18063aec34073060ab335406a1303cbdb8bbbd11e4b02358888ee5681339a796

Analysis

max time kernel
69s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e22e53f409b3e9d4523af3e74b30c44.exe
Size

3.6MB
MD5

3e22e53f409b3e9d4523af3e74b30c44
SHA1

178e7ff1870e1d62688c4e396572afd7b8bb839b
SHA256

18063aec34073060ab335406a1303cbdb8bbbd11e4b02358888ee5681339a796
SHA512

60d1adf0819d8317dff03e483debbddda0577ba3f91eba545c8a3a44d82ba3e2e9f9cc5e27d4a25bfb8c512aa256993ae5fc8aa2e1dd9f7069e86cfcc5f88e55
SSDEEP

3072:4HqLaIXw+0L/dJjDJgFpCsCCw+dMhWmTC7hwue6DuqDz:B

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-8672410"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-54480146"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-72685592"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-26047"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w32dsm89.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2servic.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamapp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\supporter5.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavproxy.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtvscn95.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXTEXPORT.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\amon9x.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ecengine.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfagent.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvapsvc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ogrc.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webtrap.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SrchSTS.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\amon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccsetmgr.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\connectionmonitor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamapp.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavsched.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\purge.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwin95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwatson.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rrguard.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpsvs32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpfw30s.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winsfcm.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkserv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lockdown.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmnhdlr.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nmain.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qserver.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swreg.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcmserv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapsetup3001.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cwnb181.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-agnt95.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fp-win_trial.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsupp95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsshld.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfmessenger.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SandboxieDcomLaunch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETLANG.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autotrace.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsupp95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntrtscan.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpf202en.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Netscape.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spysweeper.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpcc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fih32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmb32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guarddog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qserver.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweepsrv.sys.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\exantivirus-cnet.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsched32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ostronet.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\serv95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv9.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxmonitor9x.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fprot95.exe	winlogon.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	winlogon.exe

Executes dropped EXE 2 IoCs

pid	Process
1220	winlogon.exe
3052	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
2468	3e22e53f409b3e9d4523af3e74b30c44.exe
2468	3e22e53f409b3e9d4523af3e74b30c44.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3052-72-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/3052-76-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/3052-73-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/3052-69-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/3052-136-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/3052-190-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/3052-593-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/3052-621-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/3052-2545-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/3052-2546-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/3052-2559-0x0000000000400000-0x000000000043F000-memory.dmp	upx

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\F454741525656435 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\F454741525656435 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1220 set thread context of 3052	1220	winlogon.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 45 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://15w2xj8u105n547.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://75dj3u3pq6x3o99.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://4y85689k1574138.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://b1x56z579xrdm0i.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807d50034038da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://44dc9h581o3e4ua.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000080df284e0d8d9ebdeb9013a2781fcdf320cd347dab14c15fa28df47525c11192000000000e80000000020000200000004ad399c662f618a71858f2684cff51fa02f16bf54ac4f987d880241bb87ee9c1200000007d42bbb90a8a89bcc21fe255d1938d85f905871dfd585af8b2acc61ad3e6585640000000d716ab153906a9e5c0a54b784af12c5d3f9409f72523118db8d3cdfde413885eb90345ba53e4342524ce9773f329a00ac529dcf82f896cab1a04347b9276fcd2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27F8D3D1-A433-11EE-B49B-CE253106968E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://00iq6p999ot903u.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://20y27mdn68jyh8t.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://yq210481hzt8533.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000e6ecbe4fe13434f036b4607f8d34b3ef211b0b8328b25bc04e9124a6c8e1b79d000000000e80000000020000200000002031217af3cf8fbdf393a0b2fab4eccae21dc22029d5ae9b41f09075832cadfe90000000d2d10e5218b03ff47109804cdc561986352759fbfe0ea07b4521e24050cb8712595d66313c087c75bcb18494e4fe157c8657bc6e71ee2ac7d5cefd64fa81ac6ee0177d7eda7d19ded1ae94df11158a771aa96713ad4aa744f00502473bd9b65ecb4a6a423addab3641d13e438c9946ea1ef268b7669511280424390dd91bc1241c94e50b569f0e14f37f367704781954400000004a96b3ad7c85ddc473aee60fe2a6fd625c9930db3014ca565fbc2ca75c0a6291409f665657edf0a49d317c39ba6ac9aa32ebce58101cfc2e1c87e9219f2c1616	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://13i6cp3848lqo1w.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://qj2655akh8266fl.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe
3052	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	3052	winlogon.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1628	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2468	3e22e53f409b3e9d4523af3e74b30c44.exe
1220	winlogon.exe
3052	winlogon.exe
1628	iexplore.exe
1628	iexplore.exe
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 1220	2468	3e22e53f409b3e9d4523af3e74b30c44.exe	28
PID 2468 wrote to memory of 1220	2468	3e22e53f409b3e9d4523af3e74b30c44.exe	28
PID 2468 wrote to memory of 1220	2468	3e22e53f409b3e9d4523af3e74b30c44.exe	28
PID 2468 wrote to memory of 1220	2468	3e22e53f409b3e9d4523af3e74b30c44.exe	28
PID 1220 wrote to memory of 3052	1220	winlogon.exe	29
PID 1220 wrote to memory of 3052	1220	winlogon.exe	29
PID 1220 wrote to memory of 3052	1220	winlogon.exe	29
PID 1220 wrote to memory of 3052	1220	winlogon.exe	29
PID 1220 wrote to memory of 3052	1220	winlogon.exe	29
PID 1220 wrote to memory of 3052	1220	winlogon.exe	29
PID 1220 wrote to memory of 3052	1220	winlogon.exe	29
PID 1220 wrote to memory of 3052	1220	winlogon.exe	29
PID 1220 wrote to memory of 3052	1220	winlogon.exe	29
PID 1628 wrote to memory of 2504	1628	iexplore.exe	32
PID 1628 wrote to memory of 2504	1628	iexplore.exe	32
PID 1628 wrote to memory of 2504	1628	iexplore.exe	32
PID 1628 wrote to memory of 2504	1628	iexplore.exe	32

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\3e22e53f409b3e9d4523af3e74b30c44.exe
"C:\Users\Admin\AppData\Local\Temp\3e22e53f409b3e9d4523af3e74b30c44.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\E696D64614\winlogon.exe
  "C:\Users\Admin\E696D64614\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Modifies firewall policy service
    - Modifies security service
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Sets file execution options in registry
    - Drops startup file
    - Executes dropped EXE
    - Windows security modification
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:3052

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0ab1f9b91528b6a84e080408835628a

SHA1
a4883cb060192290b7c80d4abb2972b407f78fea

SHA256
0fc802f45e9ac2b9a7ed869c41e78008cdf6cab24c269af544317c44370bfb20

SHA512
fd504b1f1be9dd37e523f83816e110621524d9f1d80479f4942b23c123758d19a3b472022f1517790569253d08549a231c34e03493dd0789a751fa9776347eaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d5cd829b98286379e10916b75de717e

SHA1
94724cbc19b161bd205d68c91fd0c65a09580a37

SHA256
2a1374ff2b6fb164a10a9d346cb813c720f752b7ca5eae37745ea5cc07162f17

SHA512
be00af2ca4056d1978df8dc1860c21ea5541303924d528679318385dde5444cd79319638c64f7dc9357d53193db05b8112923ed6f108796a590f07ca5fd72d95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30331d8778ded68f3b779fa000e946c7

SHA1
8c26bada351932b4b37e3bc107bae873c2ff395a

SHA256
ac08ba9b43098eb3a01db8e810dded65dadd7800da357983476d133d353e4cbd

SHA512
0b6e68c24dfa8446de0e12b43c8ba32dd3afb676e019611768ca779a53762e3d263731546656a9f9c5c4b4205f93280fd0995ced8ca2ec8647f5067831d6cff4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f5106cc6ebb064e39b80567af5fdfb3

SHA1
a68c8d9ddf386ecf699a76a83d0f2163a265050e

SHA256
ba5cb97112142d2570919c2d9aa514493a97eb49a7fa98dabd4fc421f9924507

SHA512
1e6b15bce9463d0f9dc996ae2e0c28715b8d93854b2a06427658bb53c361fc8206cd235b4b4b13e2938572c12de1f308a237315389c9435e25944f3239295232

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
094c8ffcd5949236cce542a33307efc9

SHA1
98e0de3ba09fd15c8891569b31532249b1d5d2f7

SHA256
6b418237a3d06da3963875b65f14ed97bb6654cec0067896547577015d6811a1

SHA512
8c069adb83cb9cd08ae6b9198570bc1bd9308ef6ca50a89bc17ff3c90d5a6837476fc3a8677377281d007f1c9c3e8d6291369645269e8da9d9074fbb6ec6fc43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c08e0e0936b61599674158f885dad460

SHA1
16c9227bce24f301a4634ec9572ff96ce4137189

SHA256
c9b44accfb8600d085d1088b17ca45a38977e347c56e454251624ae44649d768

SHA512
28a9272f51c05a30d9aa42ac3034a0b3033f0e5ea93046927d8d53dc7b0592a73a5bea3dc9b684ab155336007c64b5c6da6396a5400b2fb14497167d68a8708a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d1c51f6ddb0865b0b5af49942640b48

SHA1
1bde341891bdf6172fb3e0fc62420f7a820c689e

SHA256
7e53fd3059d6e07df7c10321d78eb76846f6104da36780a3110443cf8b1fc9b3

SHA512
030aabb4ea4b02ffe0e6840ce43b5362808abbdca48ad5d53a5066d9412d24fd7ed80fa04a2699327a7d2b3c9d26c99b0117beffa3e2af8315f6de23859d4989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dd35282b6b20fc27d8025fe9c74f09a

SHA1
750835f237843b3197f007c79224b45c383c4a02

SHA256
b416e016ac15c38149bc6ece898300e5e8914b8878b976b561416cd81fab094e

SHA512
64966810fb110a0c757ad8f706716d6993b7bb855d279482a0055dbf915e2aeb1c0a79fafc62dfc02c9aeaf82aee9f2b6e683eec1e09251d1bc94fe63304aa90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a9f395a178e5e21516445745b8fb515

SHA1
5f69e2a5335c865383351508ffcc3bc6294c8818

SHA256
40921c87d9e02510bc600dd2fac73a0b2c1ddf855e69956dfb44f7599179c10c

SHA512
4985c52e86527dc38740e29201f43cd57cc9c14c7744451104712a0fafdf56cf9d8611d6f872ce76b83b22d85e553a3592b528884600612dfb0f08e9189ff3ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2859ad94bf08e76bc67c8f4c23d893ad

SHA1
e9e144993eb43a217d14a878428f49921128610c

SHA256
faa5de4194318dc5306bf0751a5ad2e419de02ae81b029d3954a00b36054ae36

SHA512
52d477a108d185fc9e0f43e7c52ce5f3af3e1593f1ef56565afb324f9340326c601822bfa7d01aa545b03269e3f11393a35b44053fbf2e31dbf5c33df4ef0165

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f878a3f83c1dba6b63734c9f2197c78

SHA1
b90a3a2a95fa5576be2e5c3840f70372e3d0dbaa

SHA256
e1ba194cd670e4676ae9fa4ce7f22e1b52c1a35f8a87f9999a99f913198409c2

SHA512
ce13dd91f81736cd8e4ed98ce8c03064c4e01fa05a113b35f24cc43ae52ed65d6e0767c1a9132e81c7966ca3384a4e55b204dd082fd4d8ae248cdf280c63de11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3eb0b7a5ebc14630f771dfbcf6324e9

SHA1
5cd204798babd86634745daf6549802613064d39

SHA256
5ae4c0b6785b82060d0cf21d95804b7877b3dc80a17d6afab4c6e1f29bf3d3dd

SHA512
9cfb9178ab2258b02e0696c58a2077f467347e84b06f554944b9239d4d36636d2b4f57d2decfde57608b75ba7fb654b124e95fca4787bf25d22d65106504a1d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c142c63e5fc52f9592665c1194cad446

SHA1
a9989c933d68824c84f499b23fc8c0fc8972a4d6

SHA256
c5cd5b7cd9a554cc6e2914878729f85b2f87000fcb9968b90baf8ccf9c1d8dac

SHA512
f67a1b2c32a19ccd92b2db6f1a26c47c07c5e467b0a4cb1c26871a177573a8f904366059f134baa79db628b8b6540c26414b1fc7a82c7588c947eca072391b47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b294cde6476d963808070eb9e8924bd

SHA1
a2fae87d8d24e181f8a5e75948ac08d02abdc613

SHA256
c10c8369cd483a003a30e5deaa838c18c884e3ff406e10015072d1e63d0a5dbd

SHA512
d4d327a7a937757e437df8c53d8eb82203ee44c170407325627efb703ea9c0f0a1065dd967329aa576a3174b8020f7f751f032a9f792e88446468823ce568f24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b281e8abdf6195b9ed86bad1dc741f30

SHA1
1dae760f3195fcfd056c6e47e4aa03072997be55

SHA256
518a71717dac914c3ad544e231639923424a97a63cdcbe39207e2acb2845b814

SHA512
1b4ea873dc3b0378ccfdeb3113c7379564498bb4453e68dbdfecb9e255eb8526eeb16beee1969beb2d6f07b69d291c5f4866c6cc07e3a136b209d650a227a149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fed0d44edfcc35363dbb6bbfed07123

SHA1
1cee1a8fae149f18fe0859fa74ebc581ff68c884

SHA256
279f2d2ec20c2c82f3b0dd7fd7c4c7f3cd6eef0f839f8f9b8fd45bb8dbd41fed

SHA512
16907f278420e3af244315ecb222a56833284df8685818eda32f4c5a863491e5ed1b108f67f50e9ef027a07ecf4c221a243300a761eb25fce10f682d756b539e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
181ecc26b5992642bf4e95f75ba64043

SHA1
42fb5afdb6855f806b3df7689368994a74c1c39d

SHA256
af82a2ded40d0a91ab340d916234925f2888f0512d3fdc309220bc611b410f39

SHA512
d3e97d3fc6f4ad512210164d35601a01b954d50ff45d2044cc3f3d60ee704c3c7fbbe2e2e5c78d60e1ac10edcf1b3ddef1db6bb8030c4644fcd6560c3beb7f08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a726d2e71aadbfd50c695a6881750892

SHA1
383020fede13f4e66d15a8d9036e31a8905b268a

SHA256
6251d16ad74ee1ed364486a7de9689594f428422aa47a113bb25cad3019a5a68

SHA512
a3cca726fffad285f3c08c40a664fd59c27bf9eda215238b5628606737a2fdba8c92647fabe0ed996455f6b88214bc3bf028147a694319754ee1eb2bbe0e154d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c2b3d4d48162cfa4cb5d68abd97ca3f

SHA1
93b568ff377e30138d4e933200b7a274abdb9d0d

SHA256
804a29e9ec0c790585006450d320db9d92d328dcd5e64b09efa327e842546e8c

SHA512
92d47ec63009fd1b1967be0272a2348080451ce29a4963065e76cc54f20fa181ddff80c174345d6382b0e204c7eae534a3f77db4c985b34fed6c7de48bfeab6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aab1ba04b9cee2b7b4ddd910552c6400

SHA1
b722796bd41176163869df19c6ae412381c01acb

SHA256
cc46bd73292a099aa9946ce06dd129d617639477900003bff4a7239b4a69a3ec

SHA512
741f58c64250512e40d9bbd9fcf6605554dc4c445823e2440b71dfad92e58e165d48c6ac61d9022eedfe9d5024237ce3f8ca38b5a503c518181e2d7b515e0726

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f3de9aff733b5fb8d5be1eb6bfeae38

SHA1
011563fd25ee8a1fd84d0ef79c447f438b25b14b

SHA256
22b2f906c3c0a66881efb2adcbf99d8c63a2a69de48b9b1e27f7185158cca7ba

SHA512
e5efb1a5f26c8acd1ff4a303f214559ef8de4790e7a22d77de3e39d5d70ebc52e628452063fbac343fe81b8ed3ea8df59fbd956d53cd8b6267aa8c3de582e04c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41c64fea247082459cb83d677b1e2e26

SHA1
66ad71e665c3eace04ee3083692270a16255798c

SHA256
ff29b541c4569159bbecf32c7883fcd32de6517a1f1e7d0dd9c1a39dc27cd269

SHA512
fea02ae4877a137e99778bd0eb9a1ad1bc821a24ac8f21a54ca3efde6baa47123003f95aec091257c74292aca60878e3fcf2ae229b695a98c42d20ad46695806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
503623dcfa78b04781cd25c75ff73dae

SHA1
7467e4a9c6e9d06eec4f47815b560be421e6e103

SHA256
bdfc8d72df18c357287e38812e15b1f91681678507ca745232b8040e2764ec1a

SHA512
6947b1d8608589cc76dc583147edfcd0f5ce762d09cb5cae04043b9c93bc77f006d9bd204ab3ca93889371c987dbd7bdc54c79230a3164b179207792c8245c0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ec1e07f5eec8cf96c8bae02e14def2c

SHA1
ef13415fc3937d5e63ca152b02fd20fed4e1bb6c

SHA256
c68faba5f6c61075c9ccd1a78c160a56269fb8cf1da90b7ce3e9a9d288735a7b

SHA512
26124ecf377ff632e2b694db61742e0fc779c509b5fc080ae42a7f088b4293f1ccef1c2ee407826451b1bd1c88c71e3b1ef0a24a3e5fb5f77bc634c33613ffa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b84bc37bc73c72b3bd479aeed566220

SHA1
274d4622751bcb5e54f7f55375c8d04110b545e3

SHA256
8ddd03f5178fcc8439a736c821c0c47ad6f5c32bc15c3796a31ff19ac420b7b5

SHA512
1209581f4ea2122054d1fcc10f8aefd6e5464b8cd3060c1a1adcde549fa82bd0bb4a3631b96ca606ee92c8a10c2d8ce48de9e4284358333c22c8e8baea632de6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac6b097539a6456b9f8b2763418fd4c0

SHA1
6978070db5b2836274f5807d55418bb286b0c4ca

SHA256
8948fc941f0a9d81fc92b0c3996a421085eb32d8456fa9b0354a0abfe5d2167b

SHA512
4cf38155c53623379504258e863b4dc29f7926b446b072b3fecc5a852829c5c7a0d1884fa3db7dfc8280932e49e9658fb32016748f28a2be0389ef877455497e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b5f43f1b3d46a1485b7d4fc8efab453

SHA1
41b1494ceea644ea9a92c9f73a2d12a19c428698

SHA256
1ebab641a22a928feb8d643b6d82c40b8814e04f4520946329018ee511ffb0ae

SHA512
6333cb090732531feb38ca16c6922e062f59a21c16cf4c4aac6bcaa1b8c3b3a375711b8ec256312edb909155d0a6a73d10efa0d9cf6105ed9636e0cc5196bcf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eccd28f9d7892334b7a42351c5157019

SHA1
a094e6128e94084c01e30825739a58ee6b1ea178

SHA256
0fbd51a8ee381d039fa3e037415870b804c027478b0efbb61e5333e05b333920

SHA512
91b99d7b8102a04d7b5a790b1c1303f4323502c62f47ea493e97a7c264e8a7b9a3ac9e1c11478755eaba91de044bc3d1dc25589e8c5cabc80495a0493252832c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b48737bc7fe2ea2b0ffae1f4ba24bab

SHA1
6fb9823d01f53e981d4abaab7be4e01ff1175b2f

SHA256
18181095b0f7017793cb1eacb3f3b9bb8ec60f3cf75e42eb62d10e58646a34e2

SHA512
0b5895056fcff4fbda17b885ebfd23941d49449966a6c6101835e5bcd95f49c4623b3eb4b28dbb7eccefe83cc3f3934638b2d1b850b9e9cfcb903ac30fd4e574

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a8a8a5bb551f19556c1a9968936dccc

SHA1
41a628d234fcf7fa4929ced61da206b86e518042

SHA256
b3872d43a04157812b0489ea8494b8b0ccddcec3900c5b10a850c399baef5a6f

SHA512
76ace4a416d770c158eef8cd403358e5422777be03ae3ed1ef0d888515c68299959f8531291d7af71cbaa043fd676255e837e6482439e85b56ae09e31373dc34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26157771b0240b5759307e858e6fd22e

SHA1
7e64b5031864b9d92c3bbaa369715c6a63376ae3

SHA256
b6bc2ecb5631080ac09589b08db519791bd0e134f8a0305dc98dcf8609772d64

SHA512
d196a6e105649ee7b287b2b0dd06e413bdf223f8b3c811a20e56460119135e3499e86f033170eb1aefc7850a52f1d783a32666e65c4e10114c98f1da385abaca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e21856d033044669078f8667e05e5ad

SHA1
d91e3d17d63540ba37a61b22788ea5f1c31f3ede

SHA256
22bfff57f432fe8c9367cd5b3f08d62d6db019f195f9b7351f12f18fffce5eea

SHA512
e767cb1650f16dc4e8efad1dc410882db908dcf7cce91105adc5252db0dbb26aad978a2f3b8d9626dd43820f62c844b65a77b041db7eca183f67b5116505e06c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ecb3ba28a4e23e41aaecdc80184ad61

SHA1
eb9dbe91655284ec39bd313c8f119d6f2fe7a1f8

SHA256
e97d3918fbb9acb9be725cc67279bfa63115b3c5c74c63cea0a3c8f3be09e618

SHA512
897ab3cac9ee30219d3717ce4b95100890b3e6eba31c1d4eb8a972f7f0185ed2ab6af59d6994b80b87c79c3e0da47d32eba58fb43fc26963fa56e9828b47230b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f25f5f9110f909e7d6b0a1943c78e388

SHA1
a824ce67e8b2af254253ea16bbc015bbf6d1c24e

SHA256
1923c9cd68367b2e7ab0db925d2bbdb66c793a986928dbf18d10844341b0d4fb

SHA512
f7f4493ce15388c627db31488547a86a928f4ad295af1c114be8d3f31536c67e3c4a94bc467acd50a275f1d8ba4dce719e34634bb21bdc61569ce758530e9573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
337f70c5c6912791d77bcf7deab3e178

SHA1
82266b3a2a27f18562584e9a983db32f32366fb5

SHA256
aab96a920c92763e5ae5462641b7aa38ebae3108b207f2fa3f72bf6ebe0b0bfb

SHA512
82a4b3204db82b699d5de6434c8fbe96cb858b0a8e43be91ebd55c2a796ca43b661c4cf39f6d0b94fda5c473ba75ce478e62c58cae0eb10f357ac6e099f48e13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c53587cbec17ff69189093a73b33677f

SHA1
93f6d44875195718c089b686c4ed5f36d06bf58b

SHA256
ba0f56ef78914eed94dacb2ced9112c9c089aa70b6865ddebeb8eefbf28bcbbc

SHA512
e49ff9e9c3dcbda1ecc7608e619849f4e553e935213cd4fdd241146e3fca1de4455b608f5866439aaf8cf9ba98b8c9fd06b2d3fb311869816379b8d4e650b63b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efa965eccbec8260a48142bd00535807

SHA1
971082ebcfa0fa6b0b7e5e5943eb2a37991045fd

SHA256
b6a5b606f768374321c6786900b5cd127180f16c6512482458117567000421b7

SHA512
4b320ec767130d8d5ab23102abb49ac6044b41a3a55ea2a1d31e11a3121c4fd512ae6e6be4479834ada07f5bbf9c73829e3b31b8d1547e6e1a75b623a2210c52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71c649bee06f8c17b1068b4419ad4b25

SHA1
f846d343b14fad1dc6a293a29b4b20e44bb7cd59

SHA256
f72a72a1cb1797cd20ad34eb8aa8c86d979661f8dd3d452c692c350f3f5b6b4c

SHA512
4e67e3cb6b782fed066450097eee417b676b1edd15fe06a0ab5e6aac4f5716db9a5053254f63bade03bda5429725e53799296e413ec929398e92a563b022edf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0180f21d220147b78d4dfe25bcfa6916

SHA1
6b7b89b33f557149877627d54129542f7a44feb3

SHA256
dd62164b8450072419c284b9f23fcebf8032d11aea3d985a54f892044ce1338a

SHA512
032dc7baf82f4cde7839ad4f5e526b4d663fefb8f4613b348fa2af298b24aa16b8a2c55613b96c2f63e259b0ee0ff9e2b17eddcc551a597275f7562cb745959c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
8b6a7aa78b44d01c5f19dc06737b241e

SHA1
a5b032395e8e15da12df39cf80f50b9b56373787

SHA256
bf7a24d7b40eaf5bfef40bdd9e511e46045105c5b5a406765b537d378d0e2746

SHA512
7d2e6aaa36d5f3e349ed8db657326477316f6da335795c6967fda6485201cb6cec9806695eea89bca158a51d54391202df479a5398afc412208f5016dcf4b2fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\recaptcha__en[1].js

Filesize
502KB

MD5
37c6af40dd48a63fcc1be84eaaf44f05

SHA1
1d708ace806d9e78a21f2a5f89424372e249f718

SHA256
daf20b4dbc2ee9cc700e99c7be570105ecaf649d9c044adb62a2098cf4662d24

SHA512
a159bf35fc7f6efdbe911b2f24019dca5907db8cf9ba516bf18e3a228009055bcd9b26a3486823d56eacc391a3e0cc4ae917607bd95a3ad2f02676430de03e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1612.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1625.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
92KB

MD5
13c2cada2e07220d6120604704de05f1

SHA1
45c07da8eb30e41e82cf02f6f0aa042a4531cc17

SHA256
6536f3a456583bb9d2c03aaf3bf8233a17a475c12c23b8126562426838c58f2e

SHA512
8440a424706fbee9088fffce1becdaa0451f71e9be89b8fd5cffed84bcfbe42aef03aa869ffd60165f5f45db18c8d7f6893c7e33ca1ffb6ba41e27f7e2bdb432

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
893KB

MD5
4f77194e08741607d8478ec825f0b94e

SHA1
17c1e0650dcebaac2fb0f5f93b6df74dc307e333

SHA256
81dcd2349e7d2afe3baffb8021a16b23edce1dda0caff9750052b0d7ce58135e

SHA512
6dccf8677081058ea6bb7380f70a920b2f38ce2a966f032d6370ddde26f793ba1f060c6edad2ab994e67ffad2397ceba9c0821b9b210b3986f4cb975eaf31145

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
98KB

MD5
c3ec3c1b00ab2fe9962bb20fb42af228

SHA1
0066a475b3a26cd2eab2e6c7870177a71c10649f

SHA256
e5c44b6737fd5ebff0e12dd6c81d2268252ad03cdce056d43c23d4694ef31033

SHA512
ed756845f7f78c8bf6e9a0dba4e14966e1b5f5c7b6f7fc19feed3d0ecb31cf2c58008d628ff560a3d61f099244bb21449ba65dc6f51c8076df73840b3b6f2590

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
1024KB

MD5
efd2bca50f0c3ae37bce6fd075395a3a

SHA1
94746d3fed1e29817b2cd659a6906e6cd4cec73e

SHA256
8fc7e0daac027d256ab9d4f636a7ac9c2de5be3933fd497ecb3910cf97917af2

SHA512
8ca7a827d3f4c7660188802492fcb5412ec2777caa89ce57adf557eb62e2368a0de194298d964a0a4f5953a226ad833f4a7515e5fb59ff49d203d19152ce4dbd

Download Submit
memory/2468-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3052-69-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3052-72-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3052-593-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3052-76-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3052-621-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3052-73-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3052-190-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3052-136-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3052-2545-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3052-2546-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3052-2559-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download