0f88a503022e629204e8199848f5571918f7b8d723023ba8afb57b8dceba7538

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9d10d9227f165d4745f1571e6e4d2ea2.exe
Size

63KB
MD5

9d10d9227f165d4745f1571e6e4d2ea2
SHA1

769f5ef77705c13d247ebff035ac5eab3b0aa10d
SHA256

0f88a503022e629204e8199848f5571918f7b8d723023ba8afb57b8dceba7538
SHA512

1db602c88411388407b791e2afa41fb9e63085c512e3652eaeefa383a4becc5db4516f57c50d68001dfd806fea608c099bda2023615919993eadd08c99bb5b1e
SSDEEP

1536:JiZpcklOpn+wruJ3cW8/QxJEN2uSzrCsxQYi7nouy8n:sZmt+wrqv8/EJzRxQYijoutn

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-72612839"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-29790085"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-37658857"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-3712570"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tc.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Netscape.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UI0Detect.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DW20.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ecls.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\evpn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcc2k_76_1436.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pfwadmin.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ogrc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rapapp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tca.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORE.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\amon.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\efpeadm.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msblast.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntrtscan.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IE4UINIT.EXE	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkwcl9.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ostronet.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\popscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swnetsup.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taumon.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwin9x.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwsc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ndd32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ndd32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scvhosl.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prckiller.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfgwiz.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamapp.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjsetup.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapro.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkwctl9.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccsetmgr.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netcfg.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rapapp.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HJTInstall.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Restart.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwinnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\efpeadm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\neomonitor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npf40_tw_98_nt_me_2k.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmnhdlr.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsscan40.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav8.0.0.357es.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prckiller.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pptbc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srwatch.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmiav.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bs120.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fp-win_trial.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmb32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monitor.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pf2.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ave32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav8win32eng.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapro.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvlaunch.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcciomon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	winlogon.exe

Executes dropped EXE 2 IoCs

pid	Process
1740	winlogon.exe
1716	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
2632	9d10d9227f165d4745f1571e6e4d2ea2.exe
2632	9d10d9227f165d4745f1571e6e4d2ea2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1716-20-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1716-23-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1716-24-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1716-35-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1716-45-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1716-54-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1716-1053-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1716-1733-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1716-2749-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1716-2813-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1716-2821-0x0000000000400000-0x000000000042A000-memory.dmp	upx

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\D45595D465C49414 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\D45595D465C49414 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1740 set thread context of 1716	1740	winlogon.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://5rg9k36z83h478i.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE66DEE1-AA45-11EE-B930-EAAD54D9E991} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "282"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "225"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1599"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://9s9wz81ekvx572c.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000005566585f0b114497a0be484e42d937687fbd0ffcc4d7c7ccf8a92b9fd879430000000000e80000000020000200000009931b1ceb8524a9075da316d0827d6e2f1a59403188369b17ae0718331f6a227900000009b6f176b2d8e8bf3573490b75e86f744311c22e085bf3b2e9b22e296e9258416fd92e93b6c4d45ad9ba2afc6ce40eca6191fdb5c9013b276d2d10075eb03e45c1e133809fd567581ffa54b0b06aff7eeed91fd8ef185c2f2d179861c2f233cedb3e39d0f3acf053722f1df783e3f725079457078e0ec73b28f4e93b1fbd413e999525dfb6251bc9296a92ceeb11127284000000006e3e0424791d832f90662e3db26fe46bf19b83478673ea7e1f37faabea696d065ffaa84d367445edd60e9eb9ed16df6fdce1df7496100acec0948d9aace613e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "307"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "1426"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://bg08w94xv57956c.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://8j0c64w1dq0e7w6.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "197"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://hbzc74fuk2143e1.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://8e427c23e2d0gec.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000e98abf6ba7df80e695110081c09f81f0afdcbc039887cb71c1075c6eb92ffc9e000000000e800000000200002000000096834938da01a1e3a29a49bc48e16ac637a1bdb507290456796fe4275ca2a7c42000000093a338c169920ad0df27031598b2e602ed0f62607b391c20edc5723f663ff04240000000aefa45cbb7a57365e0355e84990ff2723b9878bc988b2bc736dda74aa9f0cfce405d38d24a12fed1c32f70c4ca3d11c346dabab8805c01839799a03d6bb17ddf	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807519ed523eda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "146"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "197"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1574"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "1425"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1451"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "222"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://t7370y154719716.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1450"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410454686"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://mn3f603u4posxa7.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://9m42e1p26q8su91.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe
1716	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	1716	winlogon.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2632	9d10d9227f165d4745f1571e6e4d2ea2.exe
1740	winlogon.exe
1716	winlogon.exe
2932	iexplore.exe
2932	iexplore.exe
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1740	2632	9d10d9227f165d4745f1571e6e4d2ea2.exe	28
PID 2632 wrote to memory of 1740	2632	9d10d9227f165d4745f1571e6e4d2ea2.exe	28
PID 2632 wrote to memory of 1740	2632	9d10d9227f165d4745f1571e6e4d2ea2.exe	28
PID 2632 wrote to memory of 1740	2632	9d10d9227f165d4745f1571e6e4d2ea2.exe	28
PID 1740 wrote to memory of 1716	1740	winlogon.exe	30
PID 1740 wrote to memory of 1716	1740	winlogon.exe	30
PID 1740 wrote to memory of 1716	1740	winlogon.exe	30
PID 1740 wrote to memory of 1716	1740	winlogon.exe	30
PID 1740 wrote to memory of 1716	1740	winlogon.exe	30
PID 1740 wrote to memory of 1716	1740	winlogon.exe	30
PID 1740 wrote to memory of 1716	1740	winlogon.exe	30
PID 1740 wrote to memory of 1716	1740	winlogon.exe	30
PID 1740 wrote to memory of 1716	1740	winlogon.exe	30
PID 2932 wrote to memory of 2976	2932	iexplore.exe	33
PID 2932 wrote to memory of 2976	2932	iexplore.exe	33
PID 2932 wrote to memory of 2976	2932	iexplore.exe	33
PID 2932 wrote to memory of 2976	2932	iexplore.exe	33

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\9d10d9227f165d4745f1571e6e4d2ea2.exe
"C:\Users\Admin\AppData\Local\Temp\9d10d9227f165d4745f1571e6e4d2ea2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\E696D64614\winlogon.exe
  "C:\Users\Admin\E696D64614\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Modifies firewall policy service
    - Modifies security service
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Sets file execution options in registry
    - Drops startup file
    - Executes dropped EXE
    - Windows security modification
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:1716

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fcf8856e1f76c54c8b0e013d3398f8a

SHA1
c4f3e4212f8399deb19171cd52fff50f3d7d5d9f

SHA256
cf9a5773634558a4496284f034fb04f224fef05cf33bfd6cff74a0362740dc2f

SHA512
9cc5ad03a8ef42789c9c043b196ffb2def43bad73d9115bc89a1be114453de764d1c46b63746f19b86b68439a48ba6b62840ddfe42535331fb227648cf409955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c04069c65228ce5b40bd5ba5ebcaec4a

SHA1
711d2c52b6841202c36d579722775f854ea89fcd

SHA256
5c78c6f1423549ef8a0d3a2854e20cbc60f5f02fe9c309c94558b8d18f37fd79

SHA512
d8ecc0571877badd569ed816e2ef6c0a1250545e294d0efe68a79cb9b08357ed846fc0ebb75c94e10269a1c1499bc9acff614defa1ad11d3a677ae16f982312c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f415f1b6e1156f016fbb25a149c9272d

SHA1
555fa2f5367bd2e272ff313624ee139d7973d87d

SHA256
ba59b095166bcaae7e2e0fa8ec72a6b917372cb59f4dd014f1e7d4fd7535ee31

SHA512
07fd600edb57c17eae9a70951e2fb444cb12f283cdaa7ddd6a3493a14a346c33e769a662b03404f67ac2d74cbc14de65cc1b041dd354721694a93a4609d41dde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65d3f88a99632d7433d1b310a353901f

SHA1
ba5ae4f20cc9dc1483a19f0fc91c4398adf8d01e

SHA256
6542a8f538e9f626504763fe60d0340c79734a04c32705313f74bbdb78093118

SHA512
c8d435b28e1fd76457f71a75a6b0036d1d7ecb47f64609f88a2d464d1505d8c642e6c48f45eadb1d7996cbc08521fa8af3f162d4bb78edf7b1fdd8d5ae608612

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15ca0fcdd8200ef381b0f3f16ebd7705

SHA1
518ec39ff224a4c98d3180184bbcf42ff06a0820

SHA256
e72468a68de19d719e9bcc5ca40ac25504b408210f35c42cd64bcc52b5041235

SHA512
55b3527885446776a1b600e66dc24b2d0fb073bbfe2f371c9b192ea608c692dbfe9514031402821ebcadcc2411ddb253b06b6ac0e5b5de8f8c2ee3bf45f2ca3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11364ab1233773bd99a3f5f62c1dcbe2

SHA1
749d4821408260aeaa0330b6239d8afbc433a745

SHA256
6cfbc956b00291cf9f8a79264489a3b5ed03b722152a69c7dc89a830cf7ab1d6

SHA512
985bfc5d2c60768f2bbc9c6b0287639a0315412efb3a329f7faa41fadba378a625fcf228b145623d303c0ad409a8e68d0f0e1bbffd3ef76a5a14cae9fd5fe881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
792494dee588ef0e878187e2f01a1b9a

SHA1
728f8b23387c376c7363be3ac5bb120d178da14b

SHA256
9303e4657e16983b7e7f128db9d53b62baaa025d060adba788fc04fc5b24cef4

SHA512
973246453397f23af9e411536f92bd4a4692cb3008ca1d54515f39f4fd4505f4cc347783144d049d0da991736a91c8bfcbcbb740e21950338b85a3cd6c945996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7568cffabea72ca4c412edff8482464

SHA1
85945e437d9e4e703974a89ca73e566d64716daa

SHA256
98067e69f8f42d85a1e51263a1dd15819e3c5111d4596e6178631804ffbe622b

SHA512
be840f753e0539a4b50fa63b8f7e78ba7d2b9b7d4eca161cc5ce7b640135da8409c428bbdc26acf5ec847ff9cfdd30956d01e54532c99e252fc2e241230e1645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8865b1ff51e476ff759c5ff752441e3e

SHA1
35aeb73e10fb035b9d65a82514bfdde670957a77

SHA256
7726eef4ea97e2e023b8d761115e58edb2095b026f87b4edaf0a4230510bfd8f

SHA512
bfff84e27af7928b0b0f91e5f5813a28e007dd271b958b4df34e773a838f832fafcf230e65e14a35f27bac96a0e43ff9b481b5faf5a206ecae6d5d81c31313de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8d5c55464eb68baacf340881c50436e

SHA1
cbd31c5e80317ddb9cceaeb5c977e9fe99b90ee1

SHA256
5ec39697ce4fd8f1a054228d4e84535fd7e25918bb4e5e3112e40f81d0636142

SHA512
f62706ebafc7b2f0b633ceee613ed6d5f080a8226adb7d6287f3376d929441e9b59408d5da704fdf11e432350d9766a199a9839fb225c868377781200ab9c168

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc97d2018b4a92cfad5e28252b0c9886

SHA1
881f8dfc5cf6a98eba1319d9a92510a71f956c4a

SHA256
5d1ecb5e0b8617e6a273276dc07bba29186bee62e84b35dc10a487d66968445a

SHA512
08d1b26a5a51e16b81b55a65104dc1465b73955d85eee591a92e95e04953d94cf07483f301a08faf11b9359a5a5c32578960141ea97344e03bd0c29a6b1e9eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a87f17d74402319bfdf88773f665f88

SHA1
3fc560ac707c2d6bca081a5ec42bfa99ae63dcf8

SHA256
d8c22591a8040a5d7b9e55d0ed501901db4f3c1840ea554462dfba76d4df2a2f

SHA512
b5f5534b78604283f21453a927411a0bae1b3914447fd524a11c767916387da9fb5c10f58852982983caa7e27b37148261ec2949b262fa2f2b6fb820f5d6723c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0dbe062bfa31cc87dd8d5c78cc868bb

SHA1
c0ffacdce10f8be173be5da7bcc857059413daad

SHA256
14e112ed86e8ea2e1995ec5099e31faf37a9e44c9a79217be9ce8caafa7d95fe

SHA512
5c01af191e15a95b8245617ef51b6f4a83807cd8a632ca31df633c85a27127606e165f85dd6b146603b57a33dd1679c94407aad3afb805db7e4ffd950f5f862d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76141b3600672622ae63c788756ddfb5

SHA1
ec2e5f72ab86c9686b4f5eae732e1b5b3e9ded47

SHA256
3a12da3ef0e595f0b5587372da65ae834bda5b52ae1b02c3dbe2f2c85b563965

SHA512
13ed1f544daac1e2107b1a277fbcc3b05dc0f8430ef4dc0a027189027a25ea659c71028e7181e7a0c0495390306e051373f41ffe0b615d5f6c25fe41e1bae2cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83da3c1508e63c0f41571c2930781a62

SHA1
a5945a3f9ffb408face1c6fe1a167762221834f1

SHA256
064b7e51d19a05fa38efca4cac3842778e88378185ba96e95b416aa7010e88e1

SHA512
d4d407f412a08d2b9dd68e59a08b5152bd13f7be4e664d92c316c62c3cc937ff9b3755991fb20a9239244d669ba3166077b1a8eed0ea1ca1598b9bdd9ba74b4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50a6c1dc22569260f75a8def77dc3b06

SHA1
664450ddab62c504b65aa97017aad54272c8214c

SHA256
deb07b4b297a70205b4434c315e4305da37949f46cc688b169f8c1f0ea687aff

SHA512
69dcce74963279892afceeeb47ab762e5e7447d86ba227c83f6591f367c86b3e7196b11b300063964b9d895cedde80c8d61a874902f03dc0e2c2b8709a3d7db0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e303a3f71b778e4ded72feb7130ec4e

SHA1
0a696a2fd826abb113be9f5b77202ac5169a33fd

SHA256
d1c107ed51170ad8fed161357f060d41c0cca5b4c5a9e8c9a65354656e875221

SHA512
6eab710d7391e73c92d77eebc3f6d43e12cf5fdcca76f1cce8a4f67dddf40438d963a83fff430b5da10c602048d7142ec5e7865da0e90d37c55598c081952b58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4dc658f1cc39d6d3984ad725bee1b04

SHA1
dfbdb6fe79a7e94f79846936f5d5394e2b4a9071

SHA256
a53020710c243313197ac6019b807333011eb4a226c1e3848a48c26a0da4d498

SHA512
27221cbc322f168bfe4cc937b0c56e564d484f6659c56b3c7b407d176443fb5bede1dc35e9b0c17595721f8ced2910ed516da6e8531b6e7f618b98c8072fbc6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9447650e7d8c0a241aefdff26303b7e

SHA1
b4f31a18a0d13f2124e30ce440644a1f455d105e

SHA256
c2642a234a525727dc66bab30c7ae49caed41afa59653bfc43228a0490a6c21a

SHA512
7d81aa47ab175133bf2f0626fe6f125712f8e0b4690fc585ea286eedc360c9ababc07f786ed26e00e5b35f92da768c339a7588c12f20b3b1a6bd251e0c413407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8c1d51b90b67788ab462cf36d7da494

SHA1
a1f1619da005e05371666bf2e526422b43944ab8

SHA256
32299e17a379e645b2f9e9d885e2278a0a9dceefa8c30ff62bb4ff85f1d85692

SHA512
a904a9b5f7b0a54fd7c8d11d343ede1ecc0a2a89a8b01cd71eafe2069144b23215f8247fc26b118a9a14c28934c888c1587c08dbfd931758baeb8f1a7a94ed91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bc108b333802d7168b5abe59d75e24a

SHA1
9aa0780bff13ae6bcf8176bc7d3e92a87341b8bd

SHA256
8fbb11d17404beb46ba30c6397a46085583fc99523fc1992c8edd06dcc0faf81

SHA512
273d9a61f4829159e7a20e8196243887ed66ab3510c32a6def81ef808eda681d1f4900948eb1338d95436e21f0ab659e7ed457d725354960170c55907f56bca3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d629b38896e24d9bfec12dc851b47153

SHA1
8ddb3a4defaf4caff05f29d079673b9a55efa8a1

SHA256
8e4f805a69e7fc70f970996beba19a3a899e29aec81cfe2d986497375604b922

SHA512
a1482bef3d1c3a21969d02a32e50a285e6954b06264c5a40122600cd70c4957136402ecf5c5e6eb107376ef8b9ab5c99b92eb4200c224acbbed8160d8ac959c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9c0d664b9c73f31d6c4ad050c233ba1

SHA1
5840639e86dc26a4e5680116a04b67771243c0c0

SHA256
3c2ce69af2e607b3545922f495d7e60bdb653756393c002657a2e113cb12c0a0

SHA512
4cf54395d0d64898bd97c954625bde99ad313042d642388b9c587089acae8dfe709d208757efa47656c7ab84c5e3f4a3d33f01604c15f1c1d74be2c25fce4a8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10bd95f32837851ca93d5a38b9ce4455

SHA1
e7f9f470959fcf9965d660a686f0583997737653

SHA256
c4b4e8140fe9c55a74c7b7e89281c43d418a5121403ce7831542bedda10e036b

SHA512
542b9591d71f4e7c641a72e8a72116d8ecc45033afea905220e164e2144a7253b37f1b68ee68e408a1c67c9727c05898a60dfdc24dbab5a33cb255c032fb5f8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12e520cd6ad8ce65a5b653c3fe9ebb36

SHA1
f081a0cab6a471f2337688f7055a0195b4acfad0

SHA256
4b82836fac1f6e66564ebeec9e21f4ede0026ed185585b1c00608b827856baad

SHA512
cd9af5607f154c743895b4b61c5b9ca3064118c505866403fe0679e9ead90fd28d929b1c6900a52ce8818826af1275b5b17461e857d1d77fe3f4c4dfc19330ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa5b51f7d485838e2c47d5eb4db5980c

SHA1
e32e457a7ee7ab791c66bb1d2039b5a117035ffa

SHA256
4708a60370f36dba0e8e14b6199524885bd44faec15e9fe46e09f5617b5df609

SHA512
1c81cb7279ba93220c3dc3793734fba3e1bd6cc90200ba9aa2da2515e12f3bb704c5ab8612a4f8fa950f74ae1b3b207cdfb5bb4be122c543fc0a6292c6294a34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
144c74458df1aa4acbdf20dcff7b4718

SHA1
5976ff60710f26cac326054cf8b955074ecf64d0

SHA256
825c0e516bc47d3261639c6691baea330514e6be6f4f10c1c791c1510b3b5e74

SHA512
4d967fe9b0b8cadec0fbd428ff65a6690b2f8a03f400a4ed8eb3844f4611bdfd6c5369a40183610bb47ee5df14a683f94d3f0121ffe1f03b099fb611ad424056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8355cba0597a683490a1b21459b36ed0

SHA1
8f4b804dc4fafc19ae5ee9bd710bdaf0c105363b

SHA256
a4c5a6e3e02786e81eb207faa2dc07aea7c241b7960cf654520a879ea77b0f11

SHA512
698b21323308c40b1655749a3d30323643b76cf355e2297eab6017e69b441cf864b2c7e53d04d0d9957d928294961c3e0e5aa5bda8d8d5810d21e4f027781347

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3164ac4edf8e4e6e6719c6434a65fc1c

SHA1
094365d0e4f65bb1a66b53fa7111a4fbde1100d4

SHA256
eda7cfd960593c2b03e5ac81eb537f8c5c69f74a41e16c0981830047f529334b

SHA512
18f898949b097de337e08d9700755c28f3066baa41954312e0d2bc2cfa99282b95ef237d7cc43376d2620ffbbbf90571b4cee4bc29167a7287a0b2a73eb15ffd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29dd6b0f8b331fb7b00dbf4a23605508

SHA1
6c73db2d0d51ac600373af3e6331698aea6ec85f

SHA256
dc06868d418afe57f3273ad48342ebd2a2963e7ddb3a53eec1fd3f757a3faf60

SHA512
bee645b5481f3236fa02b5700e36a39d9118b51fdf8265925602e22a71e5698038242bf6ad7f3371800f403785bf29e75ff5d5bb78cddc68aed1b935b0af7f31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a88912e0a0e4b7cbdbcc91d8398270b4

SHA1
6831e090f4d86bce5f0a2557650b64fe4b5d66fa

SHA256
69e1377166d54b377b0ffb3c53827b225f4a3258446e805e32eb297c21f1d07f

SHA512
53c8be41a279d65a2a6b11c2a4b65d9e19c0431d122c9c4c97899013bcd2665a978ff1b44c3483ee297e82b645fe3bf447d580a12b94b6333ecc34166caad253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2db0c2d1b742c1020f54dd9ef1abedfe

SHA1
c6c6056b17af1b33248bcbbab571df533a2bd5ab

SHA256
54574bdabe0de4dcc37725d413523e665599b13060451dcad9bb61d91c1fc0cd

SHA512
fa424883ffc5f930adf9baf8c29911abbde17acf3d188453febea80d6349879aa9e414150fb9e46447b2f26565b58d3018139343e58426d6888a7574b547a9b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5945a38bbef6b5d709433d886e951d91

SHA1
e4aa6779e29ecf218cc51c15aa70df7a4b8681ec

SHA256
b636c54850ff48ede8aeb4806eee499dab0207ce72a933dfe9784ed0cbdbfedb

SHA512
517c4f4e9f11ec9717e4a807b69585b9339799ad4b96814ceb462ba7cc6f94c89f635e9b35b644cb24e76de28cbc5bc6b6a53afd3a122ef00c66ce0e26a29351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21817498fd3a0bded59bc0f1d518887a

SHA1
010d7243db2a9128e117a6c7ffff086530a4c50c

SHA256
fac84b678c27ef0905912539bce86e0f95fbf7ba59b79df4204893f081883036

SHA512
e28f90906f7bb25e7e088c43d5701e742d6f0a9ff5f215f9626804ff4b1e018a5592aad68c3d0125d1cb462c170e3166758ab50cc901a19c8d5ef365479efbef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0df199dfa3bc63a731412be3ea3a38f7

SHA1
efb3779c0cccff1e1aa6accf04aa3777ba51eb46

SHA256
34537e33d53f222a918556718184ca1dc844167dbd6d9c086bd6b9a35feecd66

SHA512
22e7a421c97d531e0370385e5fa934b73837c069f05789212b29d8276476a6540f1015bc2662a3dc4f346720a818469c9eb1d60efa8a158218bd48fbac2f58d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45a26243d1de8c529d8e7dd4a14a2139

SHA1
9ee6cf9334b96c5e1ee1c9ae6dc975ed3c57e25e

SHA256
d293059eb40a59de696559348cd57d377b52b8b8a28b2283b9e28b19df3887b5

SHA512
06a2a6cdc121c434c6c2cf1e28d8f303e6d1ce3e9ffbe2f548b11eec9c8d971c9f13110b26d125c140337e5044e433fef3c548988117405fedd6830eb1fda2be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef9289865ff7ff4dc4beb7bbcf078905

SHA1
f8da01f446c19d79f0feba7f63fc9dfdb99de34c

SHA256
2ba59597176bc7ea2c5c33261b09f0b3c0b76b97d0966ab20315542e7620fc3b

SHA512
dc1b0ec4f5462d94e17a4d9e71df794836c9110a57e4cb749851133d30c8e8c5b10e0a1828f924e082930f480e67849e093ce7b4eb7b3aa941d462ad4e865da4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bda793e58d1c0ad3ebb87d3756e60fff

SHA1
080ff64eba12deafe676b85dc8cd5f17d4660dae

SHA256
ecb233372a0f8e487f6b0b5108a0543b9347865a9048ad06e39430948364832b

SHA512
fafd4c357a34ace34341b8f995cf32d825ccd2492c7a2a39b40ca6b17974ba935d0996e74796a2e37622a04d459d4342048e6d6266e4a47afb8c414734fc31e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7d8673e01359d85eeab3ff56109d27d

SHA1
b48cb5d0cec46a2d88904ec0c6027b7bfd383621

SHA256
d830cc0e8d2252e23bda275892853e78f3fb8495fdf987a2155e17da06742c62

SHA512
068d6071f4f73aa918f4de31e63c762df15a7449820e1120868028fef47e836634f1fa0c2708e25fd51815286e697f5f3e0d8ed20b0643dcac919672430bd713

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bf2d85d296f8e0b7f51ffaf026e945f

SHA1
f5b32de9d968ba9d897a7727f4cfd4fa58d3a44a

SHA256
9a0628c417d55ca559403696edca69c21f07c703c2db52882b6e115b62c19b67

SHA512
a769f946d3437f3ee4def44967058d3bba0f7a68425c64d762bb667d4b16b7518acd348c8390e2735370d8377cdd2443a737c3ad47763b72e45402d31cb5163c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32098bfedb3fd52c1b9b147c816147d9

SHA1
f57bce85e540ef5cd96abf8c2fc9eeefbd3801a8

SHA256
bc8ac76d101b768ea169eb5ce4cf98d22a3eba02d89eb8ab6bf814314c172f47

SHA512
15a681c4f6308a92518753fad7b56e361969408d1b9d434ef56a5f60bf0aee92ae9c4343f860f73635b60e0f213153914cfc9281b3c3222358a403be7a318ac6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4381ebf09cc92db2ebc35fb954f0fa43

SHA1
c07032abb09e251ac8599d06277c57d30c02e97a

SHA256
efb1d15e445c2fd7f75f557b9eaf6f17e14218b8133b606afb49c392eb744eab

SHA512
890e40890c1f7717021a0888274ca64539ecb550d1037d571d3f18fb55d017bb527ab0a8b0a9ad03841f9e2f28a700400687dd8c69a8b85dc17babf4d42d14aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62b8d825f65d144a1dbba9696b0fdf61

SHA1
1e3d782b7d256c6701b4133fa1e4b82e1de3dc3a

SHA256
4fb61e3f557300c261dfe10a27fab469b487506761810612ed98ec1fc9a79520

SHA512
5e9fd90dab89b064a6b6a1e985af96f5f7b16d4cf5f04548efc933fd7466122f0cd17cf04a980269ec299a1d98ac1e44bcadae9ad23c306a235b311d83c5bb40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6f40450e786bc906a0643a9a30d12f2

SHA1
6dfcb46e30085dedb284a2782cf96b50a47e0dc4

SHA256
b521937d152c39ce1a72465ba391509878623c704a23d9361d8694a3ab037c49

SHA512
5bcd366afda0800d0bf32011cee70174ac3731eb943661ceb2362e8a41b2581501d7285e7e097414d85a0c50fed34aa5aca0e35586c942b425f7dcd8875fe9f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf7a24b43f407226aff7f58ad91b11ba

SHA1
ddaa495dbd18bcd2a5f705d0d911722ed309b747

SHA256
ad054450417a966118ff2974ba244eacc266ec66989db4df93639995c9ddd3ac

SHA512
c71e75ac7697c993c69d1d1b4343986ef32f72109acfaeb73c3f40be510b010d94ab1d8d16c9599b03c9817b1e20072c7a60acf7ae63e57f16b3a4f89fbeac42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a3f6d1a744ee18c0c43f2bed29d110d

SHA1
895f6f2040a8f0624e3b38ace6d21b2a9dabdd0c

SHA256
60f233c6ba3525141c375e17f29da16b360c62fd42ea799f4cd9f87716215882

SHA512
e95d4ba66503306abacfee98fa7acfabc2949697208194c137575fff5d5313beb51d1d71c37c97fa0bf2919ddd6743b6b939ca24a10badb3dfe54045223a8a87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c6466e18ab40814eebfa492b9adfb9a

SHA1
fe7bbe22c353b3c59b52b0c97c2fb2ca13d5702e

SHA256
5d70fee75184d249a064d3b98356625fd804282435831cff1290ea592f6b070a

SHA512
8f65f165b897c1a75fc22276cf1f227c748efbb4e541809520d1e81f23078a9f023f2dbfc38fe0de11a86e463d78b294b84751a56be58c15c147da6b0640cbbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a594d23f7fc5f8f95b8131fb37bd0a97

SHA1
97967ac87c298da1ecd9569006cbdc5da5252416

SHA256
1439cf592bc0956b30cea1946ed3bd30780d1ef90ae20923bd067f072d1352f4

SHA512
7e6b3a801bed06e833d0bae05ca3603ac898e85924c70b854fcb7efbde292eaa36492536ae6cfecaf6640a68b366dc752f00f77946ac3c68b6035a2fd35a5e5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3221e055d9b8b467acf0017802343040

SHA1
15ff7cfa84f53a3ca6b25b60989e441587c37a43

SHA256
7b14b82ce10b80e438b0c2cf326f9817dbc75bd2c9abd38a48deccb6ef0d2e1e

SHA512
33c149ad06a0f4c15972fbcc09de7a4deea3c452bb035e1575004c92fabfb82bbe1dfbc552582c459895b00114840284858828bca736ede545ab68f182f1cee1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aad01ee409761a1c707e4a704f7eccdf

SHA1
b62b642c6ab8a2a7ad60cacd72433cc060813797

SHA256
4f6ff83b613838ae186838fc6fc908346dcebaebdffe0149c31f10be65d23322

SHA512
9323a81eab465350e785b34ed3caa3f0fa3642d2e9a826e9dcf67ce96ef5e441b4381cb809e25371d3fca164e282534964f2f64166676c965022e410637e47a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
06fcb8c14a9c4c2180a9ad6196451d3b

SHA1
a49c4e7d368126a30c3832452b56bec6dc926e9e

SHA256
5b1f93d1a03843940c5cf843ff512367311bc4af1ba9e1683d7b498045bccd78

SHA512
819ca64d3d8af9a5e39611f129dc962c2747ef3312b6523ff65ac715092e66a5dd3cae7f1214551e34f7844a56188e11b9c4563a5555cc2b2f61a16c1f839e85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\D7CKIRO3\www.youtube[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\D7CKIRO3\www.youtube[1].xml

Filesize
229B

MD5
1ff163cb03756f7a5f747bf837b9ca6b

SHA1
b2eb21efac57036d8b88082c877717cf581265f4

SHA256
c7e0ec1add404eff910798f109e7eedc4633fe73ab15d80cfacc206c47dbac8e

SHA512
0c33148e9c0eb5550555223f1d83eff321f7b9a6b19c5141458b27e45cc60b77561426f66a763fd613d5be0934b786c137766d28c337d341a22415f2725283df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\D7CKIRO3\www.youtube[1].xml

Filesize
578B

MD5
8fd8c8e0b4293eb7bd79a574896ef884

SHA1
bb2ddc704b032b24a8cc6cd4863798b626b35ebe

SHA256
15f7612cab1a4f5438b83d260d0dda817898273d4c55a00a8ac6848640a182ff

SHA512
e67b927291760dcceb821ca3d09cdca4f56fd7f8ed72c95ddbd6c49bf4e1c8fad3a3c8f13c69866e483f988f4b472f8f9d5450c791485514588ca19412e32e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\D7CKIRO3\www.youtube[1].xml

Filesize
578B

MD5
a893551829e054236309bfa6c555d44d

SHA1
b1bae7bdcd7a56fb4f74aad0832b81b398f53aee

SHA256
9603d2b4e1a8403b2d9fa004ed834ac3dcac25c071edfcb082b97000716a366a

SHA512
abfcd5c8bf26459f7c6bd8fe764ed3f80b01b77c1227b0afd7c85fe4d7d91ab4ed7a2f2692b33cb73a75aad65715379fa0b565778d4d7a48f7816e8964bfe3d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\D7CKIRO3\www.youtube[1].xml

Filesize
578B

MD5
0a9c2990dfc29745aad2f728d39a3591

SHA1
10429123fe318d7f0d7f0f01a80f6c92460d496d

SHA256
81ec89011f2e5d20114077cfdba73665bbdb2cb4aa5f1b90751e4b55aa47329e

SHA512
f2cc7367b3c999815f01d4137474316c5dd395fa59f91d41e7ce19f5c94c5f91eeef337280d0fa0ead254e619ea304651b492e05507328828684ee0338975b35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\D7CKIRO3\www.youtube[1].xml

Filesize
2KB

MD5
b3ebf55e6c15d8cb103bce16d46859ac

SHA1
edd35ad8df49266e6e2169771d5bc536051f3101

SHA256
fdfc38dc45fed7a441bfead90e3fef093339453296fc1c69da243c533038b028

SHA512
6b5efbc98068ab7ed0c2b127db46445f37e12ab77232c9d04d1c9dfc7fc3d51392c15fdfdf5543c9c4720ce8429ad32dc232bc775f40d56351010284620217bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\D7CKIRO3\www.youtube[1].xml

Filesize
575B

MD5
54812841dc92af2da09e7d1e47dfd821

SHA1
bbf4899f0f9b33441eec3fced4a9e3fa494439fd

SHA256
2f1fb17fb1ca5f83a5759f77b61ae4303b831ad9bdf8f2446f26d13dc2fda7ca

SHA512
22b0525f115b79dd61353449460bff0ba3a61a3ac352c6c3070c4cbc4ac0548d86b4d127abecdf56b38e423e3a9914fe96499b8384a4cf55812b1ffdac9ad48a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\D7CKIRO3\www.youtube[1].xml

Filesize
2KB

MD5
9e8fb2e8c7f533a0cf4af3ce1fb21053

SHA1
7a4f5d0b42010db29ceb0358d72f57d197553d12

SHA256
e58c157e842ea499f19288776b1680106c2fc1ce093dd46d47c99c9cc4e8c415

SHA512
16981c34023dc4ba3ed0ab7a98e70da1809109c7f35ca3b9f4974993354b99fa2ac42119bb1ec8eafc6f6bbc7ec18803d32d9cb6bd5b47e57c9e37739e1abb3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\recaptcha__en[1].js

Filesize
502KB

MD5
37c6af40dd48a63fcc1be84eaaf44f05

SHA1
1d708ace806d9e78a21f2a5f89424372e249f718

SHA256
daf20b4dbc2ee9cc700e99c7be570105ecaf649d9c044adb62a2098cf4662d24

SHA512
a159bf35fc7f6efdbe911b2f24019dca5907db8cf9ba516bf18e3a228009055bcd9b26a3486823d56eacc391a3e0cc4ae917607bd95a3ad2f02676430de03e07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YT4IJQ91\cf.errors[1].css

Filesize
23KB

MD5
a1cedc21f16b5a97114857154fab35e9

SHA1
95e9890a15a4f7f94f7f19d2c297e4b07503c526

SHA256
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b

SHA512
00e857331dce66901120b042a254e5af5135364f718da56110a4744f3e64f9b61ba0b877013af8398a0f865c7bde6ad2f87b3c9d2d828651806409cba57aa34e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2050.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2062.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
63KB

MD5
9d10d9227f165d4745f1571e6e4d2ea2

SHA1
769f5ef77705c13d247ebff035ac5eab3b0aa10d

SHA256
0f88a503022e629204e8199848f5571918f7b8d723023ba8afb57b8dceba7538

SHA512
1db602c88411388407b791e2afa41fb9e63085c512e3652eaeefa383a4becc5db4516f57c50d68001dfd806fea608c099bda2023615919993eadd08c99bb5b1e

Download Submit
memory/1716-1733-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1716-45-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1716-2821-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1716-54-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1716-2813-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1716-1053-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1716-35-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1716-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1716-2749-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1716-23-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1716-24-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1740-33-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1740-18-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1740-14-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2632-15-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2632-13-0x0000000000680000-0x00000000006CA000-memory.dmp

Filesize
296KB

Download
memory/2632-0-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download