cybergate | 963950f8322d5c8f7226d431a3f731e1ace9e3fcfdc98d499584d7df054323b7

Analysis

max time kernel
151s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

963950f8322d5c8f7226d431a3f731e1ace9e3fcfdc98d499584d7df054323b7.exe
Size

905KB
MD5

f3e1125e3b5a5d17a47144b9ea3fbb74
SHA1

8f622a26c9362ae6a1f822f3d808da3eb0d6fc64
SHA256

963950f8322d5c8f7226d431a3f731e1ace9e3fcfdc98d499584d7df054323b7
SHA512

7edc89990d989e81c2c31819b4dde20170c17ee733f0e99355d3bb14e6eb97415f363d215e60febda64233eff90620fb4d79b013a2de16efcbf295dc4070953c
SSDEEP

12288:PBJHa4SSqrzuhQ88jIYSl10R/IqSBk58tKTGPM2Leov6uqoi2ARuqnK/PtuVnMqC:PrHaFSIR/998CGPMAeKXt0MB/v4mb

Score

10^/10

cybergate viko89 persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.01.0

Botnet

viko89

124.123.38.124:82

viko89.no-ip.biz:82

Mutex

CyberGate1

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
Winlog
install_file
winlogonn.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
allahisgreat
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Winlog\\winlogonn.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Winlog\\winlogonn.exe"	Crypted.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogonn.exe

Executes dropped EXE 25 IoCs

pid	Process
1736	Crypted.exe
1968	winlogonn.exe
1752	winlogonn.exe
832	winlogonn.exe
1692	winlogonn.exe
1172	winlogonn.exe
2004	winlogonn.exe
2044	winlogonn.exe
1464	winlogonn.exe
792	winlogonn.exe
1704	winlogonn.exe
872	winlogonn.exe
1008	winlogonn.exe
1664	winlogonn.exe
1356	winlogonn.exe
844	winlogonn.exe
1228	winlogonn.exe
1384	winlogonn.exe
584	winlogonn.exe
1184	winlogonn.exe
1972	winlogonn.exe
1900	winlogonn.exe
1648	winlogonn.exe
1212	winlogonn.exe
1668	winlogonn.exe

Modifies Installed Components in the registry 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Windows\\system32\\Winlog\\winlogonn.exe Restart"	Crypted.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Windows\\system32\\Winlog\\winlogonn.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}	winlogonn.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000013a09-59.dat	upx
behavioral1/memory/1736-62-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/files/0x0009000000013a09-63.dat	upx
behavioral1/memory/1736-65-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral1/memory/1736-74-0x0000000024070000-0x00000000240D0000-memory.dmp	upx
behavioral1/memory/620-79-0x0000000024070000-0x00000000240D0000-memory.dmp	upx
behavioral1/files/0x0007000000014219-81.dat	upx
behavioral1/memory/620-82-0x0000000024070000-0x00000000240D0000-memory.dmp	upx
behavioral1/files/0x0007000000014219-83.dat	upx
behavioral1/files/0x0007000000014219-84.dat	upx
behavioral1/files/0x0007000000014219-86.dat	upx
behavioral1/memory/1968-90-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/files/0x0007000000014219-91.dat	upx
behavioral1/files/0x0007000000014219-92.dat	upx
behavioral1/files/0x0007000000014219-94.dat	upx
behavioral1/memory/1752-98-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/files/0x00060000000142c0-99.dat	upx
behavioral1/memory/1736-101-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/files/0x0007000000014219-102.dat	upx
behavioral1/files/0x0007000000014219-103.dat	upx
behavioral1/files/0x0007000000014219-105.dat	upx
behavioral1/memory/832-108-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/files/0x0007000000014219-110.dat	upx
behavioral1/files/0x0007000000014219-111.dat	upx
behavioral1/files/0x0007000000014219-113.dat	upx
behavioral1/memory/1692-116-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/files/0x00070000000142c0-117.dat	upx
behavioral1/memory/1968-120-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/files/0x0007000000014219-121.dat	upx
behavioral1/files/0x0007000000014219-124.dat	upx
behavioral1/files/0x0007000000014219-122.dat	upx
behavioral1/memory/1752-127-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/memory/1172-129-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/files/0x0007000000014219-131.dat	upx
behavioral1/files/0x0007000000014219-132.dat	upx
behavioral1/files/0x0007000000014219-134.dat	upx
behavioral1/memory/620-135-0x0000000003820000-0x0000000003876000-memory.dmp	upx
behavioral1/memory/832-137-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/memory/2004-138-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/files/0x0007000000014219-139.dat	upx
behavioral1/files/0x0007000000014219-140.dat	upx
behavioral1/files/0x0007000000014219-142.dat	upx
behavioral1/memory/1692-146-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/memory/2044-147-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/files/0x0007000000014219-149.dat	upx
behavioral1/files/0x0007000000014219-150.dat	upx
behavioral1/files/0x0007000000014219-152.dat	upx
behavioral1/memory/1464-155-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/files/0x000a0000000142c0-156.dat	upx
behavioral1/memory/1172-160-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/files/0x0007000000014219-161.dat	upx
behavioral1/files/0x0007000000014219-162.dat	upx
behavioral1/files/0x0007000000014219-164.dat	upx
behavioral1/memory/2004-166-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/memory/792-169-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/files/0x0007000000014219-171.dat	upx
behavioral1/files/0x0007000000014219-172.dat	upx
behavioral1/files/0x0007000000014219-174.dat	upx
behavioral1/memory/2044-176-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/memory/1704-179-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/files/0x000b0000000142c0-180.dat	upx
behavioral1/files/0x0007000000014219-182.dat	upx
behavioral1/files/0x0007000000014219-183.dat	upx
behavioral1/files/0x0007000000014219-185.dat	upx

Loads dropped DLL 48 IoCs

pid	Process
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	Crypted.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\Winlog\\winlogonn.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\Winlog\\winlogonn.exe"	Crypted.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\Winlog\\winlogonn.exe"	winlogonn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe"	winlogonn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogonn.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	Crypted.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	Crypted.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File created	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe
File opened for modification	C:\Windows\SysWOW64\Winlog\winlogonn.exe	winlogonn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1968	winlogonn.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1968	winlogonn.exe
1968	winlogonn.exe
1968	winlogonn.exe
1968	winlogonn.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1968	winlogonn.exe
1968	winlogonn.exe
1968	winlogonn.exe
1968	winlogonn.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1968	winlogonn.exe
1968	winlogonn.exe
1968	winlogonn.exe
1968	winlogonn.exe
1752	winlogonn.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1968	winlogonn.exe
1968	winlogonn.exe
1968	winlogonn.exe
1968	winlogonn.exe
1752	winlogonn.exe
1752	winlogonn.exe
1752	winlogonn.exe
1752	winlogonn.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1736	Crypted.exe
1968	winlogonn.exe
1968	winlogonn.exe
1968	winlogonn.exe
1968	winlogonn.exe
1752	winlogonn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1736	Crypted.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1736	1204	963950f8322d5c8f7226d431a3f731e1ace9e3fcfdc98d499584d7df054323b7.exe	27
PID 1204 wrote to memory of 1736	1204	963950f8322d5c8f7226d431a3f731e1ace9e3fcfdc98d499584d7df054323b7.exe	27
PID 1204 wrote to memory of 1736	1204	963950f8322d5c8f7226d431a3f731e1ace9e3fcfdc98d499584d7df054323b7.exe	27
PID 1204 wrote to memory of 1736	1204	963950f8322d5c8f7226d431a3f731e1ace9e3fcfdc98d499584d7df054323b7.exe	27
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17
PID 1736 wrote to memory of 1288	1736	Crypted.exe	17

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1288
- C:\Users\Admin\AppData\Local\Temp\963950f8322d5c8f7226d431a3f731e1ace9e3fcfdc98d499584d7df054323b7.exe
  "C:\Users\Admin\AppData\Local\Temp\963950f8322d5c8f7226d431a3f731e1ace9e3fcfdc98d499584d7df054323b7.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Users\Admin\AppData\Local\Temp\Crypted.exe
    "C:\Users\Admin\AppData\Local\Temp\Crypted.exe"
    3⤵
    - Adds policy Run key to start application
    - Executes dropped EXE
    - Modifies Installed Components in the registry
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Adds policy Run key to start application
      Modifies Installed Components in the registry
      Loads dropped DLL
      Adds Run key to start application
      PID:620
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1968
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1752
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:832
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1692
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1172
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:2004
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Drops file in System32 directory
        
        PID:2044
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1464
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:792
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1704
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:872
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1008
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1664
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1356
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:844
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1228
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1384
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:584
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1184
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1972
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1900
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1648
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1212
    - - C:\Windows\SysWOW64\Winlog\winlogonn.exe
        
        "C:\Windows\system32\Winlog\winlogonn.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Crypted.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Crypted.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
227KB

MD5
e784d021188acf9bfe6710907caddd31

SHA1
268786e5679a16ba2f44cc028d6e08866e0bf1e7

SHA256
771c0f3a6a367355f227c1c31110aaba370055dc38cb046721277cdb551c3f87

SHA512
ca5d8fae8dad8330fbca8992f852d25068cc0bb7a700dbf11845e7001a3dfd4572efdac0940259fc0cf6f87be5bb085a5e469c07d93e330152bee56960df7888

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
227KB

MD5
e784d021188acf9bfe6710907caddd31

SHA1
268786e5679a16ba2f44cc028d6e08866e0bf1e7

SHA256
771c0f3a6a367355f227c1c31110aaba370055dc38cb046721277cdb551c3f87

SHA512
ca5d8fae8dad8330fbca8992f852d25068cc0bb7a700dbf11845e7001a3dfd4572efdac0940259fc0cf6f87be5bb085a5e469c07d93e330152bee56960df7888

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
227KB

MD5
24610a0adcd16382b073276230e8ea6a

SHA1
ba4e51ab9bcc8ea363c72ab07ad7b2e931f94b3a

SHA256
5230955c5aea9d1c5cc156fff25f02b2fbb397bdf57128c37f32cd6c9bcf8148

SHA512
d4d0e74b7ac431d22f7a04cc21763a381258fc39048cec681a3cae3b9ecadde5b38162656c6ad1e31241a7c196979ff0bf009c314f93a4354d90757404d3e3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
227KB

MD5
e784d021188acf9bfe6710907caddd31

SHA1
268786e5679a16ba2f44cc028d6e08866e0bf1e7

SHA256
771c0f3a6a367355f227c1c31110aaba370055dc38cb046721277cdb551c3f87

SHA512
ca5d8fae8dad8330fbca8992f852d25068cc0bb7a700dbf11845e7001a3dfd4572efdac0940259fc0cf6f87be5bb085a5e469c07d93e330152bee56960df7888

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
227KB

MD5
e784d021188acf9bfe6710907caddd31

SHA1
268786e5679a16ba2f44cc028d6e08866e0bf1e7

SHA256
771c0f3a6a367355f227c1c31110aaba370055dc38cb046721277cdb551c3f87

SHA512
ca5d8fae8dad8330fbca8992f852d25068cc0bb7a700dbf11845e7001a3dfd4572efdac0940259fc0cf6f87be5bb085a5e469c07d93e330152bee56960df7888

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
227KB

MD5
e784d021188acf9bfe6710907caddd31

SHA1
268786e5679a16ba2f44cc028d6e08866e0bf1e7

SHA256
771c0f3a6a367355f227c1c31110aaba370055dc38cb046721277cdb551c3f87

SHA512
ca5d8fae8dad8330fbca8992f852d25068cc0bb7a700dbf11845e7001a3dfd4572efdac0940259fc0cf6f87be5bb085a5e469c07d93e330152bee56960df7888

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
227KB

MD5
24610a0adcd16382b073276230e8ea6a

SHA1
ba4e51ab9bcc8ea363c72ab07ad7b2e931f94b3a

SHA256
5230955c5aea9d1c5cc156fff25f02b2fbb397bdf57128c37f32cd6c9bcf8148

SHA512
d4d0e74b7ac431d22f7a04cc21763a381258fc39048cec681a3cae3b9ecadde5b38162656c6ad1e31241a7c196979ff0bf009c314f93a4354d90757404d3e3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
227KB

MD5
e784d021188acf9bfe6710907caddd31

SHA1
268786e5679a16ba2f44cc028d6e08866e0bf1e7

SHA256
771c0f3a6a367355f227c1c31110aaba370055dc38cb046721277cdb551c3f87

SHA512
ca5d8fae8dad8330fbca8992f852d25068cc0bb7a700dbf11845e7001a3dfd4572efdac0940259fc0cf6f87be5bb085a5e469c07d93e330152bee56960df7888

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
227KB

MD5
89cbd2c0a5ebd2d32996e63e13e45bb7

SHA1
5b39d01ee67bae7bd5670f602a5d34d5d99f1118

SHA256
b30e4d219809b8f5c02889c58628d0f51af1ed6c84690aa888235b7f1d16a5d3

SHA512
fa1dd3d6406def05c7aaa9581a5fcb4caf07b505f2f854edcdb19e979f377f47df49a02dd1dcf434de7c7e5a4d6b5807c877904ca90bcc4a4148c06d837427ab

Download Submit
C:\Users\Admin\AppData\Roaming\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Users\Admin\AppData\Roaming\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Users\Admin\AppData\Roaming\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Users\Admin\AppData\Roaming\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Users\Admin\AppData\Roaming\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Users\Admin\AppData\Roaming\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
C:\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
\Windows\SysWOW64\Winlog\winlogonn.exe

Filesize
274KB

MD5
b11e30c990764876cc310039736d4843

SHA1
854310b2669f352734b6028af58c7921e13a9255

SHA256
db668f0494ce0318a29ccd3cffc074e7e460c0519e6164fc091e0b28d100e26d

SHA512
8b94294fdb9724653e212ec7dc5e0fefe0bc57d8e5589eb7c0d5acf0ee65281d67c69558f6a08b8f9369695bbde0f3dc93cb49ebfa60f4b57db704297adaa6e3

Download Submit
memory/584-243-0x0000000000000000-mapping.dmp

Download
memory/620-82-0x0000000024070000-0x00000000240D0000-memory.dmp

Filesize
384KB

Download
memory/620-206-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-136-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-73-0x00000000746F1000-0x00000000746F3000-memory.dmp

Filesize
8KB

Download
memory/620-126-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-233-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-119-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-107-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-229-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-144-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-145-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-188-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-228-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-178-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-177-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-221-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-220-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-97-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-154-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-128-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-96-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-79-0x0000000024070000-0x00000000240D0000-memory.dmp

Filesize
384KB

Download
memory/620-158-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-159-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-135-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-115-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-189-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-203-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-202-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-197-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-167-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-168-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-71-0x0000000000000000-mapping.dmp

Download
memory/620-89-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-88-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/620-198-0x0000000003820000-0x0000000003876000-memory.dmp

Filesize
344KB

Download
memory/792-169-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/792-163-0x0000000000000000-mapping.dmp

Download
memory/792-204-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/832-104-0x0000000000000000-mapping.dmp

Download
memory/832-108-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/832-137-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/844-225-0x0000000000000000-mapping.dmp

Download
memory/844-230-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/872-190-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/872-219-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/872-184-0x0000000000000000-mapping.dmp

Download
memory/1008-194-0x0000000000000000-mapping.dmp

Download
memory/1008-227-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1008-199-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1172-160-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1172-123-0x0000000000000000-mapping.dmp

Download
memory/1172-129-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1184-249-0x0000000000000000-mapping.dmp

Download
memory/1204-57-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download
memory/1204-54-0x000007FEF3D60000-0x000007FEF4783000-memory.dmp

Filesize
10.1MB

Download
memory/1204-60-0x0000000000AE6000-0x0000000000B05000-memory.dmp

Filesize
124KB

Download
memory/1204-55-0x000007FEF2A80000-0x000007FEF3B16000-memory.dmp

Filesize
16.6MB

Download
memory/1204-56-0x0000000000AE6000-0x0000000000B05000-memory.dmp

Filesize
124KB

Download
memory/1212-272-0x0000000000000000-mapping.dmp

Download
memory/1228-231-0x0000000000000000-mapping.dmp

Download
memory/1288-68-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/1356-222-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1356-216-0x0000000000000000-mapping.dmp

Download
memory/1384-237-0x0000000000000000-mapping.dmp

Download
memory/1464-151-0x0000000000000000-mapping.dmp

Download
memory/1464-187-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1464-155-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1648-266-0x0000000000000000-mapping.dmp

Download
memory/1664-208-0x0000000000000000-mapping.dmp

Download
memory/1664-212-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1668-277-0x0000000000000000-mapping.dmp

Download
memory/1692-112-0x0000000000000000-mapping.dmp

Download
memory/1692-116-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1692-146-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1704-211-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1704-179-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1704-173-0x0000000000000000-mapping.dmp

Download
memory/1736-58-0x0000000000000000-mapping.dmp

Download
memory/1736-65-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/1736-101-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1736-61-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1736-74-0x0000000024070000-0x00000000240D0000-memory.dmp

Filesize
384KB

Download
memory/1736-62-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1752-98-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1752-93-0x0000000000000000-mapping.dmp

Download
memory/1752-127-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1900-260-0x0000000000000000-mapping.dmp

Download
memory/1968-85-0x0000000000000000-mapping.dmp

Download
memory/1968-90-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1968-120-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1972-254-0x0000000000000000-mapping.dmp

Download
memory/2004-133-0x0000000000000000-mapping.dmp

Download
memory/2004-138-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2004-166-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2044-176-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2044-141-0x0000000000000000-mapping.dmp

Download
memory/2044-147-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download