442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d

Analysis

max time kernel
169s
max time network
192s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe
Size

646KB
MD5

3c340fa2c8442a973205a1cb018ab46a
SHA1

706d03b9b760fd9e2d55be12e107da6a033141ce
SHA256

442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d
SHA512

db78f6d0f335a5ad497a3a81fa15cb6fc9d9dc1fd8c583081a57d745f9fe579313e7a7fba9feaf66fcd4277f6adcff88dde3944b449fc7eaf6aaf270796a7b33
SSDEEP

1536:hQvHLAQMhFlKXxOvVsNNvpdGvxU1jEdsDgTcDvQ7Tkhbr0lfWuh:hQvrA1dexYWN1aSjEd5TcDvQMhElf

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Executes dropped EXE 3 IoCs

pid	Process
544	winlogon.exe
1140	winlogon.exe
1828	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navnt.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nupdate.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fa-setup.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumphive.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardhlp.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsynmgr.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FirewallControlPanel.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SandboxieRpcSs.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ndntspst.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmsrvc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luau.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navdx.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmias.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cwnb181.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vshwin32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fch32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcfwallicon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmain.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ave32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isrv95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netutils.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvc95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\padmin.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSACCESS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSQRY32.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet98.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Safari.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antigen.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bipcp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsave32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symtray.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwinst4.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-nt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ewido.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORE.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\anti-trojan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csinject.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esafe.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netstat.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcc2002s902.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav8win32eng.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\watchdog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IE4UINIT.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonealarm.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avshadow.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\st2.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapro.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wgfe95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lockdown.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\callmsi.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cwntdwmo.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcc32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navdx.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet98.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORDB.EXE	winlogon.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1324-56-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1324-58-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1324-59-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1324-62-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1324-63-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1324-71-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1140-87-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1324-88-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1828-89-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/1828-93-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/1828-94-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/1828-98-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/1828-113-0x0000000000400000-0x0000000000441000-memory.dmp	upx

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
1324	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe
1324	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1232 set thread context of 1324	1232	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe	29
PID 544 set thread context of 1140	544	winlogon.exe	31
PID 1140 set thread context of 1828	1140	winlogon.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://szs8isd5246s7xo.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://23k7hhashh95h1l.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://48506cqa617e7nf.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da00000000020000000000106600000001000020000000cdcc5f4c9eab49c17b0ec1b57dca40465e9c7eb92637bc7d8b54602c04215092000000000e80000000020000200000002dbbc599f048b501c94a68d07a024a625f2d1ff26c01e61247798475fe0a7e7e200000004a2b0bd0d54464f3d4dabba09326130f740bb68e0f32aa7f70c5f3cd2f91ee9c400000009efe46f002eafa9518ea100b305063d636cd09b215e5839cbec4da12a49debb2d5c16d70a5ee8601b497de2c0b250d95363c66c306f6f8471171f3219673982a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 905b7dffb907d901	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://41t54i3s672g93n.directorio-w.com"	winlogon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c023c1f5b907d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376907249"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da00000000020000000000106600000001000020000000ad24b863294da3c1cdc983800c07e37d7e33a9146666859f62af858220b76d09000000000e8000000002000020000000ede8488e1c51a1e275e110065e6d1f5318c3fd244a346458952ccb1f2f345ab420000000b88bccea5b13746efba750739059be5b913851e223f9c2054f061c32d268a82b40000000664d335e867c71d014d19e65ef138114528830a2122ad82cc6d269016348f4f7e6e8072619d2947b634f45e6d273d5afbbd8dd400a9f0d7fd045ff89d81dea84	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da00000000020000000000106600000001000020000000e76556c0ab9a2d443b22f515586171c3e938164ff05683eaed619ff174f5d4fc000000000e8000000002000020000000c62ed3ec64aa2b8f2a9f20a0e0bfcb939df665b298cac11f90dab1a93915f1c520000000f085ab290f7eec93e99263a1e1998d629840a2d76f1037af467ab2680c8e735b4000000064af47967e697a0f53865516f13f49c428787c2a0ed6ef850aebe7d8dd05cb910a9912862838582881803d50ef5863efb0a45786286694103f9154c37c3e3419	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://y5o07a9r88v44v7.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da000000000200000000001066000000010000200000007ec5353c873137ee7eda855aebe914c7694f44cb200592b101b1f4e0a186d988000000000e8000000002000020000000eb0ac9fe3df7a2d14f7fe5a82715c67019d6e57571e735e9f84eba6667f3c7dc2000000034a3f166107649448b9b5dc64bc639cd40d5fd83bb7fa1cb20905c1d7743ba5340000000e5ef0f81eca78cf4b39169fd5e6126e9447b3f1cc00283127bb08026bcda046848f2f9da0a472eff8e265cdd8f65059dc24b495f1dd519aeb01f7a41992a04b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30fa970fba07d901	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://9zf9d5o3t5x30d1.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\buscaid.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307d39f5b907d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://82p2lq7q56z03lh.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://v0bkngdv6gbxxtt.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11BDA8A1-73AD-11ED-BA2E-6662AD81E03A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://343sfelu924p6h6.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://71d98jx6um3g89d.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1828	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	1828	winlogon.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe
1740	iexplore.exe
1740	iexplore.exe
1740	iexplore.exe
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
1324	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe
1140	winlogon.exe
1828	winlogon.exe
1740	iexplore.exe
1740	iexplore.exe
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE
1740	iexplore.exe
1740	iexplore.exe
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE
1740	iexplore.exe
1740	iexplore.exe
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE
1740	iexplore.exe
1740	iexplore.exe
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE
1740	iexplore.exe
1740	iexplore.exe
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE
1740	iexplore.exe
1740	iexplore.exe
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 632	1232	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe	28
PID 1232 wrote to memory of 632	1232	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe	28
PID 1232 wrote to memory of 632	1232	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe	28
PID 1232 wrote to memory of 632	1232	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe	28
PID 1232 wrote to memory of 1324	1232	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe	29
PID 1232 wrote to memory of 1324	1232	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe	29
PID 1232 wrote to memory of 1324	1232	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe	29
PID 1232 wrote to memory of 1324	1232	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe	29
PID 1232 wrote to memory of 1324	1232	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe	29
PID 1232 wrote to memory of 1324	1232	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe	29
PID 1232 wrote to memory of 1324	1232	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe	29
PID 1232 wrote to memory of 1324	1232	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe	29
PID 1324 wrote to memory of 544	1324	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe	30
PID 1324 wrote to memory of 544	1324	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe	30
PID 1324 wrote to memory of 544	1324	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe	30
PID 1324 wrote to memory of 544	1324	442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe	30
PID 544 wrote to memory of 900	544	winlogon.exe	32
PID 544 wrote to memory of 900	544	winlogon.exe	32
PID 544 wrote to memory of 900	544	winlogon.exe	32
PID 544 wrote to memory of 900	544	winlogon.exe	32
PID 544 wrote to memory of 1140	544	winlogon.exe	31
PID 544 wrote to memory of 1140	544	winlogon.exe	31
PID 544 wrote to memory of 1140	544	winlogon.exe	31
PID 544 wrote to memory of 1140	544	winlogon.exe	31
PID 544 wrote to memory of 1140	544	winlogon.exe	31
PID 544 wrote to memory of 1140	544	winlogon.exe	31
PID 544 wrote to memory of 1140	544	winlogon.exe	31
PID 544 wrote to memory of 1140	544	winlogon.exe	31
PID 1140 wrote to memory of 1828	1140	winlogon.exe	35
PID 1140 wrote to memory of 1828	1140	winlogon.exe	35
PID 1140 wrote to memory of 1828	1140	winlogon.exe	35
PID 1140 wrote to memory of 1828	1140	winlogon.exe	35
PID 1140 wrote to memory of 1828	1140	winlogon.exe	35
PID 1140 wrote to memory of 1828	1140	winlogon.exe	35
PID 1140 wrote to memory of 1828	1140	winlogon.exe	35
PID 1140 wrote to memory of 1828	1140	winlogon.exe	35
PID 1140 wrote to memory of 1828	1140	winlogon.exe	35
PID 1740 wrote to memory of 1616	1740	iexplore.exe	39
PID 1740 wrote to memory of 1616	1740	iexplore.exe	39
PID 1740 wrote to memory of 1616	1740	iexplore.exe	39
PID 1740 wrote to memory of 1616	1740	iexplore.exe	39
PID 1740 wrote to memory of 1504	1740	iexplore.exe	41
PID 1740 wrote to memory of 1504	1740	iexplore.exe	41
PID 1740 wrote to memory of 1504	1740	iexplore.exe	41
PID 1740 wrote to memory of 1504	1740	iexplore.exe	41
PID 1740 wrote to memory of 1416	1740	iexplore.exe	42
PID 1740 wrote to memory of 1416	1740	iexplore.exe	42
PID 1740 wrote to memory of 1416	1740	iexplore.exe	42
PID 1740 wrote to memory of 1416	1740	iexplore.exe	42

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe
"C:\Users\Admin\AppData\Local\Temp\442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\\svchost.exe
  2⤵
  PID:632
- C:\Users\Admin\AppData\Local\Temp\442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:544
  - - C:\Users\Admin\E696D64614\winlogon.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1140
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Modifies firewall policy service
        Modifies security service
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Windows security bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Executes dropped EXE
        Sets file execution options in registry
        Drops startup file
        Windows security modification
        Adds Run key to start application
        Checks whether UAC is enabled
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1828
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\\svchost.exe
      4⤵
      PID:900

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1372

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1616
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:799755 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:1455110 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
5bb25cae0f32937b7b0abc6661a4737c

SHA1
bad78d22c7c50cf5ec9ec343809c6d90705962ef

SHA256
517596724bd34018f2b7c70fd960d6e3df4a670e07a311044a61dd21f316759b

SHA512
c9e5b2eee5c9535abb052d1436ccc6125c40293360c3f35cf9a2d3ce96ab0a5431ea545a97bcd461f2324195425d90fa0388282169b836e342bf2cef7dbb81f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
7c9e0bb25e8c28e8b10038806b0a7190

SHA1
9fa6097aeb8eacde8ba7c9ab80a7a7d2405ae2bc

SHA256
f4864000960be2f888ed7d2467f74130231fed6f56ad48ff15861f5769e95a58

SHA512
a47442cf298b6c42d126e7e0853a6768fcd46cb7c75dcab06fb07a913a2993fdc3031de8fe8b9408b28af472718da5e92fecedf037e18d72a325aece48fde450

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
1KB

MD5
9f76a7ec7f14ab969c7c0fb6598b6bfc

SHA1
721c3560f67baa18d66c6305afb900798ede8067

SHA256
a70094c484798e16b0dfcf8c0267018fb13f3f5356ed800dbdededd72ee067e4

SHA512
5c13bcded1d74bfbbcab574938c560b425c0a95d6b226a0e43518404bddb2040b45f87f52a649ff0045767d0f39e7f839cf030d11e972aec3a7ed7e4fd71c49b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\866DAB214738995E5503DA9F6D9DED9E_26A609C5E563B51B102F06A6E261686B

Filesize
1KB

MD5
627629b203c5214cfc0882c7c539d91d

SHA1
1850e715ea45a9cba981b3c2cd0f423db77b41a7

SHA256
08a10e23e7ddabc8e80be009fe9d4cfec9333cc09d2fd200d9ff394041db637b

SHA512
3653f68a500b13fb797cd60e0a002f00a82a9e1902e4feca4c0a46ee4dc3037356149d2f955381ba82fb14da9d7bdfe644c95b5e9ed6ea2b2e1f315de76fd9ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\866DAB214738995E5503DA9F6D9DED9E_26A609C5E563B51B102F06A6E261686B

Filesize
1KB

MD5
627629b203c5214cfc0882c7c539d91d

SHA1
1850e715ea45a9cba981b3c2cd0f423db77b41a7

SHA256
08a10e23e7ddabc8e80be009fe9d4cfec9333cc09d2fd200d9ff394041db637b

SHA512
3653f68a500b13fb797cd60e0a002f00a82a9e1902e4feca4c0a46ee4dc3037356149d2f955381ba82fb14da9d7bdfe644c95b5e9ed6ea2b2e1f315de76fd9ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
1KB

MD5
3275c832af6321b17787b97afb70448a

SHA1
58358143ea819766796df59cac1b9c634301f12d

SHA256
404d67d1b57d1eef04fec96af6c776cd6d922a6bd37cdf9266e568fc53345275

SHA512
19f9982b0579a9f6e408fc6da5588e7f77ebf49a5b25f5b75128c42621368a597ae3eed936b5c20574d092c49e68a990fce01419993ab2122e8ee7019d9fd072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
525699f30cfeb8770ebe8f6f6752d61c

SHA1
964d6b795cc7b2c027df8074a14ac7abad40de8e

SHA256
ce856f60a11cf87b9d13ae53e42ac89cd0e5c9d43408eb7b4ccd783bc7ed2790

SHA512
e6095065743518031e9516f01b7be3201c957995d349b7c35b4ab55c3359a0092f326b34ec3cbe3d9509697a7d0babf4d58d1b946e810a2f76f12ac9e73b5e57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
c32da6284a5aec4b6bfca1f5cdf93ecd

SHA1
1fd4620cbaf8918b8510fc887d8c8a87c07fe6c3

SHA256
14e432c354988baf0ea3d8a1d5bc9bc3c005eeddd5b83ba4709bd75977c8959a

SHA512
aecd9cf9d86b5b5083b35c25e5420c681b50027cc715929003643357eaed8adb5440fc6655120c5aa8e34f9a664c802cf3f766607d9989af6f50968e4dca08d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
466B

MD5
503fc49adc64d4e34969f18311dc0d56

SHA1
7edd215748a9dbb477f9bea6599dff41db5a28aa

SHA256
d5da188e1091c8ef2852fa946ee11fa2215d6714042d1a967175921f93f594d1

SHA512
8baa821fd987860aac58cb24c87b615a4a35081b1aa4e872c8fe172190991fc5eea326ac75d1c2fb50f98615f47c0d86edfa220b0ef490a14f7ff403acb7b710

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\866DAB214738995E5503DA9F6D9DED9E_26A609C5E563B51B102F06A6E261686B

Filesize
474B

MD5
2c799427db117a6f1da807166a7585b1

SHA1
4aa4f7ec50a8744716496b5ae94d10cd636802d2

SHA256
16cc7f57dcf71dbe06bd7b491754ab37b57db6af1f990973f4204cbd10fb965f

SHA512
cd022f19bd3b5141ed26576ef141fcbebaa43d5763df30a165829cdab3ff55caf7fb8e4e162fe385073cc80c76d3521606f945a76a0d3e2a3e91bc05eb1ec432

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\866DAB214738995E5503DA9F6D9DED9E_26A609C5E563B51B102F06A6E261686B

Filesize
474B

MD5
c16b56918c55b7ff4088dbdd84bad247

SHA1
555f59b0dc9bee1de94c3473fd4327069fd55dd0

SHA256
fe65785a78440d73d81c6ab29d4ced49956f1d367e63e72d1fc39e72719c54c3

SHA512
fcdf9e9f58f1b47133aba83dbcb890e57cafe6586b46635647c634db44a8744dc7a49d10ae36645995a04267bc2ae30b0b58eff0ee130f9e1754fd75a5e54c29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed9ebadc324037eff9c7dc1377a93e9b

SHA1
941136bb1e879a60223009b493d4b2a1c80aeb97

SHA256
960ca502aebf5489966b0b5966deb437b8a999054aaf0ae679175bce98a2ba94

SHA512
40b891ac7f65da1220079c6ec77769772f61e707ec4feb6e344e8511bd699beff5df20d48bb4c757288ca0da908828876146b519f8e59dc7ba20dac3843dcb2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45a64bdec3e7fb77f166983e0de50953

SHA1
c02f0c3fc7bab3ce9c642a851b6e39db46d9a8d9

SHA256
051b62ef1c4a17e28aacf7442a282858d78611f631c18e72193ced72509e4ad0

SHA512
24b940321304f59f7fa96237dd2f5c569f4f54ecb6ebd8921e5bb86faffb2ec2f064ee95ce374e32c8418bf6eea00627ca2c0e882448adc51f541ebd90bbe8f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71bbf30a9f06e216fdc8eec721d7ccad

SHA1
6812c3f6fe4884866b40d1171fc3e4569fb36761

SHA256
79d71c4bd3d34cfe68cb4228d25e1386c450a9cd22b05f51e591c389fe9985f2

SHA512
ba2c582a04a5c8e6b0fc50402dc1d0d03c312deab9752677e82d1bcf82d8f889976ba4d411ee0501bbcabb7ce323e4245c5057c7e8ed56029d4c258735445b78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
314c05b5fe33c5a1dcee8c74873da145

SHA1
684eaca6defa8c4562c8656272910edac43a3630

SHA256
34988c2c784bd3b413a66428b17b052126f70907a7a14341972c36fa01c63239

SHA512
32f1b2c6447eb53bd71e1a8417979ef7dba9079d8b012f60098563d893bb4b39ae1b56a45bc6a34742a1f1be74c560c0cf1dda88f5979281c9742b675c2dd11d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
839167281796b6eaa2fb2ef09e0af8fe

SHA1
dcbbe0243ae8f2c8e24163c5ae5715c5a8d163ac

SHA256
7fc29d734fcab256aefca28b5a7896775bc665fa54a5daa0104fb06c2c01ad70

SHA512
719bbc61dd2cd972444d8642ae9ff6884fef43bf945d8b4898a381f7940854b6196252a7c0804100f135774ac59c4c87f301b1887d231a4084a4050d5cb14e30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59df29e8efdc7da05b9c9db07a184fc4

SHA1
66ad28a7f9c7fdf9ac490f8099f101960b027af3

SHA256
6256eb2446650496862c05beb141ff8a4bb14cb6bb6d5b19992a39b410f17a9b

SHA512
1b59c0c924e68d81a40b87b29ae79e817a9cb320c70f23dccea048c2e583db41c3fe0bf07b25c560fb4450e4403deffdf5623611c7fa4580d1eaace811ce04a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d101f0bd1ad5c35643f301a45d60e664

SHA1
f3fcc0cbd80012db08df1036e0fb325b1fc25cc3

SHA256
ee195cb76de4263714ced82255e3d615e1c7c60ad6e9031412877b7c7524d055

SHA512
828ce4b9f47676c430f50a472a7c05df0e98f25acbd62d3c3a0026532d0e31d0747d866d026485ea6bfb3000bf34c14ab1eb1ee2050408b9538426cccc3bde41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2a69ec9bb4cf85e9b5b6b8c0773be29

SHA1
04a6cf042faf53d711879b639bbe4bee1ca6a287

SHA256
80bf24e660d54ae6372a544b6f4ac68eb798890b83667b7577d84cd9e363c8a2

SHA512
a813846fb79069626c552a66843f52374f8f52aba075ad6510e6cc7a068f2eb836be9f3444b40daed2f8cf60db5ac98dd82acb69a309cce11da4cf84ea21534d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9689147705e159d2278cbdff00de43d4

SHA1
09b59b4e5510cd5b180f061195b46848f2f67cd3

SHA256
d086611961a9d042290336690df8f15eb3ddb7561907cbe92123ffbcae5b8893

SHA512
f8389fb352ebce79f25adc2fbb827d9f4be00468abde6c427aabd0bf880b9b2ee31131c1b989e833599f28a8880d32042b7e5010a11f0e0122beec6a2d22fb7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb0c6569509652935372ebdc1cf4409a

SHA1
512a2b78458484cc9566b5c6540d597801df46ae

SHA256
023ae23c5a7a7050c61e6c5b8987fef4dc2704307adbbf97223799f57f7b9e5b

SHA512
30d52ddbf14ecfd27c31b4164d2b8bb34e14cc957624af51c344a200e23e52a5b96d33b7a471e31a70f925cc5ee99d2b74648608230fbe21bbcfacac03db38a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a669eeb2e81e0c21ba5979f5e2b909c9

SHA1
050e64f653a3e4db699661610d3237936a5ff49d

SHA256
713825d26f234c975577a53b250bb38a77edd383ce193d9f810031afbf9a08ca

SHA512
a75b5c0421449db364abb7871ac90e90e269e8095671d782562c49109d6106b32a4db1c72307003ea06b39381f8fc12d3de06bad77d1a3df49ce47642e09585d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7410afde534b7253ed2bc4b2c8aacf4a

SHA1
adf83943faf73ef554841e8edb21827185c66a5a

SHA256
e127c04e1ec241f72d6941573392b42b1b8e8f5f41b5767a850d30d6201b8f74

SHA512
3744cd18f518ca55ef401e15a6a92bc7b301c08c8d7d75731b03bc45113fbcd3b9ceedcb6b4cd2529156b3f442d5789d0990661b47e9bb087b07a6c9b5014db6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac102c6454925e285e58ce7ab80b67e8

SHA1
6e42f08597524eb85f6fcfaa5488583acd535cc6

SHA256
bd1829befb3bb33e954b6a7f4c29dd0fa8838b3f832b85e6f4dfd786e3ca885f

SHA512
be9a1621a22117f3315eb36b8c5b85d2f25b307e0243f55d3f61de99009a6cef15e02082db3e82854b6e071a690fde03963fbc8419e6e5436ff1e53f48b9ea70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e8c4f8f275b915ce7de103c17995965

SHA1
ae15475a3fa3d15d7d5926bcd7dba8b2c2397927

SHA256
d12df28cfc34e7874679357bbc7142ed120edc968d6152a0e31be73ebf085295

SHA512
30528c0112bf9d4af8babad7d74313f9848853a51ccc6d7569570f8239f3c2cbfc6120c5ba157785366fdc31477f5a71b7556c30257972ea91609990881e2c4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6fa59f403835c9e4f80af06f306d7f0

SHA1
224a2e6ed3d66225cd80ae44c53eebe00cbc7fba

SHA256
832059bf0464d7d7fad41acb816812c7985784f7bdad2c1930c28d297cb0e62e

SHA512
7363dd4fe186f3f4a91a45a9555bd504b34856b8490c4f220cdbe9c1f091fe08b475fd787e4e740a642cd5875242f1429f5a51d3d533410f840c08b80c3ef508

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0b0430df7e5098e75d377fa9649b4ca

SHA1
312815ec2312d13a5995119ab071f2843e723309

SHA256
b9a55efad2862d5afb2af9f8cc9b2a235eb3ce27632ab44a64689b3d6d40e7ef

SHA512
5e5bf8b648158d6539790906b2b5751bf0700798bca03d2ad8d446954b9a5a5e0fde0a2a801ffd5676707ae15a2661ab4e6d274eca1a00a97820151647214805

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33b40b6add26fbc5dc9ba3efa89b6543

SHA1
d8b152f4befe04d73ea6a3e8d513cf458a7d1620

SHA256
693c2c83e6c29765c04b3143fc7f7a7e6b16ef4ce161d09e304064b5cc2cd060

SHA512
743e08386ba51bbbd0c711c97c63f5738b930bbe04e95e5533fb1dfbd0a8935133c8e230dd556dccd250625bbfa835a4fcb3aac09c61311a8303ab89e74e9603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
549a86cb138173efbb9462d4ec179936

SHA1
3eaa966095492e17e82d136d52d9b9bf01ad0895

SHA256
877ebfe1dea14852460fe46a1924871edb3e231e09b715c11404afbcbe2ff35b

SHA512
2139f2147a602aa97b441c850c01f0ff27adfd94a145b01f367adc30bd5795b8b2744dae346db532b6c672f313b563c598e392be5d2a35a5802f4b5c063d64a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a4ba1c3d849fb6cb0ceb323d8970886

SHA1
4b020c58903fa24a3404a780dc23f968ff8c0bce

SHA256
896a1c240bbea5f0fe26ff9104a79b23dfd1bb01ab61039f35f6edb7a1db135b

SHA512
587c73065627db7b30588aeee9e81b62da627bd2b0d9916f65fb69ddcbcdf5b74d9734415caeda5831bf1ffe7c68b51bda7e2c619b291a19b28f1424e0f20d56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05260f57deb457de3441b10134161edf

SHA1
488b2ce8bf539324014c1724b6dc400dd51884f4

SHA256
ff0138af388af1ac0b3d5ba812375649823126eef6488ea42aef6b7f22e1abdd

SHA512
ce0f39b0685d5d9cdc5b73125bcf8a5412f90cdaeee7c29d356a3e91de5c8f9715ced3abb443c2eec6ac0826b294a053eaee250e5013f7e554a77d0d25a9a4f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fe5d721fdabd8bca4b69cb93ac8a7c9

SHA1
5f41ef2cee6e9e64ab8adb94f99a7ec5bd003d65

SHA256
d2a11d10dbe160d11500218b9b162d3833bc6b2591fd2feb9d381c0ec13c1a88

SHA512
79e9b8ad03cf688abcb43880ad7cd0b050e2a77085aa02c48d1dd2fc635c74ae929db7225887abb4d3bcfe1c9a401a9914cab90f551a8505012c949c463cfd53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19df22442e94695fc3312af5908e3ea0

SHA1
5c54d20fafd53104a13d11708bcfea1fac994476

SHA256
20fd066e5640f6ebc3f0e58107bf6e96fae28daccbbe21d06ef60670d141d2fd

SHA512
7dfb4fc5d4f3ec116a960d3c7116526358d5a6d79bf55b662a020e5225f6de1b1280909158bd8a59305bc8d8bcdbc0d0cae9126210e19a730e36bee444e9689a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bfeb02740b7c65089eac3cadd0ae032

SHA1
e4a91fea4a8a38ef74e49372dda2567690c130e7

SHA256
3bfc5c4594acefe54d254f1b41bbd43fce4af6b72cef8a0b2a35de9f965baa80

SHA512
a14d196f3c3b680e1d8784a0044776d1799fc28f1890ea814eaeae11bb0aba093ae14de4894db66af3dbfba71407a0cbe226aaec35ffe542cc6fb039b2b8cddd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e3e40dc3625e79a8f84c49ed65a67db

SHA1
eb9c1d2e3d585fb8c3b79f28c61418777af490ef

SHA256
d422cf085dcc7141e219539aacf50a5e64193073a6b4e58601879e00f97c1d90

SHA512
665a5af14b58c477974b340655509df4aa639abbb2ac60ae2a47b18491fa30e78e4617ebe718c6c1fb65f17eb01b03ee8f3bb7ee74a0a0d6b364e29c25da8e7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78b2eb04b589f86f1d88fc91d9ab9864

SHA1
583804b00cc425783e9bdb86386e0a108bb10872

SHA256
3c7ea785138ed480c549062c14e8d12e1b676100e88ec6d4bc1a66c1b6c7c756

SHA512
b28b41568343c6bfcfc492d79964ea1b2e0e25ab94e615250d37c1b3d21241453f4c5ae2ca65c7ed249c6aac20c7cb70977f5d2cb38119e292e5f554ec423621

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4337594021ce350241455a518aad7da

SHA1
1caa59258eb803e2d362d870eec6b2e440285325

SHA256
d331cdc9ec64dfaa958feb4c5a75f4cde768fed9082a2b968057e13f3d247987

SHA512
06716858741ed32daca90f90d8872148a17c457796cc05b45a5abb362c78b0649df2a032d78f93fcfa164eb87aeeb0b36115a048801c3a264a3fc707aef232bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73f2220513aac52b05c19c74286d34a6

SHA1
3b7110923964ba9c0b9219594f76c97a226f91c4

SHA256
266dd6f2a39cb38ff05d22cbdfb8ff15c42ae344d3f35b5f09e08c59d99c380b

SHA512
d88628b4fb18d9311c25c7ceec978a742dee873414f3b519e1d71ef27209c8ad172b04f70df5aa8d7ea71116421f059c59d7e225ac8a9ca9e0e9e48c8ec988fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84b0a98f66a1ffa8a6aa1891b50e19dc

SHA1
ac78ed0b2668e55f09fa72d95e2d8717f77d98b5

SHA256
118753eaff52985037918f30c5190738ec23adfe667e9fd00873ca3ed9f275a5

SHA512
e69e047e20382a1792e67907bcfc28e8b9324b4a5b1992c7145da0a85a9fde578a1832ef64c134ed3b2b25f3e77172ae4e3c68d4222b43e134f4965220db0207

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f6643cbfa7168cc89cacb1746185a9c

SHA1
1f62115c425d32ef6356be0d1bc57a59f03fa3da

SHA256
f908d28185f7182074496e99f9708598901aed471697167e170a287163f28e42

SHA512
af488d7875e430ae1b689d42d82155cf4d281a392ae606743284b4b4b4f5a86d74f21f160c2710cdd72846dce3107b042023e55fed795056ed896b7547322fe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d96dc71a573a9b7e3c9458b20c13029

SHA1
2fa0e73747564dfe689e866f10666b9fc582b3c9

SHA256
31c55f2cab5707ff6f944b8580c5d8285acee98c41d7c31bb3fe7936b8f37652

SHA512
915624b438c33dbc10e252b36a56b285c8e7374c96c7dd33be33f6404e2fae3740da42c1d313a7fafa81288a0e4bff02431c2f4b89269d4c2252cc10faf7a2a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d26be2645c63c1964e99410d35302117

SHA1
21db73aa04f8b33cde7a112ee9a8eeb9477e97fd

SHA256
fbb2a36e4bfdd2022d47455e21ec5440b4a2a9fc375db3fc5bb6a5fd51ea81ca

SHA512
19530b272d1d03bee66724ea76d6aae744b4f19b9b49ca1eb8b47ac5afdd12c63f4339a1d8f522d0be5d55e8fb53cffcc6e6c54c840c0fecfcaf60747c7d216f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63c37f5deb5553187ff0a9142c006ca8

SHA1
c783ca3cc9b413212f8cdfdf1c1e64e279c4f7f1

SHA256
d12a47916b1aee642be1b64ca58d6ca3ec5c2e0d08a9d7971981fc0cd8d02747

SHA512
79cb6167bacbabf1ad519d4d3618b98b59e79360b4d849d878dd563b7c2e847786e3f80bc943abbf85e528b8edcf3156686c67b7b62e21020a76938c9a68050b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3c74498b310abeaced50f93b52389be

SHA1
8706412afb6e06402206337bc44c53b2657af7b7

SHA256
db8cb953f81f27a74f1f41ed1f0168153187122238a1a0bd1d709e517a05a8d4

SHA512
bd81544677ab2326816140337d922628ea35e79371f3f26ca0565450f62a645aa80c62a76288a16e7cd508525179687c5e07525afa391f0e092f4047a29d2d2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c1bb78b5e416adb790ef9309cdaccb9

SHA1
5a200f14a2f845eab1a533bdd3c88ab91f2d1de0

SHA256
2b3cd18ca422a5febf22e99af9a32889dc8d40ee6f62415fd9c4be839cb89da2

SHA512
d9facb5c42a629b5cae6aed7da29ac13ec0a81ef919b8d39df6b98b6f477dd22ba6cb562389a6edaeb904465fc2456477a8b41fd9797a03c615fe98eef068f3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6296ae9e568b1382987a5b7a4da9987

SHA1
3452a9643867392d7a50dd729d1c1a79337d5d2f

SHA256
051720357209fb995ebc5b0dc3bfbfcef473ef41f419c7e71671b21794cf4eef

SHA512
2b85e1cb7c3ee2adf3d054332f1d44eb4ebcd35c1a7e1253a0f64d3078666dd07ad95a5a81e76746309f8fad14dcbbf4615fb4cd5da1345e0b270ad463fdc571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e840b92e41f6d950649a421f86b3782

SHA1
e343b3c466962fe52433f7a5f48ccb5b265ad67a

SHA256
a66057ee1924adf94b09630f13f95f4708a84035c98aa6cb636bf34877f3c146

SHA512
ae678bbf29c09dbd8036380debde8dbb386925e74ff73ad51319c7285d901b64b417f45b15e7c1bcd65f5d84c3594c48f5b733a84aba5c6b7c0f6300b4492f24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33c6ce393522eb6e0619efe2e9e9c1f9

SHA1
f6a6a081034f06bacfbaee411b131b20bcad3e31

SHA256
3ae936f3c8e1038ec8ecce929040b11d5f0bea48349413238db5fdd14f4a9041

SHA512
ee609dff53d52f8942e60af36b606e13ee4b143664b00d1213ef0dc5b05526b54e292cc8d7fff4a8c545fc2df35ce52aec2605ef8430654cee3462f3d0b93932

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
829f223e7d95edae5f3004fc2eb30c6d

SHA1
62fd643d6650e75b80c7f16767e75f93b6819765

SHA256
f2c7819605f4ea67b209b6ad83890fb0a05e29666838e627de8ed2f8362a377b

SHA512
ed1c24ae295d76118102efb6ccd172eb1b07dfca36d7cf1e8d4b338a4083421465d6b094a8dec41a76d6a50adeb8e5cf837f2374df5107c1aef1dfb9c96e5872

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
470B

MD5
2fd3d0933cac1d00fa15cc95cb8c1508

SHA1
e7d32cc5579f269e4f305a6baf389a9bb7e0d654

SHA256
a8446fe8a177b24d8a51aa64cb3025bd2d538a8a817e70e03f37436950b48300

SHA512
1f568b65fc0e6e47665a1e71897df5952b3c3bc85bf6ef9e7f0a35c149170def253a18d556f5309daee6fe8317a836b0e64cc0cc3e521ca9a0243b8295a072db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
46ea77e35f6607f5fcc1ef41f0e35a29

SHA1
edb69d47f4f817515f8362a87f12569157bb649b

SHA256
977e91778f7b4b974d386640cd10426cc5df4fbf8da541d8362883885c6b1f19

SHA512
221c2055f86a37436bb69218a382591e6c13d73b748a352b20e911d15a7a0ffddf02f431e165492b64308a86a7c3997ed0e9c0c74eaae81ea6711f39184bd735

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\Y8O5GKJ7\www6.buscaid[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9ASIE8R7.txt

Filesize
607B

MD5
52d8a9e2fe5aa1ebab3e6b0d81fe89e9

SHA1
cc14134a6c6dcb86357fbdf08e3cead2227df8f0

SHA256
27b2f39371908c4fb7927f23ed6e9f01404b0875ce978642c7df61a09d4d3a23

SHA512
62bdef459db28d7c351623061d30fbffe0b78dc9dfa4f4ce722bbcc770d7e7a8d742aeef0f1c87e406c2ecd92f8944291a5f592be006402ceb3cce47b329150e

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
646KB

MD5
3c340fa2c8442a973205a1cb018ab46a

SHA1
706d03b9b760fd9e2d55be12e107da6a033141ce

SHA256
442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d

SHA512
db78f6d0f335a5ad497a3a81fa15cb6fc9d9dc1fd8c583081a57d745f9fe579313e7a7fba9feaf66fcd4277f6adcff88dde3944b449fc7eaf6aaf270796a7b33

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
646KB

MD5
3c340fa2c8442a973205a1cb018ab46a

SHA1
706d03b9b760fd9e2d55be12e107da6a033141ce

SHA256
442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d

SHA512
db78f6d0f335a5ad497a3a81fa15cb6fc9d9dc1fd8c583081a57d745f9fe579313e7a7fba9feaf66fcd4277f6adcff88dde3944b449fc7eaf6aaf270796a7b33

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
646KB

MD5
3c340fa2c8442a973205a1cb018ab46a

SHA1
706d03b9b760fd9e2d55be12e107da6a033141ce

SHA256
442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d

SHA512
db78f6d0f335a5ad497a3a81fa15cb6fc9d9dc1fd8c583081a57d745f9fe579313e7a7fba9feaf66fcd4277f6adcff88dde3944b449fc7eaf6aaf270796a7b33

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
646KB

MD5
3c340fa2c8442a973205a1cb018ab46a

SHA1
706d03b9b760fd9e2d55be12e107da6a033141ce

SHA256
442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d

SHA512
db78f6d0f335a5ad497a3a81fa15cb6fc9d9dc1fd8c583081a57d745f9fe579313e7a7fba9feaf66fcd4277f6adcff88dde3944b449fc7eaf6aaf270796a7b33

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
646KB

MD5
3c340fa2c8442a973205a1cb018ab46a

SHA1
706d03b9b760fd9e2d55be12e107da6a033141ce

SHA256
442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d

SHA512
db78f6d0f335a5ad497a3a81fa15cb6fc9d9dc1fd8c583081a57d745f9fe579313e7a7fba9feaf66fcd4277f6adcff88dde3944b449fc7eaf6aaf270796a7b33

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
646KB

MD5
3c340fa2c8442a973205a1cb018ab46a

SHA1
706d03b9b760fd9e2d55be12e107da6a033141ce

SHA256
442ed07066420a5706beab3321ec0d56716e142cc0efbcc47bc1e88e13ecc92d

SHA512
db78f6d0f335a5ad497a3a81fa15cb6fc9d9dc1fd8c583081a57d745f9fe579313e7a7fba9feaf66fcd4277f6adcff88dde3944b449fc7eaf6aaf270796a7b33

Download Submit
memory/1140-87-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1324-56-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1324-71-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1324-58-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1324-59-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1324-88-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1324-55-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1324-66-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download
memory/1324-63-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1324-62-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1828-93-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1828-98-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1828-94-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1828-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1828-113-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download