7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe
Size

1.4MB
MD5

b8c5b7f562d837062717c906a2a67df1
SHA1

2c8f6f58cd1d65f6c0e230929bfe64a32c5db40c
SHA256

7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b
SHA512

038a5ea19f196c048d268d628458c9e9172fa3b91d90a97639916549a3f8515312dc119cfbac45ffe107c26bb85683ec9eaa10b711b567c917dc4327c944a814
SSDEEP

1536:GCxE8JHTdoQkO6xvJXzT0YpMgbQoToPQTiwHz7pj5omc4JyBMA6:GuxBoJOMXzAMrTuw8aMBe

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Executes dropped EXE 3 IoCs

pid	Process
1252	winlogon.exe
2024	winlogon.exe
1884	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ants.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atwatch.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antigen.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lockdown2000.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvc95.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwinntw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DWTRIG20.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavcl.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeweb.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avshadow.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmlisten.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msn.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navdx.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak5.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcontrol.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mdll.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ss3edit.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnpc3000.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portmon.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apvxdwin.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navsched.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvlaunch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPAVServer.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fp-win_trial.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vvstat.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SandboxieDcomLaunch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpmon.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bidef.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\realmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpexec.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsm32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SandboxieCrypto.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkservice.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blackice.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monitor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpostproinstall.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswin9xe.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nav32_loader.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nupdate.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvapsvc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\programauditor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nupdate.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcons.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\INFOPATH.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luau.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweepsrv.sys.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsave32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscanx.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ewido.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cclaw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpostproinstall.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pingscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet98.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmain.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rescue32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vccmserv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fact.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1308-55-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1308-57-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1308-58-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1308-61-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1308-62-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1308-65-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1308-71-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2024-86-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1884-87-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1884-91-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1884-92-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1884-98-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2024-99-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1884-100-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
1308	7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe
1308	7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2016 set thread context of 1308	2016	7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe	27
PID 1252 set thread context of 2024	1252	winlogon.exe	29
PID 2024 set thread context of 1884	2024	winlogon.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://scobxyx1r75p30l.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1866"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "2716"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "4387"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30bc9ed9a407d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1125"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2737"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3031"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "221"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1947"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1954"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "5170"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://vqb6cs709i3exc4.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "282"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1871"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "3478"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "303"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1887"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "4304"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1948"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "282"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "8513"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1092"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1947"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "4387"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9429"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1948"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2859"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3499"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "5149"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "3031"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "4408"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "4408"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://yed698c7j01pqml.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://67l5f8uk02n5xa0.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2797"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "11081"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "3478"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3416"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "9408"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://vko02z20fd22wu5.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://3lm079z6acz208d.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1884	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	1884	winlogon.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1964	iexplore.exe
1964	iexplore.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1308	7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe
2024	winlogon.exe
1884	winlogon.exe
1964	iexplore.exe
1964	iexplore.exe
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
1964	iexplore.exe
1964	iexplore.exe
772	IEXPLORE.EXE
772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1308	2016	7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe	27
PID 2016 wrote to memory of 1308	2016	7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe	27
PID 2016 wrote to memory of 1308	2016	7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe	27
PID 2016 wrote to memory of 1308	2016	7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe	27
PID 2016 wrote to memory of 1308	2016	7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe	27
PID 2016 wrote to memory of 1308	2016	7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe	27
PID 2016 wrote to memory of 1308	2016	7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe	27
PID 1308 wrote to memory of 1252	1308	7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe	28
PID 1308 wrote to memory of 1252	1308	7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe	28
PID 1308 wrote to memory of 1252	1308	7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe	28
PID 1308 wrote to memory of 1252	1308	7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe	28
PID 1252 wrote to memory of 2024	1252	winlogon.exe	29
PID 1252 wrote to memory of 2024	1252	winlogon.exe	29
PID 1252 wrote to memory of 2024	1252	winlogon.exe	29
PID 1252 wrote to memory of 2024	1252	winlogon.exe	29
PID 1252 wrote to memory of 2024	1252	winlogon.exe	29
PID 1252 wrote to memory of 2024	1252	winlogon.exe	29
PID 1252 wrote to memory of 2024	1252	winlogon.exe	29
PID 2024 wrote to memory of 1884	2024	winlogon.exe	32
PID 2024 wrote to memory of 1884	2024	winlogon.exe	32
PID 2024 wrote to memory of 1884	2024	winlogon.exe	32
PID 2024 wrote to memory of 1884	2024	winlogon.exe	32
PID 2024 wrote to memory of 1884	2024	winlogon.exe	32
PID 2024 wrote to memory of 1884	2024	winlogon.exe	32
PID 2024 wrote to memory of 1884	2024	winlogon.exe	32
PID 2024 wrote to memory of 1884	2024	winlogon.exe	32
PID 2024 wrote to memory of 1884	2024	winlogon.exe	32
PID 1964 wrote to memory of 2016	1964	iexplore.exe	36
PID 1964 wrote to memory of 2016	1964	iexplore.exe	36
PID 1964 wrote to memory of 2016	1964	iexplore.exe	36
PID 1964 wrote to memory of 2016	1964	iexplore.exe	36
PID 1964 wrote to memory of 772	1964	iexplore.exe	47
PID 1964 wrote to memory of 772	1964	iexplore.exe	47
PID 1964 wrote to memory of 772	1964	iexplore.exe	47
PID 1964 wrote to memory of 772	1964	iexplore.exe	47

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe
"C:\Users\Admin\AppData\Local\Temp\7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Temp\7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe
  C:\Users\Admin\AppData\Local\Temp\7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Users\Admin\E696D64614\winlogon.exe
      C:\Users\Admin\E696D64614\winlogon.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2024
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Modifies firewall policy service
        Modifies security service
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Windows security bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Executes dropped EXE
        Sets file execution options in registry
        Drops startup file
        Windows security modification
        Checks whether UAC is enabled
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1884

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:984

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:2831369 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
5bb25cae0f32937b7b0abc6661a4737c

SHA1
bad78d22c7c50cf5ec9ec343809c6d90705962ef

SHA256
517596724bd34018f2b7c70fd960d6e3df4a670e07a311044a61dd21f316759b

SHA512
c9e5b2eee5c9535abb052d1436ccc6125c40293360c3f35cf9a2d3ce96ab0a5431ea545a97bcd461f2324195425d90fa0388282169b836e342bf2cef7dbb81f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
7c9e0bb25e8c28e8b10038806b0a7190

SHA1
9fa6097aeb8eacde8ba7c9ab80a7a7d2405ae2bc

SHA256
f4864000960be2f888ed7d2467f74130231fed6f56ad48ff15861f5769e95a58

SHA512
a47442cf298b6c42d126e7e0853a6768fcd46cb7c75dcab06fb07a913a2993fdc3031de8fe8b9408b28af472718da5e92fecedf037e18d72a325aece48fde450

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_7D0866F648887A7BB8C83FDD7893DE3B

Filesize
472B

MD5
64eb3a8f7cc11324c6f4c77e1c11f7ee

SHA1
8ad889db020018b726362929a9477872a6808f0a

SHA256
481082e2478f937b15faec7128ab1a60bf1157b417bfa63022472f434ae240fd

SHA512
7753bbfb15da12afcc96406c00e511bfcd8eda2e3fe52ee01a6b6ea44c9bfdb3bd03ca64caaac9a915501b7218133c202b31a63c5bb8278242bf224c0620a4cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
f823836bc01249fd47b713dddd6f685e

SHA1
1d245e9117e5d2f65bed102d799df29566cf170d

SHA256
d0707cd293f0882fa64318102e1b45e8851339a53b685bff3c0b5d0c30eb5b25

SHA512
8dd3b00a6ff667919b5d6813def76506d5247d8d60471503167bfdba7e61e635d0e5c00fec05219923fcd7157f9e3808f2ed66b91956b466c00fc3f8cac3664d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_33E6263BAF1D93C3B754E2140B85CB43

Filesize
279B

MD5
95e426d525f14fd00d0d1687e2ecd10b

SHA1
7c991e804d1a22edf3c02a76d336cc7aefb0d6cb

SHA256
10469c1d6359e07f9b20f21f0734080f989b3f54a8e83b1c872d2f7a3815db06

SHA512
3e8c0313cc49cfcff62e138792be4c9dc41497c8b7d865f8c0b29b6ae336946084269bada73267ced3c954d64ae420c07f34daf62a76978919edbcba789963f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273

Filesize
279B

MD5
4067aae3423b2b07ca7caab7c9503277

SHA1
f427bbad70c869f7e4844cc60e8b6d19719eb44a

SHA256
f4aa7ed4c86465f043dcf128992d7337f24733d21a184a3366cffe31be698ebc

SHA512
b17655162161ac10e52efc904742d8b090c26552244057c9754a85b8b1ef9442fe3cd103dddc219cad2483299637b1b3c494106d4b5023d08c8652d8e6cfd049

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_4A183155DB502CF599F3A8AD6680B8C3

Filesize
472B

MD5
f54a71942ab5d7fdc54672cf84aa76db

SHA1
e03db706ad371c93ddd3cc4a3e4c329777bb5f4b

SHA256
87453ee6a206085c9b82594123a30bf59f7354733d19f21e388dea70768198c9

SHA512
6059582e829491f3662d4b60b0a6883b4bf60aaa55934ea76b62ca50394d17abd9cedc7831912b27ffc291b8e6248a284a7cabbd454c3aa02d1e3c312f20a346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_5C379F3600DE745720AF61433A9796B2

Filesize
472B

MD5
da9700d928847bca71f73dc9ca89bd1c

SHA1
2f156a1557a7504da776ed9a82dc52563662be6f

SHA256
428ed39905a42b1fc7aaf84f2144caf58ddcb53ac2fbda9af61784ca7394a344

SHA512
d04a785f12b61b301bb8d8e66cdbeeb808cc1a0d4b3cdd40ad4c710e2ac682f2eb2c31391505b4bfb56630b62ffe99fafebea5a23a0a5157ac8ba187414cc50c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_9E03BE143CBB35C01D53F353A29A88B6

Filesize
471B

MD5
72932caf0e9ea5f325ef03b1043ff207

SHA1
d723fe269cb18683818f157af4ae903b521cac0d

SHA256
a44277a339eeb201da534c3ce6403edb833c4c3f3d3c63c1bfa8f2c97818a240

SHA512
142b5ae5e6659021e03f1797d5b3d438d622b4561a848e530496d13dbc9f3f0303bb9c98c14571f058a3f966e89d8cb272601aa67f65a7bab9185e0e4c4e274e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
471B

MD5
24dd2bbf574a0bef2e3d157d7854b046

SHA1
6a2a41741a6f422bc954391b1c748c4d1b6914e0

SHA256
6d3b7942f1f66493cc13fc9dfbe13d90fa2d96198cebab0c764fe4298f90ffad

SHA512
997721580adf38b7dc1606d6992b9c992715fb4168f2a21f7af8c34c02e054b273f12d8c86e072a94227792fd06acd2bde27681a511b4690bb209eda27a6faf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_09D967865B5D6CF6242665AF4E214559

Filesize
472B

MD5
68570b7de13c7dfdf686da25ce10d668

SHA1
61c1304152f11e6a83c383fff8d5e498c4385e6f

SHA256
537302c07522f4bf1e766fbb1a8da346f59526715a5fcecd3f6aa4817b6b32ed

SHA512
4f27e18ac511a4a42570d6387f0f599ce059fd5b5b3b0c95ae231fe4ce91f3e12dcab9a3c68a6a36ad3612575cd625ac1c4fb2fd78b30c4fef235e6fcc50e321

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_01B1031F6736E831E4D73D2798F7305E

Filesize
472B

MD5
3c4319f54a5675ee9acda96c58f97ac6

SHA1
210ea86db1836d430b321d59b4bd1b016c914f22

SHA256
cb20ad3ec895ed3a2ae9b1a90dda6b7cc174d8851f3a15ba054a435746cbdc65

SHA512
5c09de2547644f57dfc8f90cba86554985386ab57e5aeba5ae299c9126c01c09a6be77f20c87841426209596455e543332f4f24ca1ecbbce1d1fbf536639f3b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_AED163394DA42A803964AD0D562C1BA5

Filesize
472B

MD5
2dabd839729e9b0fb2558253d850126b

SHA1
64f617aa0afb52168ef3519a4cf9829ac61ee007

SHA256
1a47e4d0efdac6fbec990e3e168bfdfe615ff8953158773e8b1940d4d91eee18

SHA512
01f08f6a4b6301a5ef062dae915cc8f171a79f65ce5a106f0f5ed0e2d703e11200535d1c3ebd617622726a5501f63f2e3406b910d5d1e648031cafd2786b8b9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_DD5E18651A85E635F184F73BE6D3DB70

Filesize
472B

MD5
122124f83967c12700f5a6f5546b0f1f

SHA1
d7acd2db61ad811c388a44b7bd407fa5f4aea8ee

SHA256
b6b9e0b6c241b4eeb5161b1c297dec2aa6188032017074ee7f8e5533fab87a4d

SHA512
af01dd1c999cbd1b405cbc2fbe5b14864327c364c7956e8defb25d6eb3ca02bb5186e697cc4b9c268bf2ee28425f8ea629dd07f059c680027a5cfb3213ace8d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_9314CBFDE0A0789248250741A60DF9F4

Filesize
471B

MD5
35c66ab0dafc0ed05c3f2e1b8829e3b7

SHA1
e8fac7e103462c9cb3fab7ed1c1cfa07813ccd74

SHA256
09270f5899964b5438d18e198fb9f50ed079fb0ee1c54a9cd668b96abdb8c228

SHA512
74f94d682b61596ebe564fa3deef4694b71bf5ac2e02408e396a46ad9c4681463268ebdec75b00fb57ccae578d53cd7ab7ae912302b5876c6407fe86866d7b25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
758f992bbab6025b12c54d80907a719d

SHA1
b2589382c49ac79b88f82e852e3b96e35874508a

SHA256
34183fabc3a2604e9fa6241c0c8be39e041c1809ad6718f2fb7f3e4a18a345be

SHA512
14a9ed67419e4664f75e0c14a0836c0e4cdbe7f97fcaf0fb1ce47f70b306213088254fc76163b7d7f08c0400876a4e6db42c8f07ea2fec820e2680d52b240f4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
a13155ded2e6a687315ded880426ff66

SHA1
dffc547ee06ba23e16ab4c4f4119ce70ab5bb60c

SHA256
4bce37a7bd720cc5c9c27defa363d48cb29b5df5946e3341d0d0f10e82809059

SHA512
ccefc1bc54d6f71c20b1ba7d23980083649d8e97cade516276b41cbf3474c36c54d4ca783f8125c3041a343ae1703b2c48c03bffb8c4ee28a28eed426e4148ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_7D0866F648887A7BB8C83FDD7893DE3B

Filesize
402B

MD5
732c52f2e223820377cad20cb29048bb

SHA1
80a4acc8af3fd8e57926cb7c0b599836fa942b21

SHA256
26dd5189d15b3d490523d870c119c8e75ff0859c4d4a3a13a1e7472cf2e1365b

SHA512
2567da7b76c7f894f9a708be81259c656b27d17d941e2055605c854697cff8fe6ea9eb6ead6dc9fd0543c03786776444cd0bf899f0ad2ceac339070c4ac5186d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
438B

MD5
09c1466e97c084ff11917dace176c5a8

SHA1
391d084753f352ee2a49a78afeb620f30b441f06

SHA256
1aefaaee50dd4abb9fada4686f28b886bcf40634c3890ece36d4034a1b43dffb

SHA512
c4c17525235ce02355e811bda3f65c4d23f0366964dc140a05d78d76e3aaa2bedb4274c30a7d63d7cbae985b1031a5eef4e26eacc9cae0a990d6a4010cb24c92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc2abd80b8619fdb0e8bcb1a53bb3215

SHA1
0f8a6f05400b4c7006e7871ff4c4516900e344aa

SHA256
a12e95e1881bf7a12646d125d4c3b26b3bd8e5b3ae1522deab666d52fc642835

SHA512
9d45fa407ec7e9909506897575a127818d0b79ee7be7181a618a6a5e514bc3209af2272fe13d6dd94e63d105e4fe7f327d9d1990e31e3d485557c98915f1f969

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00e57328f12e86d896c482711fe75bb9

SHA1
2919b13a4fe36e1f90745cc6598b00f6514fc97d

SHA256
e887d2127315bf545594ffd50f248e5f720a95dd2f9d19902a48cef2d39d9df3

SHA512
274f478018378fd9ce74961bb063ccaf5d8339e36e10ff8932586bb82c2aa3b128e2446c02cd2cfa0b7bf94bf3fa067688c74d62a4b004e2b6885833e4ddf492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52021ece9ee365fff2c6c3a7192f966b

SHA1
05b5a266f54bf0ba11e22d8d91c57443f2f507d0

SHA256
084cb48b162b3b0b03ed83dc42ac243ffb53bf8bbbb47356956ca4a5ebb76d31

SHA512
654423e8d8486150cd221cc78f350aa7ae33b279c40d79918b35110a843462ef8b94d26426d99e303fc53848e3d51d712bc7eee2f2d64f745d97abc5db0ac252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_33E6263BAF1D93C3B754E2140B85CB43

Filesize
426B

MD5
4ff55ecbf1a7f6556a5567a61d75264a

SHA1
86f449f0412a30d30785d883ca5f42e7f842e79d

SHA256
207b3f0d5101e8f5b3fa957afab0e7cd5f0236e7cdff65ee0e5182c4840b9ce1

SHA512
fe7a02a8aba52260199c8e90ca4cbffabd1ee550517a8e0f1090593d1adbafd2eb9f13728476d3b9b812bf9ce7b0bf8d80712adc168090bc1ed151a15cfc6b9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273

Filesize
426B

MD5
907a1bad5dd374ad2147a64be3091dbd

SHA1
7f1a6e829944f8f9069714ee879feabc1e98c87a

SHA256
e01a018e5455c45d10e7d195601cb32f32cf071dd105436a15b5158cc6c95437

SHA512
4d63f16547e96c2fb179dab7b02d96797355249bb4b31826e2708bb6acceec52b82983520536aeff7a13298cf2db961f033f8b42aa6ef67eeb263fc2b370aaf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_4A183155DB502CF599F3A8AD6680B8C3

Filesize
402B

MD5
eade6d90f703fb805c9a64c25eb57ba7

SHA1
81b5614564e7e8b28c433df9fc1bcbcd8f484c50

SHA256
c3937498ffdf1a1f6e7082f95e4759db59c704a77c6f8fa96d90ec0f923c732d

SHA512
8dc724ab53d85980766ec5e7863910fe778187587cd59e1bed4370b308210c30a87ce9b0d6eac5f94d288c5376e4f29853229aa80dda3c4ce54cfd3f913bc8a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_5C379F3600DE745720AF61433A9796B2

Filesize
410B

MD5
6e45afaef4f9e96b77a2f4235cf15b2d

SHA1
fa40ac19be25114a05e749b384dc15fbe1311bcd

SHA256
a3b65adabdc9acf9f91467519f894484297f3af410c169f5310e1f708423db4f

SHA512
608ecbbfb430b100dda973b873198dfd4ed332e1b3f7d62749deddefc46adb1d14305d2b7afee66d457aec57fcc49a002b28a91a973c129ad4253ffcf45aea05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_9E03BE143CBB35C01D53F353A29A88B6

Filesize
406B

MD5
dbe8e761411c3f92c12d5ef0d67ab21d

SHA1
6afc4b35d2e165d84581f2150a69a69f296aac24

SHA256
f0c343babe24523afede578bb09f53941bc767ce3afe427e97588468067b15a9

SHA512
3d2ebdbded5f6a45e92ddd8e9690950bf5d1f751418d9e3bf90809c1179d62219835d161b21c890cabb62d3a146a248f3f7b8f43b5979f79a6af0ff1a57f51d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
434B

MD5
48c115484af3104fe4e32e56d1f6bbb1

SHA1
5ba647d8bebd27593fa9c2ac329dcb051e9544e3

SHA256
762ebd99b1487c4885ca3c1bbb6b077173d65dcf742b364d9d52226e73938b42

SHA512
21d3956b17b6ba101e6874de249cc821f54430f91e6c6f77129022dd752f06ee69bfd08f0a60cc628a75f3927869d59f2373ba2d805a9e765677bc0be49ae525

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
f003fe077dd93b442bf822a44c40671c

SHA1
ac8cecc3f5861d5df379b6f3f0ddd7f5c63edafe

SHA256
a7a539eb723359e3ab70bf48ce0f130eb37795cd9bec33eef1cddf8112eccc9b

SHA512
cb93c3c170eac186d4508dde851a996c039c704857325eef8f5138ee088f1fe74ffb68aa214ed157aef31f16defe8313a9a84a2e9f72ab2ddd6619164a180056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_09D967865B5D6CF6242665AF4E214559

Filesize
402B

MD5
282ff88da6fbd3531f9272827d2b9707

SHA1
df9ea24a0a1b3915010aa2c97a5e2dfd4d8ab2e0

SHA256
f0bc343a9c4c6a3bb5794d9c632914c2b417f33e1a811853bed75ed6e8f3f965

SHA512
4a63c8a50526bc6607a4c0cb583f093c8a4960d88305bfd21f2da08b889520de6bffe90c19eb4dacabf99c083b4d956328f81f1395958414d0275dd6b69cf995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_01B1031F6736E831E4D73D2798F7305E

Filesize
402B

MD5
e78f620144eed0ee2f40c5bcc1bff0fc

SHA1
219bfd1f664f343b956729a08cb1c0b5a9ee4271

SHA256
60c8fc2a1d095f5e96701315840b5b51cb7c333d2f876de0859f1b89317cffab

SHA512
3ccd80d305fa8fbcde5e4812030839bac16adce5ca6bb050de838e5811ac483c7335bb7ee0d7b6492c63b9d303169d34906d7dde76a5fb59ffbf06347e64ab7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_AED163394DA42A803964AD0D562C1BA5

Filesize
406B

MD5
44d762f6f0e7062e97b09bab84a8f7d7

SHA1
047014ba770064d65828b669f45c357dc2da24d9

SHA256
39583a11c35d63dd98fa76b437845e21f1fee1c88098b576e1ff9a18d1fbbab4

SHA512
d5e473594a93919e83bdfc7eeff133ad6d1807c3447ece6e794c193d630bd469ffc6dccb309847c77cc5361a02efc9b8d130a38a11d5468674589663e70ddff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_DD5E18651A85E635F184F73BE6D3DB70

Filesize
406B

MD5
26cdff36518fa1fae3c1efbaf8799d05

SHA1
ca5935b4080923cbab21e7261f27e123ea41e011

SHA256
2b1d1ef22d171cae958bb5c909cfd460d657dfcf759ae69c44d93ae024ba53db

SHA512
fb50aca1188144ae5c4ca42e8d4d1142300ae967bedcc1526a41f8d7f076ec91461360b1d2ea674746994cb97268d8c7c9f18bac75f0baf716f85ea2d22a7dd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c11e49b75a581fc403a15432772f67b7

SHA1
165d4bd241377df58bae3ba84f80604ab403d7a1

SHA256
6e4c890751498264b2bf77773740612db67141f7de6367e6d8674d5c7f68d283

SHA512
607804607732336ac174b48efc3e185028361c7b226999a4a661030c0ca4d2722f4b9fc7e2ebc6252d52536d39a303dc051bd5ce3cb45cd4d8882566e4e41e73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_9314CBFDE0A0789248250741A60DF9F4

Filesize
406B

MD5
a8adc95e3ae19f3b7b236e8ca2abb646

SHA1
2ba065c1c92f9e09f696b6dbc974c59385859788

SHA256
318192347f1dd7fd7f72e74e53fb5c7569326a3e17564667873d2980a83b3bdb

SHA512
20f5e5f2ed552a3be1208b77dac0254c2eb472c778cfd27e5314593a39c8ff763827b49c1dbf51709eae53263826aef70b4584ac682a0c5e8a1d1343ff421f09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\1YWQ63R3\www.google[1].xml

Filesize
95B

MD5
d4b27026dff06388386e8da44a4a3b42

SHA1
35348af65d4c4fab22f878e4f56291324eb316d8

SHA256
6b8b1eaf86046391345dce3cf974db7ab5c830e5cb5f5f694cdfcc4bb5d7c970

SHA512
0eca0a3716b600e3f11b7af687e17ca6e6152917661628ee827b2fbb6c416c652602b9a2eeb849a5e73c14c902b50802aaf1cfd59b2f323853005beb8cca988b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\75F5E1BR\www.hugedomains[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SRAJUZY5\www.youtube[1].xml

Filesize
6KB

MD5
c054659e3b5b29f233795af23307d143

SHA1
60bbbf670686422d3059665116035fc060f9ee87

SHA256
f99775419606e7c86f50de357ddfb5e296c45e86b5d32e78d7fc349427b1e00b

SHA512
652c85a3ea92c6502159984771c34c6eafae1db52f71b9ae5748c3c20468f0fd6e8cef92121231ae7f89b25086c76ec960ae9f6d65b0d9ca5da728e44334aecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BG9XQTG0\recaptcha__en[1].js

Filesize
399KB

MD5
b2507198388fcc94ca9e94ed4c5561c5

SHA1
8853fc86f1c616bd20a73e3e24442036fd90fd2f

SHA256
02c7565a86d6d3a80295b85161d78fc88d8c79a0e314c0c7777570237a365ed0

SHA512
9461ec9b79eaf72e85744d4fba9f18b3d3f1f9b3fb28f30fc2392f5740e21eb11a73f15700e4d5c4af9f2b582c4efdbb8d3492d4a14e32a1e8715458c9e464d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\60GTXD32.txt

Filesize
1KB

MD5
ee43f95bb428abc17c1c4d3f844cc601

SHA1
eea05d2e842ffc926d13ece25422e9b09c538610

SHA256
c5f568a8598970da902de2fc1df2f478185566c87ecac582a36475e20286db9f

SHA512
2faddf2a17d202aff422c7b9bdc8b7129ce97d26d136975021da48d8f9a5f26728a3cca574a24c288867c21a448cce2b767531ce90a73b00e69f29f58afb8478

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\K96PTAKC.txt

Filesize
535B

MD5
073a476e38029ce3b8100934dc1024ed

SHA1
a1aea95d578f3cd3d1bf0083b5aaf5ea12596d6d

SHA256
2ea5b7a0c93cc8a84eb7f6490b46bfc1464ed7a0f81287a1f3537a8324d1b3d6

SHA512
1dabdc54a298242e541d8c9c900d4d769cbf046a9597c33486459b6bddcb337acdac9ea781a1004589bc82e72f359bcf658385b3f735dcb0d32ba674f6fff9c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\L00OF3DS.txt

Filesize
1KB

MD5
d73219657577951dc359c556061e6dfb

SHA1
0272db14419b19d4180cb99b8344654f104a002b

SHA256
6c1465a4bb512d97e4624c1776749481e1cb24b9a759c04de8086e0f7b794809

SHA512
0137954fc7ea4168003e937dd4df497c529e87e685c2be5e9313b31d5007a7d4c7d0d22d1190ae9b7bb292eb5e90dc2127494a489b475ea5c3fbff04a2bb00f8

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
b8c5b7f562d837062717c906a2a67df1

SHA1
2c8f6f58cd1d65f6c0e230929bfe64a32c5db40c

SHA256
7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b

SHA512
038a5ea19f196c048d268d628458c9e9172fa3b91d90a97639916549a3f8515312dc119cfbac45ffe107c26bb85683ec9eaa10b711b567c917dc4327c944a814

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
b8c5b7f562d837062717c906a2a67df1

SHA1
2c8f6f58cd1d65f6c0e230929bfe64a32c5db40c

SHA256
7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b

SHA512
038a5ea19f196c048d268d628458c9e9172fa3b91d90a97639916549a3f8515312dc119cfbac45ffe107c26bb85683ec9eaa10b711b567c917dc4327c944a814

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
b8c5b7f562d837062717c906a2a67df1

SHA1
2c8f6f58cd1d65f6c0e230929bfe64a32c5db40c

SHA256
7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b

SHA512
038a5ea19f196c048d268d628458c9e9172fa3b91d90a97639916549a3f8515312dc119cfbac45ffe107c26bb85683ec9eaa10b711b567c917dc4327c944a814

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
b8c5b7f562d837062717c906a2a67df1

SHA1
2c8f6f58cd1d65f6c0e230929bfe64a32c5db40c

SHA256
7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b

SHA512
038a5ea19f196c048d268d628458c9e9172fa3b91d90a97639916549a3f8515312dc119cfbac45ffe107c26bb85683ec9eaa10b711b567c917dc4327c944a814

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
b8c5b7f562d837062717c906a2a67df1

SHA1
2c8f6f58cd1d65f6c0e230929bfe64a32c5db40c

SHA256
7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b

SHA512
038a5ea19f196c048d268d628458c9e9172fa3b91d90a97639916549a3f8515312dc119cfbac45ffe107c26bb85683ec9eaa10b711b567c917dc4327c944a814

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
b8c5b7f562d837062717c906a2a67df1

SHA1
2c8f6f58cd1d65f6c0e230929bfe64a32c5db40c

SHA256
7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b

SHA512
038a5ea19f196c048d268d628458c9e9172fa3b91d90a97639916549a3f8515312dc119cfbac45ffe107c26bb85683ec9eaa10b711b567c917dc4327c944a814

Download Submit
memory/1308-57-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1308-66-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/1308-61-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1308-71-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1308-54-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1308-58-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1308-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1308-62-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1308-65-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1884-92-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1884-100-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1884-91-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1884-87-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1884-98-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2024-99-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2024-86-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download