04c4176ba82afc4749e1ffefed306badc56caf687b102d2917606e7445393d76

Analysis

max time kernel
149s
max time network
167s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ca0de97d42ea910381b8527612adab5.exe
Size

1.0MB
MD5

5ca0de97d42ea910381b8527612adab5
SHA1

923ea5a3367898223b6ef6fec311991d1596f3c7
SHA256

04c4176ba82afc4749e1ffefed306badc56caf687b102d2917606e7445393d76
SHA512

82daa9a14d74ed40f3403a7650f8e82aba02fa9191e53dc5ff1adf3f928092ed442a01c1623da147ff2f57f053f09910f35fdbadf7b2f8c8471b8ab6f5a83c5a
SSDEEP

3072:Cqu7aslM9lhLElGtSIs48417nFdcQ4FdHLDC62ftOS2N:CqrK

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 14 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-42659347"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-19686203"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-93229781"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-49563765"	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\azonealarm.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldnetmon.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navwnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardgui.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPAVServer.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirus.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bs120.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav95.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsched32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fwinstall.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscenu6.02d30.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UCCLSID.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hidec.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpupd.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luspt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpost.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdoc32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vvstat.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\watchdog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xscan.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmb32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\persfw.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeweb.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdetect.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spysweeper.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vettray.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOSYNC.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\connectionmonitor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icloadnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navlu32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav8win32eng.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rulaunch.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WXP.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\htlog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monsys32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navex15.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswinperse.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portmon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antigen.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfagent.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweepnet.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\watchdog.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORE.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avrescue.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cwntdwmo.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvarch16.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trojantrap3.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscanx.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minilog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ostronet.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccwin97.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\penis32.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\routemon.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\st2.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symtray.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpcmap.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfgwiz.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

Executes dropped EXE 2 IoCs

pid	Process
2124	winlogon.exe
2880	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
1384	5ca0de97d42ea910381b8527612adab5.exe
1384	5ca0de97d42ea910381b8527612adab5.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2880-73-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2880-76-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2880-72-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2880-69-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2880-130-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2880-137-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2880-139-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2880-1494-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2880-2692-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2880-2717-0x0000000000400000-0x000000000043F000-memory.dmp	upx

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\85D4440514C4A444 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\85D4440514C4A444 = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2124 set thread context of 2880	2124	winlogon.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 55 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://ag2d4027hw49f6v.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://68g8qofchlg0q6t.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "25"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://07o7smyfh81spba.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000002f33724b902e47e73f5b7000e3e97364984b071cc4563ae97987797cb4d51dae000000000e8000000002000020000000e3e146f8a8a7e827af2bfda1a1758d5f5e306ef43e3a54057585394b5dd73b8520000000dd5c1edfe616289a40b74338e1653520811425ca5c9c8dfd6d1af898a9bc46fb40000000249ec7d9ba860b166f826d8385186eef3bae4865472d87826347dcb72d666280d1f2d71abc4a69c82465461c286cdaf1d1b1d8f2b418d0e63c2cac4fc36ee1d8	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://ukj9nrn8sec4307.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://55id3e9ca2kr523.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410697000"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://2v59czs97zq9629.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 708df2078740da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000d54b9f27ef2b3ed7984210929bd4a87003303608b3922e0741a28ecfe31e59dd000000000e80000000020000200000006a4d5d87c06e8ac2b1ea4e1aee6181a53e1f3be4db808212a0940c4d7984909e90000000daef4235292171c92cee59f9a7ae86b053e6b6451adb23381e0333d85c853cbcf7eb398bceb37f1b1351d7fe91857ee4607208b8876f63f7e6f1c115d035405ab901dc33f9ecd0a7f7f7068e519f356cfdff6d40be820b21543304e3e17af7053c61e33e340bcdfd6135a80c41318f4e6a529d0378b169cff8cbd0578352b5f82af591baf2b7db3912e94a865357f2344000000032405a1a775b5d89139afa4da9a6f7a226bb8c0cd65ef9d6992c9d7830e5df2b4edbfa6bb13b81019780ad2c878c45212af75d0ef7020ede29e6cb7235be6e9c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2DA8E8C1-AC7A-11EE-B331-6A53A263E8F2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://53th4uigb8m4d67.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://m96776fm33m4r6i.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://66t2wu6e5gef63w.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://er7g37k73f9ful4.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe
2880	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	2880	winlogon.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1644	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1384	5ca0de97d42ea910381b8527612adab5.exe
2124	winlogon.exe
2880	winlogon.exe
1644	iexplore.exe
1644	iexplore.exe
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2124	1384	5ca0de97d42ea910381b8527612adab5.exe	28
PID 1384 wrote to memory of 2124	1384	5ca0de97d42ea910381b8527612adab5.exe	28
PID 1384 wrote to memory of 2124	1384	5ca0de97d42ea910381b8527612adab5.exe	28
PID 1384 wrote to memory of 2124	1384	5ca0de97d42ea910381b8527612adab5.exe	28
PID 2124 wrote to memory of 2880	2124	winlogon.exe	30
PID 2124 wrote to memory of 2880	2124	winlogon.exe	30
PID 2124 wrote to memory of 2880	2124	winlogon.exe	30
PID 2124 wrote to memory of 2880	2124	winlogon.exe	30
PID 2124 wrote to memory of 2880	2124	winlogon.exe	30
PID 2124 wrote to memory of 2880	2124	winlogon.exe	30
PID 2124 wrote to memory of 2880	2124	winlogon.exe	30
PID 2124 wrote to memory of 2880	2124	winlogon.exe	30
PID 2124 wrote to memory of 2880	2124	winlogon.exe	30
PID 1644 wrote to memory of 2036	1644	iexplore.exe	33
PID 1644 wrote to memory of 2036	1644	iexplore.exe	33
PID 1644 wrote to memory of 2036	1644	iexplore.exe	33
PID 1644 wrote to memory of 2036	1644	iexplore.exe	33

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\5ca0de97d42ea910381b8527612adab5.exe
"C:\Users\Admin\AppData\Local\Temp\5ca0de97d42ea910381b8527612adab5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\E696D64614\winlogon.exe
  "C:\Users\Admin\E696D64614\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Modifies firewall policy service
    - Modifies security service
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Sets file execution options in registry
    - Executes dropped EXE
    - Windows security modification
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:2880

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1644 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c261224a111d1fed0b2d711b6895e5c

SHA1
0ae7be75032704e698a66b19f67470a1f651c4a5

SHA256
059f7a4ebb1e3e975366df6b69ffd5a9fff4d0e73da2542c3d2a49ed8c16183c

SHA512
75df31b36c91e07f912ee02a8aa102408ef1d0ae14b32db5aab8329a9dbef615c683ac8a42c87d527ca34d3c825e0cd60b527ad8d6b39455da92098a434dac1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e6b9ee905a21d1fdbd59477e266eab2

SHA1
332eb025c592d17f23a709bb072a3f226d66d3d4

SHA256
966d85522f19e0398be370cf2510cd5a4e97294316c377944ebc1d9904c3644b

SHA512
185ec7500b9da00b0e3aa38c86db890e37e0808e59ffd3ed12aaff9131d87fb9bd32d46811c9c1ebe6bdece165fb5660f0254bcd3f2a88c50c606b9835e340da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad7ef893c670863f4721b92b673ed517

SHA1
2b28c94f436dbf61797c9a7b99a9f876df805e37

SHA256
8aa21386a0803de730b685aebaf7efe5c68edbb010079f45a3ce5f6ed7b1bb49

SHA512
8ddd56fbc708fa0aa35aac465d2f4de4dcad3029e1fcfbee1b9781b6d4a7a43050485b6c9a3024b078d3b079c60a7d72063de1180543b65e66cd8fc278c9b8b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
665a930f3490a6481d4673b43caf30af

SHA1
6ecc0482a7e69336b7b948a8163b111fc6fe01f8

SHA256
7b8a3e84ffcc692226019118d04f120807664654992d0d43c4f83c68e57d1b53

SHA512
9104103b17a5f3b8748cb030edffba3d3fdc629bd60fa2cdc26a80e012b3e962f45a3d81a75d2f812b19d86e82dc0180becc0dc496ddb2f3cc8ee0f8837f0624

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
436448dea8cd6304a3af84882c914477

SHA1
18a4eaf78b55c5a7f90f3aa8b8dc48a1f2706a10

SHA256
b2e049d69ae6dceae3a70694c7a3030e0a969d5fe59d497e8a5de0dc9570644a

SHA512
293935262da68acfb65f0d7aa8938368fe082a3c7933dc9d6542b7ca46698ba5a933e330c6d58f0432c5e808f337b21c5af75e9518f8e6565a8e08c17c0b6e80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c21ee54191e9a9c3b4600dd2d35c74c4

SHA1
37fdd5e5a575a0a3d78150b7247a70d7161baf47

SHA256
9ce9d8eba583fef7c496c12766bf368167c5f29193300cead716c0184ad329f0

SHA512
5f225352cc14d82dcc3338bc0930aac06c203e72ef97c3ed60a08b2b25fd615629cc12a8c3bf043628b11b2e477f6ea8fc32c2066ab49cdb5f77fe0a742b30a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
576615035cd7d262e8a852b92af0211b

SHA1
b0b40292b6265632d66b215a0faa970b42ab9b00

SHA256
6dd0a04476e10724e44944cb00882ca93deaa0f3ea08e1e01058df48b5075038

SHA512
fa241c1ca27a92942e2a4a0baed59f1c26d9fb3d467737513c572a959ad63964a1044a2d5349560a5933d9efd7d882f31ca7b34388739e5bcaa9a8067a7155cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a76ce9817b62f566702184cd99fa2eb

SHA1
08fa49f38bffa511ebad85b462edb3e4d3e828e0

SHA256
632551ed8e3a3847e5e1f09cd7e00130c03ea50ca62a7dc584227f78ab34992c

SHA512
057f290e77f936649826e4b8daf431e541da53290bb34f3df793a2b94743678e46858a24eeb67fafec98b5aff3033734a45b4deaaada98b5fc770148365f3cff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b521b154d9b0844d6eb29e7d363322e

SHA1
100fb582b6b5e43b0ff7c295b6b171070dbdc661

SHA256
cd56ab22d9cf709a3589537672f1a99e755eda9cdea5e11cafc07357fcdf4882

SHA512
a859e3fd4666244ae6ee66f6af9f08357aa89dec954368dd87648803fae1bed76d86ce29dfa95dc276ac957186c903672a06e12e16af6115550fceb712c30c48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1eaaab55ff20efcdd0971297743cca48

SHA1
6d129003dd0b4d98a42a6112e7515ed3b48f8ac0

SHA256
79c0fc29217903f0cac049ed0e9f5be4da5ae64c10058082d87bfb3a8c069177

SHA512
37b375aa26b0681a32fc2c7c0b21a143985d3f2ccb678737d181cb83153f121e1c9ae912c0dd1196d2f81791597ff98f04bbac0748e9cec17806fb732ed8ec15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cc25a9fa51b22b3702f77941268af6e

SHA1
d6fc810541768ebe9b2b60a374e2c62505ee27db

SHA256
09daa479364ec8b51333fe9ad4fd5574e616e81b5da4f74842b771a6bfca17e2

SHA512
5dcbb844b297adf67c717b1e6812abf6aa982b49ef367f610ab5399547a85dfb7cfe9688bba6fc52b60959800f20c1250bb003bf3d4881d0cdb74f00db085c52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30a17184352301c4ebca92bd7e08749d

SHA1
d60c5f89c7d8f1de231e1d54d372cf7c37f8fcd5

SHA256
eaf0eaf9519cb45224f8af95e26e3d2a93132cd703de2ceb1c764e5af4fc14bd

SHA512
b1cb2ce735e2c82b35104c33b32789005cf2abf7cb48cf8308bb9ffb9fa1ad0f6e06f073761d60cf61db8f9e995a1dc1160d125bfad85f77301ca6500b695e36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a600fbcddbb2290eebd1344df550dee

SHA1
a1b3b1e4c6078c2f63fa96bfce4627ab135fcb5c

SHA256
dae8fc28daf413d1855732476514f6345e7a040f909d25b68859a1151aecab7a

SHA512
946cbfc9ea9d57eb4da3ca4cd8001804e9a96a04d1c5c21d307e8ec38d159da64cf9dd7e596eaf3c7efac7602eb1e7568b4c42baa035edc31a98d35ea6b12675

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e86c9ed024965e9a32a45b422314189

SHA1
67509eb60ad6d33e95bf98619ee77fb2d7ea0c38

SHA256
94c094201ae2d5483ea6a2ab1d7396968f2789327f73b6f4601079f21f2daacb

SHA512
ded1b9afe0eb0bef2f34f9e8523da0b49ed2f50cd6355f79004691979e17f698539adaacd0c681bcd496680c23ab35a422278527c0262b10697a206fcaf05b2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99cd6c23657abc8b060875ab1cfbfdf9

SHA1
7e9456311d90c759e6b74616e031e29d73e70460

SHA256
226a4952fc3ca36adf1065a7ee6c60cd0f0e0847ec69fc35864994737a2e904e

SHA512
308105504e7fb244ab24bd19f67045a95a4f47341f713144d4f3e481549e57d14aa7c220863f189a9ae4803dd348e2d74227727f7efb649d8a8651627b1ec6fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f0b3874ba15a491e52167991e69a86b

SHA1
06c5e5a1d111f995c8405f47cde4fefa6a836aa9

SHA256
7a29abc9322fda595339375bb51d8f02c7324c1cfa3ef8dc45f5f8c0065b4ad0

SHA512
3e49c7306099505b89b6756c5565e3cb4572069568936ea3beb543fd42bca9545e237762955573ac628e9d4b53bcf69f3e67753beea924ea31310ed3216fe02e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5c31360d49d46d4b18e4594ccebb5a4

SHA1
60100066700c4611edfa20c397026463a72a8ffb

SHA256
bd7736aa1fab33c2e71bd4960a1d221d15ba7aae62143a56fdedaa1cf4e2a12f

SHA512
6ca7d45272d13f88112f4337dea73d172b816a4dd992a91ebee96a462f9729feec1356d93da46d4504e369ab3a32e541947d34680cc7c5a0ba33bcd884b4762c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f62cf38feb52e1f6f4d5be5123df1d8

SHA1
5afbc08a67a41a2f0a77e875409b16efb8f65205

SHA256
447fea8ae15e61684d2f0a3df9300e220d7e9cfdd0ca55be842df0c2d1cb5dd7

SHA512
42ea2bf082020a3ed839fc43802102643cb994b4e1da1f8c42ea0fc711b2a9b78db7e6005c7d3ade32126de90c41a15648171eb24e28adf3961fc1a8662568db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a451882c43e07aa61aef92ed65f88127

SHA1
40d41e911d6e49e04d604711785dcb33a79ce6e2

SHA256
95069416e433ba38afc4f573d277315fc70fa664bae2045d8859fc8facde49da

SHA512
a59eaf4b34d700385a658478dac9048f44f7f31886665025b5e13a80dd0841d26df00b9e1fb50d9c1b879718e9fd296534c305587b2e064d7ea0b480687461c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71028690423355f25e7d3a7b9732267f

SHA1
41267c6e2661d943a6062f2c7e310b117f5ba618

SHA256
4d9d082578c115e71b8255d99e7f66d6f4733ebd174b9d55ac5379f6cd0fd1bc

SHA512
6446ee39199fa84511942b61ccb15ca4f1a4d5833934b21185277244b25e6b3bb4f7e70acfe1148afc946a7d87ac7a106f6771c299f1b4680abff8f94f90fba1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a2d834f6a8e3731f329dbe49cdf13fc

SHA1
26aaab4a8c6adc2806b3c58e9b2d683aca49861a

SHA256
13e46e56ea8cd2ab762877bb6e7400ac89be1782462c3d99368c0eec0559193a

SHA512
d14e2d1bda3308b5ff9cef330afb9747069e811448b5f1a3b81b6b7ef1cbc05bf1930709aae1f4cb91be2eb6d359a97bed9d7c7b6e66a59635a80e265a61a55e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21eb0f93219d976760c7102c0d11fbc1

SHA1
3996f18bd4038bdc64a7e6706962382f9c8b7bd8

SHA256
2d19a02ddd4368323cd35f5a54fea9f5a125f744e3d0026238d69b42ded38436

SHA512
7d230d4aea16b5fdfbf2207ea885c627877db34d1a129610d2038d3b21d6ce660c425a4af0b2323d66bb7f6b07243046b8d9c33f91c91cbbf3beee2ef4b609cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffc6b6d719e5febb79f750c8786e1a84

SHA1
51fbc01e3e9a82f00fa585300d74f1a785960f80

SHA256
94cada6e9d4b8f4d05a001f532bdaf3c764a23bf9c927cbf2600344c36cf0638

SHA512
1b6377560ce965f52b81772ee0a39fd221b5e0ed6b58f587185358e6d4da3fb7e6992c11703ded8b4c158e060665662816d1c18afbb04578c4bf317d853b8dfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66e60718ea395c41456fff4239813a74

SHA1
4842ffe5e9b18e8356f42124f66f7897a536863d

SHA256
e61751d12bb38742d5f6152eb39af1834d0e6921f3dc4132c63b8f020248bc7c

SHA512
a0aeebbb5c38fd835feaed8280831aa4ea2bca1fda3322f9253f30fb1fab1843ce669c58275da97a80b80b19a166e43269c64ac04f7893b754726a638eef21f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db765b8aec51eaf5d528e6e01aeccce6

SHA1
89649e0fab83d74d91dc1b22ecee5c058461cb08

SHA256
cac7e8cc865e6456ca245edd2573ab02a642a4e515f2b9a5c2dad6a5c22ae9c9

SHA512
dff1db38fa078dc2e5e0c8288b6626c0a4eaef9e018a2c0f147519e11e9803a00dd98c02e7f7edf68eec702f56e5416a82b9a41fb679c359cc09d06eeff10d1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
967ec7d388eeb4876eebb90a46f152e8

SHA1
4b9c635dae85e2825f35034f8482d20a753aaaf1

SHA256
907d86d9757d35d6c72b7fdafd34a818e3a492dba2900a44425016835c36ef4f

SHA512
4a9ae7fec15feeeaaa12671d41ffe8b250797ad68a04e7d3dfebceb4ab7188fe4f65e553ab44e6d6eec60a769a070107470ff2e74bf9f27f3cc2e0fd209a66f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
311c99fd66fa88973654558636c722e2

SHA1
9ddc1bf279bec9f28d67f5f0466caef2392e906c

SHA256
1c49738c67862a16f6f4d295296bc180047e31901611c3643dc5200a490c2002

SHA512
f1b3923b5a699aed96c10628ffe3c882486e84c9c2f0dbb583f9c369b97277154deb75831d20ada5120973a81c02d006b2b19d789dadfc8211e5d2908899a9c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
869938dc6722b8c7be1ec2e0d5440dda

SHA1
3298115e3ce8e85b3f517828039ac01dbcecb6c4

SHA256
0bcc4314b6acbe8676fcf186b846e1a2d0a6cab614a7778abd97b0239d7368b2

SHA512
fa47d2977bc1ab28c032821a6b797d28538eb7b9ca89909b1d6de2caca7e9c5a5be8028572b4bd9f198bdbc103f92f5da67bd982a8836325a371924128ba49ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fddc86a1f0a5c9a69c47682bd92804a2

SHA1
56f61780a10692a99d80610c782430a934de874b

SHA256
a9cdda1ecda3ae7ccc28533cbc990ae0b0ed20d319f27508f256ffa57d7d164a

SHA512
6fe15f31cbb2a10f35cd761e4c5c9924cb1752fe2a3a825cac233a9473105336232f65d5f323c14febde969754269ee90b4bd4fdf3f77330a26ffa7005cf1a7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50faeb478380174d775d37c3e984ca7b

SHA1
0faeacdc45d0b2745cad599f38c2661bb0006104

SHA256
4635b60c51a8406c90909d41f0a4b7ffcb125015b0716199eb9f0443af4c981f

SHA512
dfb9ad2f9629b4957c506accf500426ef632e0a6ff091c56a085203141831163a81acf9fc003e5cb73d93cd51cb0c582c6886b941e6ad3d20289804b8019a8ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7959c3d823ded61d378f4c455fe44ff

SHA1
c0904ea7af9e30c283b1cf155c46ae0be1685edc

SHA256
d037794078c0d3c91c6050d96f0bfb9b2c8bf4de17d1bcd0ad6fe2ee2961739c

SHA512
6773a95e601c1bd824637d837b8c6935ad45c2aeda4283aef27ca30c4ce5e66b372a49a33c456a900766e866fbd5f67af951f3fa8400f823f7a779e44e80ba87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cfc9142fc9fc7dabb4661f268ebe6e9

SHA1
f69fea3a19cec8cd546238e310d0dce3947e49a3

SHA256
bf9de77dda094c93f1b2180cafce65c4b12d91eda885327c2cab9b15246a4a1d

SHA512
c75d7cb6910eaea893e96b4ec4adaf31e8d7b08a87daae5a53c0a00ae267cf14ded5dcbb77847a055f0e56020de4079511bdca4ab3fd7141871d70361b7d3ab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d31bced39de508a5da54a1b200af37c

SHA1
6fcb3e76f0b405d562ca1dd2ee563872628f468d

SHA256
e3c44dc1dd873dedb84c4bea48789501155ab87cc525e19d64d0e4c9b7eaeae6

SHA512
703ca552369545f6ea6cbabfad9475d87bf2773b220e69198a473eeecf76cb8ad9a56dd05f02bbba049b45a2c17b3bd891ef5e5d434b45c6ed050a3040af84cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3217b2dcb5b011c97aeaffb1f3c019f1

SHA1
52664d31e4d238637072c96e67a7ddaf5b572f2b

SHA256
66471a8c399215006d321fbe9ef227a01ab2a61c2ae949808ba19597017aeeb8

SHA512
c5d4bbfd7a0a359e207e1687b1bb6bfd5edcf6e40062b104e03efc847241a4756cce022a15f225405e30877115c0305dedfa47e9a55933202b2d962db21619e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb7a4a9a007a4472be352630c5765928

SHA1
a3ed26b38b8e91ac580583d2d634f988dd01fd32

SHA256
d8480fabb2109253898f7c84387c40bb02d156d35b619c9cc09364b77a62c665

SHA512
fd14812b374efb626924403f4d909791332ac3172606484f1c4273cb58a4673e2f83a9958960055257fc01e2f2c99a678503fe3786ea9be7f328dfe60de83d89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33ee19deda7facd003e451ce7d896b92

SHA1
fc9cdaf648c06d29f255d1d67e95b003f79974e0

SHA256
f4d8ca6baa4b86cdda6245b0e2f38f66705c9d700faec5929159917ca7ac8223

SHA512
1c654a396575b684d6186e04110ab5d954567a8c8da25cfd21eb8761727991c364f0afd9a67f90c007a0f769d49bab87e015dcf9599ede20a634af70d6dbb9a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d428bf486d028e3f96d78a026897a04

SHA1
7397d0dfb898b453a4d2825818f28011901ead42

SHA256
1624036e39e23bd01baafbd4bf212d97350e3dc5f23defae5282f1e50225f30c

SHA512
18935dde587ffe5b784572458f3115155e9bf5e1e8a2922ef2a2f8e43d2ca6f3ea22f783430b792693e506bb606f4df2027bd2a8b580168c2feeece69295afcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae824a426f28919fd7be615408e5d1c4

SHA1
bf1c72bd9224d5c3c9d77f3017692c80a1ce6680

SHA256
5d8b00fbc2a8ec4d1e7371944eae9cff8e0fdc831ad75aff3f52e057d2e2cfa9

SHA512
5e3808a4373411044b4029adca2e91ef1647b375149c59635e98d6b52ab427845acee69d4825110b8ffc8da3bcd2998d36d437e6907bdaed41cea715b97baf30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e331faefa08e9bb890f6b1493a80f5bb

SHA1
b96bf6d7189d48b9600b9cdc5322cf8becb0ffa8

SHA256
96613feba3e4d1ed4d7da4172966bbe12b9a5b0065a6961d0c1ca4d018d593b8

SHA512
8b9bb3345c16d86b5de7a89acddaebd9ab6467a8a80638fa72af49dd37cfb5bc211a4411696142cf15c1408e35b0c1ea647390c3e05640ea1cd14a24c1b928b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c500637ce93531e7f1bfbffeb0f34e92

SHA1
7c0637e01dec1fff0c82d012ce6673de0398adca

SHA256
200f26013a126926431a8a2d6107bf7a4fc9351186dc7ef41d3142f6793c25e5

SHA512
637b0c6b317c499ef0e5c0642693baa95f863dc2e3de692ea626421d59dac3552fba6a48209753c326d79f8e61312d7e856bb0925fc81a2defd4ef389cd01628

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a95a133e618eeda87c37cb0ac6370020

SHA1
dac9f343b02acc1ed2cc0db4fc3fc45cdaaeb0ce

SHA256
c78c79e89e28d2d033546360e274688cbd5e52b9af8dec322f44ad300d40bed6

SHA512
f0a440f385e2bacb41baa80b724e29eec4bdf4a73b9d918474adc56f8ce2d1fdef8be4449d3ba30c06a6988cd16deaccb3c04e846dc21fcfbd5546ae04848304

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11ddfee774637eb2b37e63fc091b9c01

SHA1
6d7d5d7578c14b3aad0e2d368870e0d783b260a4

SHA256
b9382caf7137acb5ce71e3b19852e33eb70bf1702685c93bc2463c06fb7b097a

SHA512
803aabd83072c11867c2a7d5c1d6fa7a8525947363b6c673b471a22b76bcd8de8ef4bb607396e77c649a52964f11f22e973a4a853bae396711bf31ed2df81249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddffe18f425570d4618c88198b3c4dae

SHA1
bb21c56b7b1314b2ef9a36cfb46d2b7ee19998d1

SHA256
bb8ca9f69ead0ff7df44c42402fafab659e6a35d095740648723f1dc8a248648

SHA512
ec237ad44fe5469c9544c66785fc3150d897f828ccdbe3c36e3ddaa30659e6b773ed96bf7b82c6cab012feade5606d18dda9d22ce5f4421d85024e03679e04cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e1a820238431802c0add91949996e4b

SHA1
52a8fa2095a9b133448210d616858de6efccba07

SHA256
b83b4dab4afbd6b6bdfa696bda62d90a8b9e847a92e6375a5e5d1ba4c0f85861

SHA512
8f12884a67306ad0132d71d2752dff0cbbff68e71204d07cb1e59bdf6223dd3c44434d864efb9f80ec88378842c5d082d695020748d135ca4459880bb4ac7d95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acff55a8afb93f07f3d7d695791a910f

SHA1
7ed3024c7334aa250176d1ee12890cf5f3a4d7bc

SHA256
57cce47a668a5b393a8f96f05e1c198ef163ff9f83c5638562deaa583872d92d

SHA512
b94e2b9df235fc7881912add66f70a8340760ee6d870dfe6d268027e59d01d88e49f785ca60798ff04d65644935799fe807147599b2222a47ff705a716e9b8c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
c3eb4f16f418bca1366136335c22632f

SHA1
f0bf12ceecb03f8aa468141e914b123c4d69fa2f

SHA256
afb7bda9da50b21c1813db2a6e300d7133fcee0c7fb16f48a7f2a08150e36b97

SHA512
fb6d9aa079df0f521a6991d8da1daee9f4af80967b830c7e2bfd9934c885563b6b18eaac0f717e7adbbc348440fadf08e5ff30db4d24cbe5c9776300222cb0e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A89I98IL\domain_profile[1].htm

Filesize
6KB

MD5
ed5afe78642f7c65e1d613ccb31d0a74

SHA1
88b1a1d076c91c08ae754bad4b92895ea94a802f

SHA256
a18b3d1750d74f23ca759a67c8582c9f1c2ee0ec4cddbd0f1730c6ffdcda2953

SHA512
72d06a24714b9dbe50c6fd32a6ef284483b651391326d4c991924643ff70a5b06e2a65f986ddb555e0cdd5b4c8260ed5d4cf2d4ed84234bd8aeb083bb8eceba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A89I98IL\styles__ltr[1].css

Filesize
55KB

MD5
eb4bc511f79f7a1573b45f5775b3a99b

SHA1
d910fb51ad7316aa54f055079374574698e74b35

SHA256
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

SHA512
ec9bdf1c91b6262b183fd23f640eac22016d1f42db631380676ed34b962e01badda91f9cbdfa189b42fe3182a992f1b95a7353af41e41b2d6e1dab17e87637a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E1CCB52I\api[1].js

Filesize
850B

MD5
3b2e99294f82f2ba64c2ca33c8b607e1

SHA1
991dabc70bbdc7e83b422f16044866e286bba07f

SHA256
5c233ff100be4a898501dd4838cca4ecf914eb5926cc287416793208eed9d151

SHA512
ce5f2e9e1caef7b744767386e8e10273703d6856590b6b8f812ee73fc4aaa53319f12b8c42ce087448ebf11766dd27ed8376786d741a8ebc37c24450a9545e67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E1CCB52I\reboot.min[1].css

Filesize
3KB

MD5
51b8b71098eeed2c55a4534e48579a16

SHA1
2ec1922d2bfaf67bf3ffabe43a11e3bf481dc5d7

SHA256
bd78e3bcc569d029e7c709144e4038dede4d92a143e77bc46e4f15913769758b

SHA512
2597223e603e095bf405998aacd8585f85e66de8d992a9078951dd85f462217305e215b4828188bf7840368d8116ed8fb5d95f3bfab00240b4a8ddab71ac760d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E1CCB52I\responsive[1].css

Filesize
66KB

MD5
781608aaede6e759fe48d7967b0a6c53

SHA1
bc595134b15c604ec6d42dded9f6d167d94084ac

SHA256
7371dd376a195424e3df2ee7877a045a2d60c307b3b3a119789c7160b7c21b92

SHA512
0eadd4bd38115eee3db9c62508143e7b93b5ff5fc5f8f05489af21c6499ccfc9e741d4de740e75ab933a32de2a1ca5cce7777a60b015ba53e503196e75bd0c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E1CCB52I\style[1].css

Filesize
165KB

MD5
65760e3b3b198746b7e73e4de28efea1

SHA1
1d1a2cce09b28cffc89378b0a60cbb1aa8a08c4f

SHA256
10e40ea3a2ad69c08d13e194cf13eb4a28a093c939758a17a6a775ef603ac4fc

SHA512
fbcb91f26b7bd874d6a6a3b1d4d6f7277ded091cdae5706c285b4d5d17446a1bf58572c224af38393ce49b310a51d5c5d60711c7094e5d32abbaaf10d1107e1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YV6H14B0\cf.errors[1].css

Filesize
23KB

MD5
a1cedc21f16b5a97114857154fab35e9

SHA1
95e9890a15a4f7f94f7f19d2c297e4b07503c526

SHA256
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b

SHA512
00e857331dce66901120b042a254e5af5135364f718da56110a4744f3e64f9b61ba0b877013af8398a0f865c7bde6ad2f87b3c9d2d828651806409cba57aa34e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YV6H14B0\jquery.min[1].js

Filesize
84KB

MD5
c9f5aeeca3ad37bf2aa006139b935f0a

SHA1
1055018c28ab41087ef9ccefe411606893dabea2

SHA256
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

SHA512
dcff2b5c2b8625d3593a7531ff4ddcd633939cc9f7acfeb79c18a9e6038fdaa99487960075502f159d44f902d965b0b5aed32b41bfa66a1dc07d85b5d5152b58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YV6H14B0\js[1].js

Filesize
188KB

MD5
f2ffc56c591307a97b46340e4efd5159

SHA1
3a55a6bb105f8131fded01a85e6e9961821c39b2

SHA256
ee59f94db32607503fc522768cb4005ee52027e4a4d34da06b6147af196b9035

SHA512
ce698a9987b91185a3441d3302d52afc4658b2d0c9ba711f406b4c6a2b8b6685c048dcef81cc7f8d274d3f47d95afad0b41b232d8fa9501898c17f55b83cd7bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YV6H14B0\recaptcha__en[1].js

Filesize
128KB

MD5
bccd4f0bba239ae7d7dfe22796002bb1

SHA1
1bad0f4cd12a64111974f139ee5dd9894e6861aa

SHA256
6c82bff669c9fa03a36651524f78a4844a0b220201615b459313d3440afc201c

SHA512
2cd1e55bb1edd18f51d36f99be4331b438a2c95b12c12198e577016e8ce50604330761590f9465e0b156df826d42520e8ff04640ebb9c5c515c67912d599f9e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YV6H14B0\script[1].js

Filesize
9KB

MD5
defee0a43f53c0bd24b5420db2325418

SHA1
55e3fdbced6fb04f1a2a664209f6117110b206f3

SHA256
c1f8e55b298dc653477b557d4d9ef04951b3b8ba8362a836c54e2db10cda4d09

SHA512
33d1a6753a32ec06dcfc07637e9654af9321fe9fa2590efc70893eb58c8603505f2be69084fb2bcbf929218c4e7df9f7a8bc3f17a5b41ed38c4d8645296ebab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8ECA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8EEC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
305KB

MD5
d261adf2f3e1664f22a8cd3aadb6ba7d

SHA1
7bdd466e44589fc429759ce3ecf930a30db5f6cd

SHA256
d712af913a23ad78e18df02d360290840b3a4bb88e117c3d9eeb21aa8e0a0da1

SHA512
bdcafd12edfe2b324c0ec866dfffac132bae7f77e63f8a98fb97448a2a253efa8344c371f69e83caf5761ad9ff80d5777adb20345336db048bcf6ae8815bfc8c

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
1.0MB

MD5
5ca0de97d42ea910381b8527612adab5

SHA1
923ea5a3367898223b6ef6fec311991d1596f3c7

SHA256
04c4176ba82afc4749e1ffefed306badc56caf687b102d2917606e7445393d76

SHA512
82daa9a14d74ed40f3403a7650f8e82aba02fa9191e53dc5ff1adf3f928092ed442a01c1623da147ff2f57f053f09910f35fdbadf7b2f8c8471b8ab6f5a83c5a

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe

Filesize
400KB

MD5
709fcb67b5a8e6aebcbe0113383740a9

SHA1
bfb979029b0849de31ecfc41ce36d66b25ece78c

SHA256
a1213e5c002d7c7fa52902280ae1ea6918cc42ce8bc4bf0132f1c8e3ee47fb92

SHA512
6f3988d675e3a42f674ce15365576d79751fe1caa67f00f6d5b3240d9b7ad3fb2c2a8eb40b6c0fb9b442af1267d071f10d9dc94496a87eb089aad82a3942a77f

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
681KB

MD5
33521760aee5d2fa174fdefe05bf6e70

SHA1
9872fbb4e8915fb0d7411f3093be5ce96ac56fa4

SHA256
12cea45f36eaf0cdd25962ce8fe6159619e4a17e443f47c28e72dd0586a79ca2

SHA512
8865c9dd081b1b099a7bb9224f2d756985285f6f88840f6b1578567cde64878ad4a88697643119bf863d2c3f9886548540465ffb6108d1f8661a8adeb370f863

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
879KB

MD5
ef3472006ad34398a01c32e0d57959c2

SHA1
fb1e3928e701bcd52b1681204a3be6c14fc6e84e

SHA256
adb9180d713b638671da9085d62567b8256ca3468d1cbc72811028f1f8c3b84d

SHA512
e16f3ca3acd9bf80dbdca0605171234773a412b2c8a3867e784bdbfb6772818d21a760d20f1e69afa83a0d3fb521831c6d2e166bc93e671d30d0a39054288888

Download Submit
memory/1384-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2880-130-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2880-69-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2880-73-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2880-72-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2880-137-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2880-139-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2880-2692-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2880-1494-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2880-76-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2880-2717-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download