15e421fdc1f050315fa852f46c772ee39dae7e2f62095209023511b633a454dd4977646fadf15368d33086b35bb4831d957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C67047FE238D580B731A13BEA5F7481F

Filesize
480B

MD5
0b163375a3dbbaa6bd9f2a7c53972404

SHA1
ebe83a7bc7f928b18b64e10bd67ad6b71ba2eb44

SHA256
5048e2d5a4dac0e7f32ffb2ab91bc84b1a2fcc8bec809cb8139ad60ccbc0f61f

SHA512
10e10ef36f787f9c8ad1efb9bb1102fd754907de4eca5e64abf1e36e59237e881a259abe861736f63c69213911254352edf892ac60c5eac53c38b58318066d37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
cb78697c6bef14b0b82aa395b7e5a64b

SHA1
eb7eae9a33ccf3a0d276908ea31343b15fbbd25a

SHA256
153a1cc5c3276d499cebb0266b72bc4f67477a9a8af475cd79bf5c3cc5203bfc

SHA512
0d3dea8920812cf47219229aea6dfcdc1e6efe03e97dd4d05c435e46377494fb8056a57ea44c6dba0628114b4a38ee45e735c6e11e62f53145adbdbda0ccbd76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_09D967865B5D6CF6242665AF4E214559

Filesize
402B

MD5
fbff1a8a6404f0c059a7739cc21ae2b7

SHA1
fa7b8be73c327355521717d1edeed411636c319b

SHA256
c6c0e3e92cb649d83c041f9eb3b9bdd220e895efdb5dcec7823f6d012d078a18

SHA512
3d0fe8e752a5ff3b39445e1cad2d1cb13fea500c9ec71efcc35c8e81f37f2f629b7e037c322b594ac31097d61fe5a633ad5bd26d3b628297e796ba7db6318c6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_01B1031F6736E831E4D73D2798F7305E

Filesize
402B

MD5
6adba65cd0d29ee696456a760bdbc1f2

SHA1
6400681380c940974f66b4991e77b809f6da88b3

SHA256
6048d047db8b31167614e74df7507ffc5c076906be5d0a13fda5b1c79daf9f2c

SHA512
21e2d092ce11a1a1d70ff0001ede8b62c0e3742ea1a1f88e75b0010f3b68a8fbf2a9311bb1db2219d0c386d38ef54ebb56d625c2c5c3a1a7304b05574fbe36ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_AED163394DA42A803964AD0D562C1BA5

Filesize
406B

MD5
da325344cd7e0f22b27bf1a4bd55442c

SHA1
d2ca9011d7634378c2da92d418f1bd07234a9b9c

SHA256
e42d7a423ab926adc37e95696ad641a4e79d2e51ccf666bc41d8bc7139dcb350

SHA512
ecdd61beda1d339a9d36990f132e0c1b2d4306c203416ca8172d86092fc7253f5e011b79f2696ee77028b0513691da1165b67cbbfc7fd6b40099082151b13d6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_DD5E18651A85E635F184F73BE6D3DB70

Filesize
406B

MD5
83c4daf6732ee4797d675a7fea3c116d

SHA1
bac178a65fa2c40618ec70a0027e0ea194e4ba20

SHA256
b64d09f78fdd3ac5b1c4101c2a5f6fe6b6559277330d4a3236a89f07a594558c

SHA512
b829c9faf4e38e5978be20f6b4659427010cb8d65c37966b4ce7f9549e15ea5af3cf7e7ef63953d6f2c704817f37939ccea9c9961c14c0ade43db7af814f5458

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7286c8bfd10fa5fdab67b39a104dfc7d

SHA1
fd7c63c86ef45980f826180094c7dde15feb5a77

SHA256
da4a8be5080d5e3f95e8f5f6fe1e12c9d32050dabc5636793bcabaf140ea347c

SHA512
d1ea4142d321051d231735da6801f160858bc66c515516e1999729c2e49e347653dda588f3fc9cfbd76d04431984c6ba08651a27a8752ce248f219dd2ea36461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_9314CBFDE0A0789248250741A60DF9F4

Filesize
406B

MD5
b572ec9355605e689b62ab193394143a

SHA1
41e3c0c79a3be0465c17b6e9fca73d8d276774bd

SHA256
d43ba92a7c0d3fa1797d3c599732cbfc3641f5b146ce8618e37e2b2d200def64

SHA512
8c05069888d8c826dbd8caf64806d6458c6b229e402f023eaaac25c8ba3207e0d943b865933506121efe63986a819435693a6ddb10a5205d937794490214318b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
7bd085596e2ed9ea899e1628edfc5f26

SHA1
e85e495a93c0c1d4b4182de6f3c7b04379b0ba90

SHA256
c6155f63487be779d3f53bcd5d4443f79204ddc791120d11420e345e4bdf70c6

SHA512
e5af657aa45f4439947c17bb35847036ee306b28abfb6e0e7724b1ae012c6972c328d4a9a15f8279daae2f8b922cec2b52ae689ae0ad7db5bd2e85bce9d3e020

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L081U3X1\www.youtube[1].xml

Filesize
1KB

MD5
bf99ac38f6933017248306d250b6454d

SHA1
6690a12fd6814803101a70d837b92faa4b6191f6

SHA256
c326f637a409d9bec318cd75b4e95844ae06b9ff6a5b31c2e727cd7a329d5998

SHA512
6ccb1f8752b15c0bd97ea31097cac8cef2bfcdea88950322d2e3dd4b4bd99cc91848d154b27d0b68a2a0b4e269dc1845a50dca8a2fb3b39d0daaef6bf285c5af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\L081U3X1\www.youtube[1].xml

Filesize
3KB

MD5
ee2d69ec4f9b3cad6796828bb32edf71

SHA1
d8dbd4e985fff26e85521af36c64e74c0e686af4

SHA256
7ef667f915eff1e0fafa28263ceffc42cc66d082401666b68da95c1c44d41804

SHA512
62362adfb7186e3bcd7e93afaa641206756d9b6a9db047806b1946e0d37fe971681a6a11e47b814c8ec9c6e4cc29f13f6e87f3d4323562c1e7e8b3b28b4ef871

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\T0I2A0RL\www.google[1].xml

Filesize
99B

MD5
2056e60549e3965c80d03e575f9bf8f0

SHA1
33f13d5b4f74d77a667c257849864810724a7f3d

SHA256
ec173ff427142f5afc71206db3b172aa744f1184e40ad4054709bea679876678

SHA512
7afb300a2aea4d3d20311283f16e62c4fa3fd34af9f63d82118a2bd2de851f030c84debccc464d0df1964753b978b53d5a13932ae6d87d80556722f6b3ece56a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\UE7S9V92\www.hugedomains[1].xml

Filesize
116B

MD5
cb578310b2903bc8478d566f2bbca69c

SHA1
524ca5ba5f6306330ec91a40cb7e59aacd967e44

SHA256
3525d46512c65537f05f3bbcc93df7ef0d1e379d23903e865dbd9078319cb527

SHA512
97572a9f84e3099a66af436a685019a9784c5ef2b87f4eccd15d75a10bdbe2628e0d9e6613c0d21465e31f3451ccef57ccd5604e97f0be202cd874962c6b7c61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\UE7S9V92\www.hugedomains[1].xml

Filesize
116B

MD5
0a7355878c1bab178c6fabb8959ce363

SHA1
2cbcffcbc3fd410aa16c58c41025059a0e234109

SHA256
68f9e1cb51e273fcbc8936b45f819f39303e76cc46e23357545c40932f273ad0

SHA512
0659cef1768138fcb2413239cdc12c48963321181cff7f08483fabd471eb792a4f826c682e68a024bb09c2491309cc0b10f7ff83b762ff9fd5e2e433e8678298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.dat

Filesize
5KB

MD5
08352b21f70348d78c2b696dd8144a4a

SHA1
62986022a566052fe7e070f90fb4c12159a8b5c8

SHA256
acbfec6893803d06d8c2417726ce4c4c21af29a7388af9bba0f9545610becade

SHA512
f33f30c33d5f61d1ce1364db02c9f9b1ae2598745584e1afbe38eb89e142e90ba00f2a5b015fd14540e2de35752f57a343e1e6589389dddaed21e0976eefd298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TAR9OKL9\recaptcha__en[1].js

Filesize
399KB

MD5
b2507198388fcc94ca9e94ed4c5561c5

SHA1
8853fc86f1c616bd20a73e3e24442036fd90fd2f

SHA256
02c7565a86d6d3a80295b85161d78fc88d8c79a0e314c0c7777570237a365ed0

SHA512
9461ec9b79eaf72e85744d4fba9f18b3d3f1f9b3fb28f30fc2392f5740e21eb11a73f15700e4d5c4af9f2b582c4efdbb8d3492d4a14e32a1e8715458c9e464d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5302OP7M.txt

Filesize
97B

MD5
f8ea2cbe1586207bb7cc313289e5247b

SHA1
3538346cdafd4adc3b4f0ba273b143d5321999d6

SHA256
d3d89663a54471c57729a9f376e5c5748a656427034c0c42ee82ab907a90ad05

SHA512
4877816558fbb9f6e8936a2aa25e8b6178e3698564049bacf41d5943dcc2249e571f67492c87487c0dd76df8557ae0525457c0d9a6029c6011b8815d7e806c78

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BIH42MHL.txt

Filesize
118B

MD5
d6ec0e4619796fdb6a3c346b6ea97a90

SHA1
ded805f08cb03fac2d2a294c124474f76f0d9896

SHA256
bc0a52d444b23e1d19f679bf5551a9de7003055181f2b46b3f87215e9d5bf833

SHA512
ec355fa3cb75d67ee119a4481abab11ae2ad9efc8edc9ebd328262906daf0e5ed21ce453362b09c11cdcac99293ccc4ad248f9001a28eb6c567766692f30194f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BRYT30ZY.txt

Filesize
183B

MD5
0dd0e65b03468fd83797794d328d9861

SHA1
bebfe08202eaad02e32cc1414080aaecf30678ca

SHA256
08763ffedb737d2c9318ae5e8a77d797ab185b0472f7773be242c03b2490eb3d

SHA512
ad3b69f9f0a9803120eb3caf99e76539ac0761eeed75a4746a77458c19bc698ad6450076f899f4acd20ae49a4281bbbd0b93e40adf6cc3adf9ee9afc34c5a002

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\IH1OBDJ5.txt

Filesize
608B

MD5
0aec98c9f943c2b6f38053ee4a1df984

SHA1
f6f2143bdaa77e291ae5e3023bed65b4683f6477

SHA256
d5e3c33a6f1ad98a0dab64f71530d7348f4f65b71063b3a25b1d01246af81da2

SHA512
752e24031b2949b1313acf6135e57c9ed840874f55cd5a4e1d9646563cd96ddb5e3815bd8000c6791fe3a7fc325992222ae2fd2c18f363d688ba2dd86ab07a94

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\S7W0EZPN.txt

Filesize
85B

MD5
c2a84d1cacae5f23eb98c43c37773871

SHA1
63e209edd2dc85eeb3e086bc20017940ad4f1413

SHA256
ed0b7b163b6ba6e0d97130b61ab4247c74e5a94e41578afae017d527604d0369

SHA512
eec09197c49cc205ab8dfdb9e16dab49956b14fce31073525c27ecc9c600eee2f4837a280a49e1db3f7e1260f71f8a1d32a42f2b04eaa2abb81b737e74285d30

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.1MB

MD5
922f13354a57e00020a78680d844dc0a

SHA1
c2e6c1bdfec4593c6d30ac3cdc530be2fc6b35d6

SHA256
ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e

SHA512
b78f8f3bcb6202e0456efaeb379f3c39b637c74203a13278204aa20a3a9c57e77926d678bbc047af0eca3285b1397999cc7dd73739ef85d9841289b6f2a823a0

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.1MB

MD5
922f13354a57e00020a78680d844dc0a

SHA1
c2e6c1bdfec4593c6d30ac3cdc530be2fc6b35d6

SHA256
ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e

SHA512
b78f8f3bcb6202e0456efaeb379f3c39b637c74203a13278204aa20a3a9c57e77926d678bbc047af0eca3285b1397999cc7dd73739ef85d9841289b6f2a823a0

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.1MB

MD5
922f13354a57e00020a78680d844dc0a

SHA1
c2e6c1bdfec4593c6d30ac3cdc530be2fc6b35d6

SHA256
ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e

SHA512
b78f8f3bcb6202e0456efaeb379f3c39b637c74203a13278204aa20a3a9c57e77926d678bbc047af0eca3285b1397999cc7dd73739ef85d9841289b6f2a823a0

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.1MB

MD5
922f13354a57e00020a78680d844dc0a

SHA1
c2e6c1bdfec4593c6d30ac3cdc530be2fc6b35d6

SHA256
ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e

SHA512
b78f8f3bcb6202e0456efaeb379f3c39b637c74203a13278204aa20a3a9c57e77926d678bbc047af0eca3285b1397999cc7dd73739ef85d9841289b6f2a823a0

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
1.1MB

MD5
922f13354a57e00020a78680d844dc0a

SHA1
c2e6c1bdfec4593c6d30ac3cdc530be2fc6b35d6

SHA256
ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e

SHA512
b78f8f3bcb6202e0456efaeb379f3c39b637c74203a13278204aa20a3a9c57e77926d678bbc047af0eca3285b1397999cc7dd73739ef85d9841289b6f2a823a0

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
1.1MB

MD5
922f13354a57e00020a78680d844dc0a

SHA1
c2e6c1bdfec4593c6d30ac3cdc530be2fc6b35d6

SHA256
ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e

SHA512
b78f8f3bcb6202e0456efaeb379f3c39b637c74203a13278204aa20a3a9c57e77926d678bbc047af0eca3285b1397999cc7dd73739ef85d9841289b6f2a823a0

Download Submit
memory/1776-85-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1776-105-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1964-86-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1964-90-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1964-107-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1964-104-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1964-91-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2040-58-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2040-70-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2040-57-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2040-54-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2040-61-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2040-65-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/2040-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2040-62-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download