e8ef7886c7c5ad1b6023e420e50707795386f44320d644712183d286e55e38d2

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fd0fff8835c67f627c0e0e3b2a55f12.exe
Size

262KB
MD5

0fd0fff8835c67f627c0e0e3b2a55f12
SHA1

db6a26f67ef5278980c4f5452f79de5d7c0f62fc
SHA256

e8ef7886c7c5ad1b6023e420e50707795386f44320d644712183d286e55e38d2
SHA512

7fa0bd92579036a1b18dc6c32d3f192d4caf2b10ef8b182fc513e6b7c23c9d5d70643259102468a4136e2da59b9bb540aa503e1d05c205043e0edb1f33c50b7f
SSDEEP

3072:BDrF9h20NUmzQze45ggO8/tmiG+lDe7eWQbFo90mcrWt7HrOgwcoutZ:B19RNUmzQzjgH8/tmiGqcoS

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbmenu.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kerio-pf-213-en-win.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpf.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nd98spst.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pview95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rrguard.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UCCLSID.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfiadmin.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deputy.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\normist.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav8win32eng.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alerter.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanv95.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpf.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spf.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wfindv32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmiav.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\advxdwin.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FirewallSettings.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mgui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minilog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pfwadmin.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav7.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smc.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tgbob.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccevtmgr.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuard.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgemc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpcc.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bipcp.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsupp.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srwatch.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcmserv.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan40.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swreg.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GRAPH.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkpop.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwin9x.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnotify.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwatson.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hwpe.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\periscope.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardhlp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aupdate.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ecls.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netinfo.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portdetective.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-nt.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xscan.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SbieCtrl.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfind.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autodown.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwinnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fameh32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ndd32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\undoboot.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zatutor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ACCICONS.EXE	winlogon.exe

Executes dropped EXE 2 IoCs

pid	Process
2900	winlogon.exe
2724	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
3036	0fd0fff8835c67f627c0e0e3b2a55f12.exe
3036	0fd0fff8835c67f627c0e0e3b2a55f12.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3036-0-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral1/memory/3036-13-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral1/memory/2900-17-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral1/files/0x000d00000001232d-12.dat	upx
behavioral1/memory/2724-19-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-23-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-22-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-24-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-31-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2900-33-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral1/memory/2724-80-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-79-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-402-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-1632-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-1752-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-2287-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-2501-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-2841-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-2941-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-2948-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-2967-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-2972-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\D4953584B4C41434 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\D4953584B4C41434 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2900 set thread context of 2724	2900	winlogon.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://4393b64wg4876hq.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://rd3m329uw1z6txi.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://puucgx1z1pf1av2.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1789"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://18esz4k6ukx2968.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://oj149ar2n0z5u9l.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "121"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1789"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://babxsv2a6kt44z5.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "11989"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "282"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1499"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5DAB0631-A841-11EE-8D93-6A53A263E8F2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "282"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000c4e3a4e3cda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "197"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1499"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1499"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1789"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://i0m7j9ovyifvi85.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000018fe64ec31afbcd1fc3b3ef6fe89a84fea78de4d5528875e7292e8452885c23f000000000e8000000002000020000000bda628097786aa465f28d720b83de9c00567409a5a46ea6b63b58fe90de8ef8490000000d2d3ca4d6738a1b91a3ffca11e6322bfdeed24f587bac50955ae68277aef6ca9c1388961bfbe2ad53dfbbcce55791f54e48e53942b11127b283283ed54338320b8eec3c4d8ee33c9666f23533058a92583c3f1ade6da9f6ed7a0ea24511494e0d187f4cf271744bfcc04b527aeba2d23c76a39fde0ca4960ebcf5421483d77b8fa06f7a92c888e6db09f9db77eae662a4000000035260e03fe4ca17f65b36dd61ccc8949cf93d14223ba49a94d22fc3022c074aa5aa8187ee6daa9523f06ac8aa32b86b83ddb87677a2f6299dc6ad45d0199ebd3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "11989"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "11989"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "282"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "197"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://6m6olrk3c970wz9.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://4cg98d0ee8p123s.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe
2724	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	2724	winlogon.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2620	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3036	0fd0fff8835c67f627c0e0e3b2a55f12.exe
2900	winlogon.exe
2724	winlogon.exe
2620	iexplore.exe
2620	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2900	3036	0fd0fff8835c67f627c0e0e3b2a55f12.exe	28
PID 3036 wrote to memory of 2900	3036	0fd0fff8835c67f627c0e0e3b2a55f12.exe	28
PID 3036 wrote to memory of 2900	3036	0fd0fff8835c67f627c0e0e3b2a55f12.exe	28
PID 3036 wrote to memory of 2900	3036	0fd0fff8835c67f627c0e0e3b2a55f12.exe	28
PID 2900 wrote to memory of 2724	2900	winlogon.exe	30
PID 2900 wrote to memory of 2724	2900	winlogon.exe	30
PID 2900 wrote to memory of 2724	2900	winlogon.exe	30
PID 2900 wrote to memory of 2724	2900	winlogon.exe	30
PID 2900 wrote to memory of 2724	2900	winlogon.exe	30
PID 2900 wrote to memory of 2724	2900	winlogon.exe	30
PID 2900 wrote to memory of 2724	2900	winlogon.exe	30
PID 2900 wrote to memory of 2724	2900	winlogon.exe	30
PID 2900 wrote to memory of 2724	2900	winlogon.exe	30
PID 2620 wrote to memory of 3064	2620	iexplore.exe	32
PID 2620 wrote to memory of 3064	2620	iexplore.exe	32
PID 2620 wrote to memory of 3064	2620	iexplore.exe	32
PID 2620 wrote to memory of 3064	2620	iexplore.exe	32

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\0fd0fff8835c67f627c0e0e3b2a55f12.exe
"C:\Users\Admin\AppData\Local\Temp\0fd0fff8835c67f627c0e0e3b2a55f12.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\E696D64614\winlogon.exe
  "C:\Users\Admin\E696D64614\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Modifies firewall policy service
    - Modifies security service
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Sets file execution options in registry
    - Executes dropped EXE
    - Windows security modification
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:2724

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2620 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00169e4fd0011b92b5cbe385db026ae3

SHA1
d6637d308dc78af610413d3b6a770a11d3a4e781

SHA256
f1055c118785e2d1b403c9e8d967c7197ea0394279ae475dc22ded754d06c6cb

SHA512
164eaee8e3071b13e4b7da03e5a602882f0fbfc5a1905490ef5d549df8120133036dd3a5ee4f924d1d0a3bc8575dffa661cbf468052073dc6ce249305be1de38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3ea7d02029433b5822b65369218bb0b

SHA1
bc1b0edd6805899968dab2571a448132769c55cf

SHA256
886b26b8ec5140fb4032a02080a01ca7b5fa626260187af04b94dfc58f67b996

SHA512
712ab28c870c379a7c5d182b20779fdc5f23c145044489c1892acfa679edfdd79cbc2022f2eb18df6ca869ece86773b668d34a61d179819d2ea7d24ff859b31b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
576210f0b8462f63e8804d0ce8bebadb

SHA1
de10c45bed0be4cd27445ee7aafab9aa5f8cf85c

SHA256
49d90b88d27e6fe044edc914762241e1cb993d8284f82acdc7bb4cbbeaeda1bd

SHA512
1b0c65f8f5c90b848ea72a69304f6a9e15f11b2e4f47dda6bef9095f42f14471dbb603fda93cc278390b949b87b291a16d21387e4d9c6eca5a05be52655878de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f63c8c75ec9cc9f14143902f73a491ee

SHA1
6e1a7f64735e80079ebba3a64022cc974c595053

SHA256
f543bb540c2822a2ef89a2e06e8965470286b9e1b714b3311eec754f630db851

SHA512
4a1ab7460fe7f7924487e11d6b9c4ef88810377ee22cba37bad3f5a47cc7b1bcf2636683341a65f049b3180be1490b2904dd9483fe7fcb768525840a2bb22610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a782fa8d2c34e0754f4d992109a23bd

SHA1
33a0827fa2c9449f511281fb206b6443954e48ed

SHA256
b1e99d3a6f0f648666077e0e1a664fd26730c7c7a09ce4af52dc620fb6bf695e

SHA512
28ee624204df52b6f6172455df66fde4f254d0436df58854dbe9507037a4be1a628ad7be5e40e100971903ce68f009c2cb5d48d934cf98c5c151169be2681fc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d8e6bca9b4b8b651b488cba6ee502b8

SHA1
5b7bd8cf55a67f912f016de8535070045aefa5fa

SHA256
7111893c695338f26bce4b2b8cf40654b65449b268fdc8b958da49176509b7d5

SHA512
d9004e71607440070be96dd8ef6c68f6ba40e60426bcd2e037bd993be26feb8dd1f23c18ca7e04754ed8ae7444f02bba004db0dc93c51d674e8579517e0110f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee4f0905a398a4bd53eb0a9021a7e7a3

SHA1
4455d8e0f697e6cecca70d6fb690c2c0990d157e

SHA256
f17e1230545389aa0ef3fcf8499e387acdd8a5321deb8f4d40a751b7cd8cbe72

SHA512
2a76b029421dd4598b797a9f4da4ad8907cae6a0e26e35303a4748d5b58424994f026c809bca71533fc912b500bccb8382594a933457444e0d1f4702dc92b607

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8b4d82171cce57b6ec4273644ce53fb

SHA1
4f9c9269d6655f20d52cfc366652d3096b5eaa22

SHA256
20733f24975c3bf5fd0faa3183ac5b8e62816eb95a1399e94bae1df6e76ec91f

SHA512
eb070b28a24e9bb16c0369be6ef839c69eb134d1fe262d14f1434dd88af0e0eca61cb9d37f676b5115fc4a8d87c4e566713e7b703153ed2014044f90b34e6ed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e43da829bf81ff2726c92d2557fbbfeb

SHA1
761da14cf79524c1998548ee12a239c8f9b8b51e

SHA256
6db79222c414bbd05ed80d01f523f0d426ba4694b65f532644a2bc65836b42d4

SHA512
c693fbdc47ec01d7ab699a946ef79d8b0a90560c30af764490100eceb0a659d9129da88e017be87e689d1da0292a7c7586e138fc2c9465a7adf2f20f5b17612a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab84a299679a7a8511334f7d5d5b8ec1

SHA1
51951ae364086af567ff9e7b58778df6b7e4681d

SHA256
e9e0406d881cac0635c52d8412fe39908699e5062605d9dc5809d7d1eae7250f

SHA512
3c069dc3b319ee7d2c9654078d55d4f0d0b43c679caabc8118c3213205afe7e6a1f0286de2747c4df808271c0b9198d56754bd92a60c9c3e407ec180005149c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fdf8d523a777876307577e36a997fc7

SHA1
4991f079aee6008536b99ab51b73c2b46ebbc40a

SHA256
00fa1e1d2dbe5a9e839d2cf6feb272fd2fd47755306d31088424ea4e37df5174

SHA512
730bf2029c85000359b3d5033c8a511f9fd9095dea01b9dc6dd5e14b2c83e461157d11a09aaadd6e0ad37178a0118e3498e0f4e3e7df9bb2269d46cfa10e0b27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0526c68e1172494f7cd88620f21ca65

SHA1
9bdffc2fb4c6c65f25364d61f6035812aee17e0e

SHA256
98d109711132f53ffe2cc3722e64ab5a66eb6d908abe3f32f12f09ac3ef54f3a

SHA512
d61038edb0e174de2e4dad71183b94882d5c56299c516abbc6043eb67867a68dce7ee6b0b6b84e1e79a7e173babd449a0eb15d64ad7915e031813f35512135ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04499375d47f06dea1e0e15a1edd5c00

SHA1
259bea4b120bd07e88f7f9a40a5d044a278967ae

SHA256
c269cedd7e5895ff2611daca317fa843dcaaea80d1c6cb50885f3fc16c2e224f

SHA512
347dba7e89f0b96b02784c88ad2203fd4f837d3771b826e87b0adb095ee2c48117fb08269a36a7f6bc24f0720fb36c36d38376cc6f2bcf85cc106c312ab73226

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3415411b29ae479d1c08fca3f039b418

SHA1
98ceb2b922a92be9054cf46e7ba172f763c55ffe

SHA256
fb766a58dbe96223f25383bff39bfef00795d65bf3ecc8eb35482495cbdd9a95

SHA512
0d4fd5157d611457e12d2a9f86506a21cad34b7a70ec91713ae45d2bd1b3cd30a29f2cfb139f30b130a614c737bc570f5efdf3a3b53f2d173ebdde65532956e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02bffb3c12f30c71f02acd23bb9d0bf0

SHA1
dd9fe018816f608171b053937d9ec1bc662d62d2

SHA256
611ac7413e26a9a5affdd1dac4f2723598b4e597d657a1adaba8cb23b109e078

SHA512
8c6b03d86f56cda60bc45e92f93e452999e1c8ffea5656dc2af0d587921f36a36d70ab59113d6c2d3661ecfc40928a18e2191eadb0d8c5ad15979763de57dbf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e97cc81e8797593a1191b87ead1ad44f

SHA1
01335c838a01cb88973df07cd070a673b157ea7a

SHA256
f6fa69b38ee019be1b685d13e9b5b4d3bc326d4dc284c9062a40c3e51533ffc2

SHA512
88609c2f81b852e7dff58150f43684726004de443101b9d0578854df11066a2511163df570e30adb52ba32dc7cb81c6ff5fbbab614eb696d4c3ab138e3c7618a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3506c6fad9aa8897d0105971227493b6

SHA1
f8554fa87e919ffdcefd7c3d3308c2571cf98763

SHA256
835330ef6062cdb2b6ce1944bdbc42b82285e6e376c7806fa789c788d30d5bf2

SHA512
40c14041eb470531f11e096c1dbb937f02281a76b4fdbcf564be757b56a7581c3003589c3c5f1ff332e6ede8c77627360bc3ec0a61f0d309ac2eaed5a000b0e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
263024a71b891428a3f6159fb12165ba

SHA1
45d70cb2b0ba2adb9e790c800b83bbefc77a0193

SHA256
41ed125bf224c9205b4c5e692d6c71fbdc29b46eeaf97d0806bdd58f70d966d8

SHA512
3ca0a2c6ef3d5356a7fc5596b1d7257c52891628972f13385909c557169506d256f67b6b579a9119e0240651624434518237d90eefa94f7e66c22bcfcae66533

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31f89392229fd3cbcd5ca8fae33e80fb

SHA1
a2f9f3c446cefa9e3822d943903a7d90161a6484

SHA256
3377d32cb37fa0ee06d7998978b57194e39db7a64fb7ea28116f5db7b9d38d9b

SHA512
4e3027835d32c1c9bf534415279bb0165a3c1c9c4583959c8a21a6a5902bceb71391c769d1c522a252d4f2fa7cecd9de5a0764ed6d32c5d90f3a7c7075126e64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72435a889bb1cb211975851c9814643c

SHA1
dfed54f9871cfbf4d4abc924b211363bdaf42937

SHA256
9aca8fe29fff0ccce123c23a96b8e6852f32ce6c592e02f8b479a13917cbd180

SHA512
19a570c9f4af95210d8689e1ff2ff951ecb61f861bcad4cc5c1a654d999ec5f3df5442494aac7188d71c21a5f979b311917f6f755341346343c640cf833a92c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77a2f3cceba6fbe6a98949bbbc7060fb

SHA1
c226022a7184f9473fd6bf4ba6f4379eb4afb792

SHA256
acd6ebdea57a4e22147f3f033b03706396053b781dac8c97fe058f31951782c8

SHA512
437d3f287cbd68c756b085d6cc2370b0443a5c6829b144dadd2850d3e958e647931b4da239228b3ca1fa9da885b05cbe09a297fd474263e8858d7aee59795d81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0932b68ad200468e3d6218ee7d337041

SHA1
7d00dac69977e9cfbcead82e612a30f25599ecba

SHA256
12074f8abb3144f3213d5856bbe0f069835fdf4dfd6f64394e04c4cd9a3a8fd0

SHA512
599b73da9d5e75fc65f5ebc75ff357e4a6145cb57e51875deaad53a6f4ec2fda54c81d6f0cdea428a099cba4c8e8ce2c221da5112947bf3ad0f4ec3a33908988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a95dcca3734344c0f13abddaf120f5b0

SHA1
e1369a399873edad02806f6223c72b5770c94e1c

SHA256
baef65725c301161533e7838e4f8bca9b252bad465fb95cc3d3396c3da2ce002

SHA512
ae24ec45f408c026bbc6c8be3347c049640649682e0d75b544fad4106070c99fb5a5850abf6218e34347f3eb5fbc5d49d568418804c36fbb74cc53f17e7dad16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cdb9940fd9a9a9fc6f59a9184307fb2

SHA1
8d56ca5ba373856fb192b0868d55f4112755d66d

SHA256
d10ae0bd2785c3a4e875b0fc810a221c7b0d4df2c201ad3b8ce74b29ec072fc2

SHA512
5afb97f2a4a4b50b3793d6bf2075fceda4eeb0e36b937194c8efad90bfd497cd8818748b38b20a4ce21bfa1c9e78df8985f8e8c5cd955750a90772b0ddb81e96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41e8b5c22a01c0ef1b7eca02fd8d0d6b

SHA1
5a884ca471e6b2e49149b5c53e358e0bc9c71374

SHA256
8def151088263fb60eb34758435b97b9c0fb17c47c1f085e963891a60efc7a6f

SHA512
8ace6880c934f8684c4460ae561784abc028ca6f1c8eb7a8dee97d6c72bf7942e2699dbed7873030a02fe0b17e4d1117ae85711534150b334bf731c915827cb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33

Filesize
406B

MD5
8b3c43545c3f1d3238d6ed13e3a08584

SHA1
a006485e50e42882a7e0ab33785c1cee4addb9ea

SHA256
a864eb70587151bcf61fb446b649986661cba7ddd2aab90992de89b7fa622bd0

SHA512
9b15ef1b35408fd75367f40da02d334b469e752e937c37de24734dbceb034ce341450dbee1a5c2d6b00743cd4f8379af5aac3d08061b023d2acb39bce500063e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\K04OMUYS\www.youtube[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\K04OMUYS\www.youtube[1].xml

Filesize
18KB

MD5
9ed4f81919942806f0a0dd63d2ddc392

SHA1
1b1f935ebf26a5598ec517f05d50ef23dd6e93c2

SHA256
d1438269ea87cacc38ea51d805336d61fe05185def98353da6c662a4270c6a5d

SHA512
7f1e75b1ff0071399614f4abe8c143fa8bb77f4abd84236aa6f3067574e34443aaab222a21a1fe78b3807f2304de312841a419e84a7165079eb6182c24efa7d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\K04OMUYS\www.youtube[1].xml

Filesize
578B

MD5
cb022eef97ce11df6eae44b7b06fcbef

SHA1
a7daa477f0fafec9a313d9763eb162aa79125df3

SHA256
de01b4b4e1cd279b0931cb37680a87eaf98be124c7ede5ea9ceb0d8b5810f064

SHA512
731a1783776d121ca713be61aa498e318777ff20d1bc06456ec789c7c1fb8432ea7c01175d09b32466e65a16138f8eb95252192c2c2cfe01f5357f9667787f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\K04OMUYS\www.youtube[1].xml

Filesize
578B

MD5
ffb86afb5a69b48d46ac07f14ac11dce

SHA1
12aaa02d115bc9130808bc1cdec08118f5b006b4

SHA256
10fa6f76104311aa350de63c47e02cc5a8b39dbdf7de75fbaf9320b8e8c0b24a

SHA512
4297d49affc5ca4f5a9a992eb7c5f74bcc1397fe684540fa0af5906cbeae53b626f261d71c38ee260f369f1eb1d357f9f17b4650662c22303d48fc3f154af1a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\K04OMUYS\www.youtube[1].xml

Filesize
578B

MD5
531d2b9841d3f63d4a72bd7b151ed0d6

SHA1
c92ecce0de8a98dd842d6208fff29780caf3c9ca

SHA256
99a77319655b1cb2c4d478537f9ac47d6906c8ec01f29b24f54f4daf426643d5

SHA512
e11cdc5152edb3828743599d269e0be705fb492b8636413cb30100e3fc8848be46d51969a80423cf7c17ceaa3792448f9310060594cb3b2223d67c2592298987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\K04OMUYS\www.youtube[1].xml

Filesize
578B

MD5
916e3232edc5743cd196f1fd19a145f2

SHA1
6104b9a9cad3d1cc9e723ac2d8c339f2e5089fc5

SHA256
b7b958a15adbb1d71338278336137bbfb1cf7daf86dc555d010e8a428aa3a3f1

SHA512
e038509a9c71efae2fa55172136e4030593657f51acf0d0d05e40f0077cc586c37089a9cb277b1ded7f02e738961756a9d8ab9cfa1a9d416f58ce9ff23e89413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\K04OMUYS\www.youtube[1].xml

Filesize
2KB

MD5
d1201c45b4bb153bc0b09ad69ae9a36c

SHA1
e4f9e8006f58275f32b72362307a8e9adf2c04a6

SHA256
b9ed6bb905d5950ef5e6da1d8b884cd1e22ae7ff3c17f36879fe6f96dfaa2a64

SHA512
6f694642d386f7259d862172b299d6a724c947cb438b7e7c6fad2bb8df0e8f25380c851dbf5cf34047cbd27f1b2f86761a4f08cd66c0ef8936686349e9837e9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\K04OMUYS\www.youtube[1].xml

Filesize
578B

MD5
cfdc7117986cd84b6aec3c83bb118d8f

SHA1
b9bbe5553c50203c67a3d21fbf9240692505d790

SHA256
698d6b24163ecdd0978a7404a1ecf937d2dbde5a948a5aa363a0603f709e613b

SHA512
c0ffb5ab60940b3cfc62d571b71dc03e41d6762a7bf14fdb5f035c1f1c8d07640c971fae82e2abfb5b215a6cccad27ddda3a504eca24d0c27af750ba01426fa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\K04OMUYS\www.youtube[1].xml

Filesize
2KB

MD5
cccba1668f3facc3bac38329a548073f

SHA1
cae956a2aa9bafb942893fc53aad26f25fc846d0

SHA256
18051276358e414b44a958b037f564b5cd57a9eb8bbb1ad459181349329d34de

SHA512
d907c36c2b76e11c9e46239c2cfec182ba990646aa9743324bf2c0077a93969f45c0e94de838a978439b78f42fff9995d5dfa88a1e93ab6dd5df6c271bbf1928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FIEDGG3E\cf.errors[1].css

Filesize
23KB

MD5
a1cedc21f16b5a97114857154fab35e9

SHA1
95e9890a15a4f7f94f7f19d2c297e4b07503c526

SHA256
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b

SHA512
00e857331dce66901120b042a254e5af5135364f718da56110a4744f3e64f9b61ba0b877013af8398a0f865c7bde6ad2f87b3c9d2d828651806409cba57aa34e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8CE5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8CE8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
262KB

MD5
0fd0fff8835c67f627c0e0e3b2a55f12

SHA1
db6a26f67ef5278980c4f5452f79de5d7c0f62fc

SHA256
e8ef7886c7c5ad1b6023e420e50707795386f44320d644712183d286e55e38d2

SHA512
7fa0bd92579036a1b18dc6c32d3f192d4caf2b10ef8b182fc513e6b7c23c9d5d70643259102468a4136e2da59b9bb540aa503e1d05c205043e0edb1f33c50b7f

Download Submit
memory/2724-31-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-2501-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-19-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-23-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-22-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-24-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-402-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-2972-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-1752-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-80-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-1632-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-2287-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-79-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-2967-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-2948-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-2941-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-2841-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2900-17-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2900-33-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3036-13-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3036-15-0x0000000003AA0000-0x0000000003AE8000-memory.dmp

Filesize
288KB

Download
memory/3036-0-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download