66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe
Size

890KB
MD5

9c0b63cb17fa4ee66900da0f06cc3e4e
SHA1

ac19722da1fbf52eb9656ba59d818906829220f0
SHA256

66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6
SHA512

f18d6349f5cb180f2f8179d3c94dd1da6978e7dfc04ff9aa495b32a7d0b793f2df5b4c3fab7d9e262fd2b1f589b19ed0644c00f93a713397796e7c81f00e7a97
SSDEEP

1536:hO20qHkRRNpTNJo9KJt7i3ukMV111I8Yp45wzvShJFIn8lq93oFDeUXtk3ns:hMRjVo9uFiJu11upaEMq8Y3Utm

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Executes dropped EXE 3 IoCs

pid	Process
1500	winlogon.exe
1392	winlogon.exe
520	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsma32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfservice.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luall.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nisum.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qconsole.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeweb.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\whoswatchingme.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmsrvc.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dvp95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cwnb181.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mxtask.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ss3edit.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkwcl9.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbmenu.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmlisten.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccsetmgr.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavsched.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\route.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweep.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msblast.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avrescue.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shellspyinstall.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symproxysvc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WerFault.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpupd.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bd_professional.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfind.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530wtbyb.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsshld.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scrscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zatutor.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostsChk.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\amon9x.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\processmonitor.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tracert.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swreg.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcupdate.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpf9x206.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-prot95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentw.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavlite40eng.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ndntspst.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WXP.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-stopw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kerio-wrl-421-en-win.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonalm2601.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANOST.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfweng3.02d30.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwebloader.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EHttpSrv.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbpoll.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iomon98.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nc2000.exe	winlogon.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/844-56-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/844-58-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/844-59-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/844-62-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/844-63-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/844-76-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1392-86-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/520-88-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/520-92-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/520-93-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/520-97-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1392-98-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/520-99-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
844	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe
844	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 844	1992	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe	29
PID 1500 set thread context of 1392	1500	winlogon.exe	32
PID 1392 set thread context of 520	1392	winlogon.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com\ = "1097"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008769fd57b42a834f899fba74f70f59ae0000000002000000000010660000000100002000000002349c250b48696ee87c2bff02c7d6802433425bd52b52a091804f35a711396d000000000e800000000200002000000091961b97766d53a99c6161e99a576937ba10bf4b91214ebf70936923c0b8fb152000000069ece5507ad5306afbc96e6a20505c0b286f17b0ee5b2977fcb0865ab360b1f2400000001c1e626ee7a3fb15104ccb2070222a9a395c49320b607f641bb9d1b339051f7318d71c0c907a42786f3ac52d6c65f98adcca86907305105f1abaa6788f38b8cb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376817763"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com\Total = "1097"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1097"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://fnz2a208671c735.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1097"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com\Total = "1097"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://5h2ow2r0wz13lj2.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://81l86arh6g66lnc.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://j56x1i8js01csri.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com\ = "1097"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://gtmwu058j9fzu6l.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://p104hz1i5546nxn.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB2EA7D1-72DC-11ED-BF27-66397CAA4A34} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e01f99e906d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008769fd57b42a834f899fba74f70f59ae00000000020000000000106600000001000020000000b77b8e057e054ba9f00953a54aebcc306c21fefaa620632cebe0264e388be72c000000000e80000000020000200000003cccde64b8d6a206780315316ed5b3d46cf955ddbc118fa368a806bd5f369e2790000000de94ef50d51121293c6bdb8e75b37b2fb74ab60fcb5fb1bd1b61682d4a1aa75834e5c602c3946ed1be7654f3d43a7c9ee33e559a659170ed1e5e3979acb96c49b9f8764490fe15bca0df281dc1cf2367ba6737459e52e8c661092273464345def1d5fac5aac222605510ea0a8449fe1b8b1972ba69ebf33557e414cb0a7a9e8437cc438ef53d4b740f72b776ff4ee6d14000000026785fdc73eafe24bfc73163eb002b4ffa566e2937c8afa145762b0024210847194704ad31e79a35dcc2b9787f79733123848adcb293cc8a4dd1f9468bcd976c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.buscaid.com	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://37tx6lueq4i89h2.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://3t3hk82bv64616g.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
520	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	520	winlogon.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1932	iexplore.exe
1932	iexplore.exe
1932	iexplore.exe
1932	iexplore.exe
1932	iexplore.exe
1932	iexplore.exe
1932	iexplore.exe
1932	iexplore.exe

Suspicious use of SetWindowsHookEx 37 IoCs

pid	Process
844	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe
1392	winlogon.exe
520	winlogon.exe
1932	iexplore.exe
1932	iexplore.exe
1656	IEXPLORE.EXE
1656	IEXPLORE.EXE
1932	iexplore.exe
1932	iexplore.exe
840	IEXPLORE.EXE
840	IEXPLORE.EXE
1932	iexplore.exe
1932	iexplore.exe
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
1932	iexplore.exe
1932	iexplore.exe
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
1932	iexplore.exe
1932	iexplore.exe
1656	IEXPLORE.EXE
1656	IEXPLORE.EXE
1932	iexplore.exe
1932	iexplore.exe
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
1932	iexplore.exe
1932	iexplore.exe
840	IEXPLORE.EXE
840	IEXPLORE.EXE
1932	iexplore.exe
1932	iexplore.exe
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE
520	winlogon.exe
520	winlogon.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 788	1992	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe	28
PID 1992 wrote to memory of 788	1992	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe	28
PID 1992 wrote to memory of 788	1992	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe	28
PID 1992 wrote to memory of 788	1992	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe	28
PID 1992 wrote to memory of 844	1992	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe	29
PID 1992 wrote to memory of 844	1992	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe	29
PID 1992 wrote to memory of 844	1992	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe	29
PID 1992 wrote to memory of 844	1992	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe	29
PID 1992 wrote to memory of 844	1992	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe	29
PID 1992 wrote to memory of 844	1992	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe	29
PID 1992 wrote to memory of 844	1992	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe	29
PID 1992 wrote to memory of 844	1992	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe	29
PID 844 wrote to memory of 1500	844	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe	30
PID 844 wrote to memory of 1500	844	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe	30
PID 844 wrote to memory of 1500	844	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe	30
PID 844 wrote to memory of 1500	844	66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe	30
PID 1500 wrote to memory of 848	1500	winlogon.exe	31
PID 1500 wrote to memory of 848	1500	winlogon.exe	31
PID 1500 wrote to memory of 848	1500	winlogon.exe	31
PID 1500 wrote to memory of 848	1500	winlogon.exe	31
PID 1500 wrote to memory of 1392	1500	winlogon.exe	32
PID 1500 wrote to memory of 1392	1500	winlogon.exe	32
PID 1500 wrote to memory of 1392	1500	winlogon.exe	32
PID 1500 wrote to memory of 1392	1500	winlogon.exe	32
PID 1500 wrote to memory of 1392	1500	winlogon.exe	32
PID 1500 wrote to memory of 1392	1500	winlogon.exe	32
PID 1500 wrote to memory of 1392	1500	winlogon.exe	32
PID 1500 wrote to memory of 1392	1500	winlogon.exe	32
PID 1392 wrote to memory of 520	1392	winlogon.exe	35
PID 1392 wrote to memory of 520	1392	winlogon.exe	35
PID 1392 wrote to memory of 520	1392	winlogon.exe	35
PID 1392 wrote to memory of 520	1392	winlogon.exe	35
PID 1392 wrote to memory of 520	1392	winlogon.exe	35
PID 1392 wrote to memory of 520	1392	winlogon.exe	35
PID 1392 wrote to memory of 520	1392	winlogon.exe	35
PID 1392 wrote to memory of 520	1392	winlogon.exe	35
PID 1392 wrote to memory of 520	1392	winlogon.exe	35
PID 1932 wrote to memory of 1656	1932	iexplore.exe	39
PID 1932 wrote to memory of 1656	1932	iexplore.exe	39
PID 1932 wrote to memory of 1656	1932	iexplore.exe	39
PID 1932 wrote to memory of 1656	1932	iexplore.exe	39
PID 1932 wrote to memory of 840	1932	iexplore.exe	43
PID 1932 wrote to memory of 840	1932	iexplore.exe	43
PID 1932 wrote to memory of 840	1932	iexplore.exe	43
PID 1932 wrote to memory of 840	1932	iexplore.exe	43
PID 1932 wrote to memory of 2268	1932	iexplore.exe	45
PID 1932 wrote to memory of 2268	1932	iexplore.exe	45
PID 1932 wrote to memory of 2268	1932	iexplore.exe	45
PID 1932 wrote to memory of 2268	1932	iexplore.exe	45
PID 1932 wrote to memory of 2856	1932	iexplore.exe	47
PID 1932 wrote to memory of 2856	1932	iexplore.exe	47
PID 1932 wrote to memory of 2856	1932	iexplore.exe	47
PID 1932 wrote to memory of 2856	1932	iexplore.exe	47
PID 1932 wrote to memory of 2400	1932	iexplore.exe	51
PID 1932 wrote to memory of 2400	1932	iexplore.exe	51
PID 1932 wrote to memory of 2400	1932	iexplore.exe	51
PID 1932 wrote to memory of 2400	1932	iexplore.exe	51
PID 1932 wrote to memory of 1300	1932	iexplore.exe	54
PID 1932 wrote to memory of 1300	1932	iexplore.exe	54
PID 1932 wrote to memory of 1300	1932	iexplore.exe	54
PID 1932 wrote to memory of 1300	1932	iexplore.exe	54

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe
"C:\Users\Admin\AppData\Local\Temp\66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\\svchost.exe
  2⤵
  PID:788
- C:\Users\Admin\AppData\Local\Temp\66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\\svchost.exe
      4⤵
      PID:848
  - - C:\Users\Admin\E696D64614\winlogon.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1392
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Modifies firewall policy service
        Modifies security service
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Windows security bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Executes dropped EXE
        Sets file execution options in registry
        Drops startup file
        Windows security modification
        Adds Run key to start application
        Checks whether UAC is enabled
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:520

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1700

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:799754 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:840
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:209931 /prefetch:2
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2268
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:1127438 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:1127460 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:1061954 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\08B8D8C1791AA7714DD4D760C5F42C55

Filesize
503B

MD5
f5798030605547f4ecea8d47cf4044ee

SHA1
3724b1ed897a387dcf8cfe53e5f13671f7547733

SHA256
ae76bbb6cddd1d36af146ee9cf320b43b3dc249b5cad29a2aec3a6c50d522cb5

SHA512
9d500b569424f28810e13e03e78e2a1001f7e293af2c3d7e1cb8afa22324263ad4c551b005a8f5ce559602fbfda2a52975f1ece5706b063bb4c1faebbfd59bc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\08B8D8C1791AA7714DD4D760C5F42C55

Filesize
503B

MD5
f5798030605547f4ecea8d47cf4044ee

SHA1
3724b1ed897a387dcf8cfe53e5f13671f7547733

SHA256
ae76bbb6cddd1d36af146ee9cf320b43b3dc249b5cad29a2aec3a6c50d522cb5

SHA512
9d500b569424f28810e13e03e78e2a1001f7e293af2c3d7e1cb8afa22324263ad4c551b005a8f5ce559602fbfda2a52975f1ece5706b063bb4c1faebbfd59bc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
a7652d8d56f0f500b6c0fa4dee99ed1f

SHA1
a3913bd6da9fe9abd1eb627580cffd4b4e93de11

SHA256
208b49176d7716f9cdcde3c2d36911d006e2dc6e0f8a80ae0d992e1c9e29b208

SHA512
78ec13fde969f281f6ffb2cea08580bc18856f70d658bd3d1bd4cdac11a4291a0460dbdc2c59dec70120079576bdf81f1e4d9ec0d77e86dc878ec3de82610451

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
1377c2956f6d4d989e6fafbe01600b49

SHA1
7a550dd67e42a8f1ba1468646af02691d0580345

SHA256
4e0206cd8e1112cdefa7f974876461a968bbcbbf016b1b1c2e3af77346507886

SHA512
0c559b1d2e6d1772aba8cc7a9dc8891522dc2df68558d4285ecaa87da4fabd81808f5ee8a599ceb7e26641029f7f9b3d27f33c2f42b0bd1f1a3fc5612083ed09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
1KB

MD5
64cf1c314650b593f140c04a540e4111

SHA1
b33c47c7b494a26d93562be339a7b6363818ca23

SHA256
8528a21bbb18d9e4271b3abee3137611790e826405e812fa4d22dbd969cf971d

SHA512
429b543d58b587487865f798ca7a901de87032f58e64a03ea41193300de1039585f4e3e981146059fed56125edcd0f8e926c5c9a030f63ac90931ade71df1d7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
1KB

MD5
46197022f50b794909b3561af3f42e02

SHA1
3cbde28ec6529125305948aa8169db7f80cafd16

SHA256
5ef10b6c0050600b4c72a137de042e696668cbbda0938bee53249ca4a46a3733

SHA512
780410317edaa0e0853f8035e1729b830b64fdf3bbefa7637d8efa61106ca5cc18a9fceec1789926820dddde87a40d4cc53bbb810674f921ac6f2fca6893bd7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_B49B51C2F61192D2C0D20E671D9EF51E

Filesize
472B

MD5
99c6e888e109cfca37de80b29e284001

SHA1
3082cf79c611491ae64e5599f55e9e4908c457a6

SHA256
19503ecb247142c34038b8ac5e0a5ab5bc7d94ef205beb3edde394275010e15f

SHA512
aad8cfcdb8232ca5fcb2dcd3ed5d7d028001db7e50d47c5178c2894c00ad5712610aec649f4b6aae0c39e0e31b5863241a1ef685acfa6dd0e873c90319384bd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_B49B51C2F61192D2C0D20E671D9EF51E

Filesize
472B

MD5
99c6e888e109cfca37de80b29e284001

SHA1
3082cf79c611491ae64e5599f55e9e4908c457a6

SHA256
19503ecb247142c34038b8ac5e0a5ab5bc7d94ef205beb3edde394275010e15f

SHA512
aad8cfcdb8232ca5fcb2dcd3ed5d7d028001db7e50d47c5178c2894c00ad5712610aec649f4b6aae0c39e0e31b5863241a1ef685acfa6dd0e873c90319384bd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\08B8D8C1791AA7714DD4D760C5F42C55

Filesize
548B

MD5
5389f33caaa42419ad7d2bd44756d575

SHA1
73e6f6fea299874a928fffa2c0325b80fd86cc5c

SHA256
d36be14c123a00824bdc5460dc1a3e98bd3043ec137001ee5bc02a507337ce59

SHA512
3a56a63d7b5d57a29b9b2071d61c02fe185613a233ec02c020746bcfcf77f81def637d729e63341bce736f06053b883f27c97b18f64dc841bd58ff7699babb74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\08B8D8C1791AA7714DD4D760C5F42C55

Filesize
548B

MD5
5389f33caaa42419ad7d2bd44756d575

SHA1
73e6f6fea299874a928fffa2c0325b80fd86cc5c

SHA256
d36be14c123a00824bdc5460dc1a3e98bd3043ec137001ee5bc02a507337ce59

SHA512
3a56a63d7b5d57a29b9b2071d61c02fe185613a233ec02c020746bcfcf77f81def637d729e63341bce736f06053b883f27c97b18f64dc841bd58ff7699babb74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
387b364c3add186533252cb35465f5e2

SHA1
d4cbab5064656b22cf675be3daae8ba7c6e53ca3

SHA256
042ee88d8d803aac115f4caef23b67c531193edf5b6bb4fa9e810630a0162f50

SHA512
dc7facaf0fcbffe836742c7625ed112dc84b45e350a0663c24f486f03108d2d22f84a3d742b4b82b291ceaeda05afb3a9ec26912907717a6268dda15376d4b49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
387b364c3add186533252cb35465f5e2

SHA1
d4cbab5064656b22cf675be3daae8ba7c6e53ca3

SHA256
042ee88d8d803aac115f4caef23b67c531193edf5b6bb4fa9e810630a0162f50

SHA512
dc7facaf0fcbffe836742c7625ed112dc84b45e350a0663c24f486f03108d2d22f84a3d742b4b82b291ceaeda05afb3a9ec26912907717a6268dda15376d4b49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
5ff7feaedd35afc5e8b46de65e654954

SHA1
5453acdc7814c9a747d98133faa9373462597786

SHA256
b5ceb233fce50840b2b936a4f0ed8dc14a25e91bfb3715d51663c92542a1d9cd

SHA512
64c14be96c0327cb1e4c817153ba26235c5330e7a4e3fb1980ed963743f9d178dab0fc2694cd50c1760ce67797bc6ab8c8063453e11b5578dcb9049141e5ebfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
02c59dabebd1762742643ef3e203e2ec

SHA1
a899ae8ddd1372228227772b84c860f601e52442

SHA256
75a72446794760bfc6c142afb073e47907f97be301aef1f9768b4c007286911c

SHA512
6b00e6a9d679ecd43c5c890c6d2dc0a94f8026c1cb30b0634c4a53453db9dcb3892c5a6c05246a8c11330c9e9187f41606f5b9bab1d6affb1b16003ed7d6c854

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
466B

MD5
287bf4ab58759feaba623d36d291bf03

SHA1
6b68cdeaabe6e1a362f6e6cc3a6dbe0251791b66

SHA256
efc5f34b48f476e0690e550e9dd21e43a6578518b0bcb2814561994ad1fb4fa6

SHA512
d03189f7771928384d32c0d86c70051290f5902536598a963d7c2bbb0008cab830f7081ea467a88447b3a76d80ee952561f77b875309f1d0560a6ad42d396580

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50b583b600cdf246aa0446c9ad477819

SHA1
0a8d71459f095ccc04cd79ac6ff0a97b46a4ac73

SHA256
10d687bb9e7030c10c74f9d86338e5bb72908df598b83baf828cbccb533b5005

SHA512
8b041a3be45f86d3cdba5287084af20d74e422337b2589ddd590fe3dc10a50a55874f76ae19348b66c82c706bcad5b090bab9ba2f22655ea9933dd1d1dd4b0b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62493872794ffb20e429e99cc26f8afa

SHA1
76c98825a2765beed7569e05329dbadcd7aa3262

SHA256
493c21aa73576ee0b924c1b18d2fee653a1c7cc6f41003ea607ef0b752848534

SHA512
2905ac597ef602f06ede03a8baf74ea64a89d704187e05e7ee0ad1d7afd829cb15356e15ccaf5e25e3d3314cb817ea467a8e5c27923795b4c5e5e0ab0afb01d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35fc0138fc6286a1c312878031cdbb16

SHA1
e7c8b64178632b35b1d386c0333186464d7f8172

SHA256
80ded8b1e688aa19de73aea9035abaaecaab43b6cdf138bfc338fa13a0b7bab7

SHA512
95973920f69bfa56ccfb2824d4b0c567d9c883ad349674a0a5c5814f2d8e727d6574319e1938153c6a12658a9c7c9cca1cb81bcc2e9206fe7f98dc38f2a16605

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b40fde6f0377d18992fc0e1d7882753

SHA1
e9c1e2c9ab1df28fb4535c56671db2ba2de7f60f

SHA256
d847bcc826b1ae8e067aa973bb21296d8fbf4232771fd694a3b35e5c1813922e

SHA512
cf7ba5577dfde8843038e3169cf66ae76101866eba7a4801c19711b93e145d9b0da590edf3d20ef4b8f9f64b35d79ce24c73404d9b3e841e9e9069fb387e90ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd92e90c763bbcd228ea70fc8fda6447

SHA1
3503d630ba18473a643e944bd343cfca8733003a

SHA256
515c40d880a7ce78c810a50049ffeb729bc70803f8dd1edad53c7717e5a5f9a7

SHA512
6ee5259dee56df4a2b72a86c16507f37f46be6c38e48ceb9b65b0a3673b93356411500f9827a317b396e29ca72766b49844f8e676fff5e1e83e1dd762fc56d36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fb535a6f08ce9bdf3f18196f707d08d

SHA1
d35e76cae07d30d4c512c85ead4a63885b29b0a4

SHA256
d5ff4ca44e4358f220e12d308cf453550ab91ddd8cce5781769c3d884aa17e1c

SHA512
41a40b67b6f086e212127fb0193b500ed8e370cc7fa35fe7a5d90f60eb1b65ccee8408a73921699031a6acf709da33666e7b76ef159b913d30606d2adc0b92c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1895121ffd017fd425b05b44b4b8c34d

SHA1
eb0bd56d91116cc792a0f5457cf6e25b978eb2a5

SHA256
d505388fb598ca19a71c2b5fc744135afa8df520c6f3f0abb3aa90ca8903fa64

SHA512
fb26ac347770d575b7887f043fd068cdd100f95509f30deefc6632dd8fa64a24b35d5ae881ee2a5dad02272c694af7878263a8713162c9eee4da70f5ba04c605

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e177abce133b39531fe7a8b9ecd099c

SHA1
fa255cae3587ae918a88bc24f8025c35e6aaefd2

SHA256
6697cbd8b53d097ebe2c783698f5e5e00aefd5024f90f1eee2dedb9fc66e61bf

SHA512
8d28f874c79da0387d12a820c4978b0bf97011288cb274305b4624237aaa322e6d31305bff21c61a63a364ea93bc5b05a6858ce398291c96e992ef28c89c6dec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
934a4239771010b938d1a689276e5bd9

SHA1
63d83a24eb6d96d677115e2dc0d35b6dfde35566

SHA256
d3b72297062f97edf9ee55aac085ce269234ea646db37f550f2d98de0061de24

SHA512
09b6fdc923171748b1f554079170f4df23dfdf755e9a39a41ca929180d22a0eb95f99c9c3d5c709cd6f94e17da194aab3ea73a9e96f02618752aba00a4a1c04c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a64907970c91e15758d4ffdc6d215448

SHA1
a3ae14114479d807c935988db2bb1ed0d843a2a1

SHA256
86d165165f376f90e080c6a4dc1e68f61874100569363e09ffd356768c6be9b0

SHA512
cf77d4c4b3fdc9370cf04af4fd7f6b6c15275302b851ade90c980b40c8de65815b299b0aa3305c9abeb7691184a39ca4898e908b18161e9ae98b80168f9231e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c1a4571011bad2f077ded30a8899aba

SHA1
b2d86ea667c9d03d2e8d171e8c38a2e478a8856f

SHA256
1db23f697f47890149bab37eb6b042a9ab5a3dbef1ee13a21017c9d9c62fdc61

SHA512
1e59d7c1e890f719eefbe5df5af2947cbc1dffd36d7c8edb88483d4758062713e0001d8bddacc3cff4f10a285fc9f99e7c862afd1779107f02e1f5ffcd1d3cc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d62eb516d9be1ec4f41e1fe08265a3c9

SHA1
35c60f7fa8333e82dd6b4ee72125cb1e761fe1f1

SHA256
9cf2356d2c84b1f346433ef3dde41e3bcdd013772e75282d2165fc480e291f22

SHA512
70481ba541b4febaf87491bb33769e1d57ad93ca9fcee7549f2246fb60eecca5f53aad695f1fffde1cd91cc69d800840f79a099a02d50c9fb10cd4b84da09551

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d643412d1b1902220e57dbdb8d30d89

SHA1
f5e380075f94de88c955e5bcc2457e14d41cc0ba

SHA256
f548816cc9c810877dcf722f305a72b720abbd22e7f9d7a4266dc4eed6862d01

SHA512
b6b844d1a6a33b0ec83f3f468c6098c1114599966126e075308ad1033ecb4b634a0ef345ceb8ba65f28806af8f4c0ba82f831e99c2ba0dc401871f770af712ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94294d721e890d6c5dc1c3bea61627f2

SHA1
d48e4b8935542c4ae411afbd70e26a15f26cdac2

SHA256
f63e818d81fbd888a61ad1e124df2cc56baa17f5d8494fe3aebe7aad47c50328

SHA512
b18211079457677cd515f0c9ac62103aaa13c85c0340182e6987e5f929817a797465e5856504198d723c09f831446c874c4ea3284ab8e56a7c6013ef66bd1e66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4a39c79fed83612f011c91ae7220836

SHA1
f3314ddd7656f2e27e04e6041b4f837825990273

SHA256
f08581ccf216b22848727af5e4706e1c1fe8c80e9cbbe05a71e9d6051c5fe97c

SHA512
cdd614ad6532b5ca49b87a4c8f104cdcefcdd3aba87da012c16335994b31f4c4a59d1915ce9d08c2a3be9fa0524aecea77daee03364a2998900383d29da093b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e3d9134d1a1f5da869bdc7f9063dc59

SHA1
5ffc546651e7d758dcae72fa861e5e8dd955dd0b

SHA256
310cdc6a5e7dc6a67bbde0ac32c840d4e7ac813e184cb12a58a75654a01b0d3f

SHA512
9cf206d6a2b2ab82ac4cfecec8707977ff7237bdebcf23f69b0ae8bafd41f0c9911a64b24239de0afb110f93c573728a281b534391473db581a68a6c74d470d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5fb99bfb35d10a2bb4c8fc1ee04a55e

SHA1
afd9c535e45847d79c9b7ed607e623111a59bcc6

SHA256
42a72a9c3ac2f59b7cfb237ec390b1e9c2e10d883f2329ab24fe46c0f28f3c5e

SHA512
3ca3ceabb3ff1e4c56a0150af439ecf11dd4d1a71795cafbc832b72dd9b5dc986e4f1909720af4508721c1736864fe026dd182359aeba12e3a7d111ac2ba0f1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e153eb32c37baedbe970406eaeeca06

SHA1
1470d0670b164b2222b000c224052ec5601c090a

SHA256
9f98a01da21543ebda36e99d2c6fb6e14c4720c03b5584348be71e2651977b39

SHA512
db4ff4e87ac46a6504dfd00294e22ee80cd073024ef20c6fd045f66e480925f7161d8ef505e6dc0d10cbd967ca613f72178fcc08617a1143de488092d1b8fc79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
470B

MD5
8f1c7f44c6b9298f5a1af7c04de5992a

SHA1
0d9f00840043ef76e4d0646b41df8c76362b64ed

SHA256
5748c9bb1e12776587d8aa1feb9d74715c2edab26f2043282a4f8c37bf8b34ac

SHA512
ae5a3462679800aea33e028351cf46afc4084956072a741a06b2bcc1072061a98f667dfdb8948cb65c5d4bd5cffc8fb6d5606c72c12fdfcf61ece3f303a32a1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
33ca3a602ac9ecb22835469957dffd92

SHA1
cf1de939592f3c817ccb49540d780947f60f42f1

SHA256
11ad6d6cfa5c91016d03e47e8602eb5df6bd5c2e056154f94956a26180e44417

SHA512
64d7ba2695be812d28f1d3541d88a0686bd721ec23d60758c860eab45b3ff6e7fdf33ef9eb890bb70326af85c4fbcf799f81d7cfe1e4399bdbbe1af83f7b6881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
252B

MD5
453784cef1e687e775d02b8f9f102338

SHA1
12476aa640c31324e76049841ed45dcd274be00b

SHA256
e24a47eae621a056fe1f67c3dc37b7bf8bb5f79e92ede4979be373fcd8aca791

SHA512
b94e8b9d1d79faf892c2282e590f878c235046e9b814682a5805473096d2301e89caba60e6ad9d6301083dca467294333187cc83e847a4badff92a9f6bf4f051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7a0e6ec5bd227371e9c57622a48b2ab5

SHA1
8e87991009761a2da5b84cf0a8e7070bb33c2b2e

SHA256
afbc3caf1d5cfd6477d2e749080c133b15ec3b0281fb78587eae7e0ecc5e7c01

SHA512
371a5bb211c238cf2a622ae87b9bcf8087b42c86d58f70bb595ecd1622a9b9d0f63a205846d30b2adc42e39b2530089993e6d32863d4b5f44839d47edb62f203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_B49B51C2F61192D2C0D20E671D9EF51E

Filesize
402B

MD5
7cb3a4ff6b327fc879deb0d4d293a27e

SHA1
d8c92f753a04b01ca8a19f107402b2b6988ca0b2

SHA256
eb066a3890dd3e0349a3c855b6f1ae4b7e658077800cc4d5a1f2aae4bda39f84

SHA512
ff2f0936405e2bd6c406b28a569383bb42338bad633225adfd66ba29db0e8cf93cd7152d9660cbe68b70c625038945ee73ec161d641e5a697cc7f17b9ee43527

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_B49B51C2F61192D2C0D20E671D9EF51E

Filesize
402B

MD5
7cb3a4ff6b327fc879deb0d4d293a27e

SHA1
d8c92f753a04b01ca8a19f107402b2b6988ca0b2

SHA256
eb066a3890dd3e0349a3c855b6f1ae4b7e658077800cc4d5a1f2aae4bda39f84

SHA512
ff2f0936405e2bd6c406b28a569383bb42338bad633225adfd66ba29db0e8cf93cd7152d9660cbe68b70c625038945ee73ec161d641e5a697cc7f17b9ee43527

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_B49B51C2F61192D2C0D20E671D9EF51E

Filesize
402B

MD5
fb84c22c63d0d654626581cff97aa4a9

SHA1
58e04365e1314a553b65aef2d15da024d57fbc2c

SHA256
a011c01933eca476b6efbe76a4c56e06e883bcbc2b931ed5d85d7be2b0177f42

SHA512
3a9046bfeab3b791ffe6e867b1b8ffeba8c5e3eb8f2fe9a84c4673a03245d1f17fd173f71e935e07fe30e924eedf9cca76634dfcd68497804a886eb838b64e50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\8YP7FNCX\www6.buscaid[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\8YP7FNCX\www6.buscaid[1].xml

Filesize
1KB

MD5
da92ff4de3aa172ca80f33fe65124db1

SHA1
6df1b1b6460e9ab96cb7f5082cda4ae0ee2ccc40

SHA256
912ef303f63d9f72238c864cc0f0a9f786b16b0dfd9649f41948c69f5a0a34fb

SHA512
38928818531a7d20349cb93f75c779d1e2e2b16937669ee5600c6e4c348e663dfc06765c8491daeb2b78c9ea045fb32174eb08fadb1bd2f7578bf2e297c11f80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V72XLT2Z\caf[1].js

Filesize
143KB

MD5
828617b5452d4e9de31fbea1420adf13

SHA1
5e57799115640a59be11c231c483d5627b2d624e

SHA256
fd661c6f74593303ff4667fd893a951e4bce7cf93f89f5cb95ff265595d7015c

SHA512
9c4ab8cbec196ab6d6e19665dc22208b1c314db6e62f0d6a9d7edc4daaeae8279da25bbf5c7e40f6f2034a39491b89a8ce175c9164805a5da4d4bd434319d452

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\3TRU2M2H.txt

Filesize
110B

MD5
a859a3da0f4e3468a7abc9d55788a5ad

SHA1
bf846ec647c6d51a5cb565c1bc27cd832f679f8d

SHA256
e5a1050068804a7f9977d62a87f2f1409aeeab0544f521c500ff00481bed7ad8

SHA512
b33943cbffcf6c5958d9204f8786abd62f7184b399862fda41b8d971c2fe6e5d14d29902ee05000a3a935f8722c29626a7ba00ff8ce2b90a08ba436cfb517a02

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\B1570O48.txt

Filesize
110B

MD5
f021806cc9250b342f68eb5cfa1432df

SHA1
118e2d9aca202756a5dc3b35ac907a181ac725ae

SHA256
1dc64757b11ea68f528f8c3107f68aead60ac5a9e7c390a92b21a3152f5591bc

SHA512
85a91ca161fd3e86cab609c4e413b03aa15b7a5b9472b0bf4110846e458ecba769de8dec57c84ef166638ceecc27738df6773452973366c50333d67b2a2f42b2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\D1Q8E2AS.txt

Filesize
137B

MD5
895f80731f9d6429f97b0fa6685dcc45

SHA1
f289590a2048574b0f36d01f5b41860df3a2b4a8

SHA256
d7e6b8f2eae1a00ce57a7e17ca471d1efe6015b543204bd02ba7e8cd6ea8a717

SHA512
cb61da2ddc848f8556289ed30978eb3b45f93b6855a9c1d6c2d39856917b56f9cc3b0ec83f01a5fff6124c7b34b69afe7e4c95a518940f7f6b2bf20732958c77

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\GIUKBS3D.txt

Filesize
539B

MD5
5f51f646646bd0730215dbaf864296f7

SHA1
cc19a345928dc06c23710b9368f33471b36939d4

SHA256
8a35a776d9fc437b9c876608792ff58d876d3d76f13c86a2a5d80d27ec55b141

SHA512
ced15221833dff1ce7a9b2ae8563b852d4da10136f1c54401d0008461e9f3a454f4e28d43d67b174ae0a9c85fe930298c4ded53fc4c19f0a7ab9bd2618bad2f8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\KDO6O1N0.txt

Filesize
84B

MD5
0ac03b3fb7c417ec87908315ce9d463c

SHA1
b20987d77351bf5c6c9da0d013b3e7bc06ceef61

SHA256
1b08ae1cc2f487311641ce6d560aadb140cbdcccd0539bde18191f8d1e236d88

SHA512
35dd84ab6525c855cb91fc68eab701fecddc5e5bc6f9fe37e5a45bba98edc1f46b642c75843c0a53e85d0da396a68c2cec92e7835d96ef3eb72ea19884fc8c40

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Q1U2K0LB.txt

Filesize
432B

MD5
e8e2784ccf2fda10d91694e22a8afa4a

SHA1
5bc89ac0695716c0accdd3b0ad81ea58f5464a62

SHA256
7cbdc3aa1719dce22cb27508236b2bea07d20b9ebf09060dfd73d646ec3b3c16

SHA512
e51a1703593abf378e34301d7349280e803ec9bbc8cd3468e4e68432d266a7634b7989b6652921a7809f710ea00f33ab19cb90f20454e153729c1012279525bf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\YFAB2U15.txt

Filesize
84B

MD5
3747b28ea084d7a808a34c6c6d2260a0

SHA1
f6aefaf7b65faeaaa08cd6a3a5da876e52318053

SHA256
3d0954404a7e0c25c6fc9d74c1f57a94f8a0a3eddd52aa8d34b2936cfafc605f

SHA512
b619f84a1cd41b817ec199d6ebc6eee5db1e36664ec35921cb5c10406e23d0a97b31a52ca48e036ecbd42cb9007f86e4c30da7ffbb174ee26d17b7ecd4e4e1ef

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
890KB

MD5
9c0b63cb17fa4ee66900da0f06cc3e4e

SHA1
ac19722da1fbf52eb9656ba59d818906829220f0

SHA256
66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6

SHA512
f18d6349f5cb180f2f8179d3c94dd1da6978e7dfc04ff9aa495b32a7d0b793f2df5b4c3fab7d9e262fd2b1f589b19ed0644c00f93a713397796e7c81f00e7a97

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
890KB

MD5
9c0b63cb17fa4ee66900da0f06cc3e4e

SHA1
ac19722da1fbf52eb9656ba59d818906829220f0

SHA256
66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6

SHA512
f18d6349f5cb180f2f8179d3c94dd1da6978e7dfc04ff9aa495b32a7d0b793f2df5b4c3fab7d9e262fd2b1f589b19ed0644c00f93a713397796e7c81f00e7a97

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
890KB

MD5
9c0b63cb17fa4ee66900da0f06cc3e4e

SHA1
ac19722da1fbf52eb9656ba59d818906829220f0

SHA256
66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6

SHA512
f18d6349f5cb180f2f8179d3c94dd1da6978e7dfc04ff9aa495b32a7d0b793f2df5b4c3fab7d9e262fd2b1f589b19ed0644c00f93a713397796e7c81f00e7a97

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
890KB

MD5
9c0b63cb17fa4ee66900da0f06cc3e4e

SHA1
ac19722da1fbf52eb9656ba59d818906829220f0

SHA256
66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6

SHA512
f18d6349f5cb180f2f8179d3c94dd1da6978e7dfc04ff9aa495b32a7d0b793f2df5b4c3fab7d9e262fd2b1f589b19ed0644c00f93a713397796e7c81f00e7a97

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
890KB

MD5
9c0b63cb17fa4ee66900da0f06cc3e4e

SHA1
ac19722da1fbf52eb9656ba59d818906829220f0

SHA256
66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6

SHA512
f18d6349f5cb180f2f8179d3c94dd1da6978e7dfc04ff9aa495b32a7d0b793f2df5b4c3fab7d9e262fd2b1f589b19ed0644c00f93a713397796e7c81f00e7a97

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
890KB

MD5
9c0b63cb17fa4ee66900da0f06cc3e4e

SHA1
ac19722da1fbf52eb9656ba59d818906829220f0

SHA256
66f6904751985f14aea6e5ff73c7ccd6fc68b4795b9a7bc0f4665f094b4f02f6

SHA512
f18d6349f5cb180f2f8179d3c94dd1da6978e7dfc04ff9aa495b32a7d0b793f2df5b4c3fab7d9e262fd2b1f589b19ed0644c00f93a713397796e7c81f00e7a97

Download Submit
memory/520-92-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/520-99-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/520-97-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/520-93-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/520-88-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/844-59-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/844-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/844-76-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/844-66-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/844-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/844-55-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/844-58-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/844-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1392-86-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1392-98-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download