ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe
Size

1.4MB
MD5

21ef66b35da57ca5d92b39de1c741f51
SHA1

2943ee9ad20ff5a3796cbe5ddb8f323a00edb042
SHA256

ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc
SHA512

a79e25bdaacf86edcd3df9174bd708bdfadf6eb61b13833fbc90838fd8b08ca9c7e98b603c3aa889ce426918709b68cce14c639de3e1dfe507cdd0bc08b67c13
SSDEEP

3072:iyf8n+BnNpiXN5U+M/hQuaCA3VMxDJAQO7LN:i/+BnNpCqP/hQuavirOH

Score

10^/10

defense_evasion discovery evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 14 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-70554750"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-57951861"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\E696D64614\winlogon.exe = "C:\\Users\\Admin\\E696D64614\\winlogon.exe:*:Enabled:@xpsp2res.dll,-28956246"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winlogon.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	winlogon.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\platin.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsscan40.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portmonitor.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkwctl9.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmnhdlr.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zatutorzauinst.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FirewallSettings.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsm32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\watchdog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navengnavex15.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\syshelp.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nupgrade.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panixk.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweepnet.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpupd.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\borg2.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gibe.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccpfw.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\syshelp.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2servic.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxquar.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clean.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfweng3.02d30.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ss3edit.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds-3.exe	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IELOWUTIL.EXE	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpupd.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccwin97.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pathping.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spf.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-98.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2Fix.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clamauto.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\claw95cf.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\css1631.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minilog.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmon.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fslaunch.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prckiller.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\efinet32.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navrunr.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcip10117_0.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clean.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\exantivirus-cnet.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-prot.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpftray.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navdx.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnt.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsched32.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccpxysvc.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fact.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwinst4.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjscan.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Filemon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lockdown.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navwnt.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msn.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pfwadmin.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleaner.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmgrdian.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cv.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrecon.exe\Debugger = "\"C:\\Users\\Admin\\E696D64614\\winlogon.exe\""	winlogon.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe	winlogon.exe

Executes dropped EXE 3 IoCs

pid	Process
1596	winlogon.exe
1564	winlogon.exe
2624	winlogon.exe

Loads dropped DLL 3 IoCs

pid	Process
2228	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe
2228	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe
1596	winlogon.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1"	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\E50B29BAACAA360FCC344254F83743208BA6735D23877EED = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B9373D14A02BC13F1345A3F7BC53B8BCC98D3B04DD0CD9CF = "C:\\Users\\Admin\\E696D64614\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Indicator Removal: Clear Persistence 1 TTPs 42 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOSYNC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ACCICONS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLVIEW.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCEL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IE4UINIT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IELOWUTIL.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSFEEDSSYNC.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOHTMED.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORDB.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\POWERPNT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANOST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SELFCERT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINWORD.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DW20.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GRAPH.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTEM.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEUNATT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSACCESS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSHTA.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSPUB.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSTORE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OIS.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CNFNOT32.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXTEXPORT.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\INFOPATH.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSQRY32.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONENOTE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANPST.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPREVIEW.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DWTRIG20.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GROOVE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEXPLORE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONELEV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETLANG.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCELCNV.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GOOGLEUPDATE.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOXMLED.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OUTLOOK.EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WORDCONV .EXE	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WXP.EXE	winlogon.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2504 set thread context of 2228	2504	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe	31
PID 1596 set thread context of 1564	1596	winlogon.exe	34
PID 1564 set thread context of 2624	1564	winlogon.exe	37

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2228-13-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2228-12-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2228-11-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2228-8-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2228-4-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2228-2-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2228-27-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2624-55-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2624-52-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2624-51-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2624-50-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2624-47-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1564-199-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2624-630-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1564-681-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2624-682-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2624-731-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2624-775-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2624-795-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2624-824-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2624-1288-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2624-1330-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2624-1352-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2624-1356-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2624-3238-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2624-3300-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2624-3353-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Sound	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Sound\Beep = "no"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 55 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000e4eea66921067d2cb8e8b909f1fdf287e0540672357fac5c961a6654e1ca9ea2000000000e800000000200002000000040e0bcce8b8ed22a6518d76ed9b4e50ebc104e046755d5c163aa1473fa97eaa520000000bab18c36433146260d38599f564485b1e6a7fa955b678f6db6216f0b5e64fe29400000002faf963e31dd22dfcda6beec5b249841f3c3cafaed1e3331289371a49175f6ad9ab26bc1e4328fbd06dc5ecaf6ad6447e6a5767d49fdea043791ae39918573ca	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D1DD5F1-86B3-11EF-8252-C28ADB222BBA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://p1b7b7s21fe0796.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://h2r3661g9n0083c.directorio-w.com"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434690960"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://b62vp092das4919.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://98c7ft6tu87i010.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Download	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://fjwl2xs9hzqssuv.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 105e5340c01adb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000937e3abb9140824cfccde042640d3e3fe4f2e7f803963cd8be05e532a676b8a8000000000e8000000002000020000000798f5d9f242bfad193e2e204c29ae4c9c11d305e77f845d46c366a6d8f4a22ad900000000270631bb5fa9f288158764df31f5a6ea4f3c280ba32bb67ad5709863b9e7c038c0d78c2569d5cc3adb07680868c07891f1a80ed5719268bfb58df132a7b6e006a1521d653beb5e1d4b80235a02732df2f97e60b57e281994ed86c19a315c00681ab582eab076a872f33ec6b813761b37f41d5d1397b977ed4fe7ac7793ddc8c265d31c777df15d378941b327a6f1e0040000000c004ffbb70e309cc5d46eb454341869076a17f390f971d0f71888325fb90c9214964ab44d5f28e0279c2fa6fd8c1c2073a82c81a36e23ccd08805a9b29412654	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://9qp14a180rq4aud.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://5892j5pllq1929g.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://47bh46e38s699u0.directorio-w.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes"	winlogon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://bvj8cdw1b4wdes8.directorio-w.com"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://bw9f8n29g6y9kav.directorio-w.com"	winlogon.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2624	winlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	2624	winlogon.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2996	iexplore.exe
2996	iexplore.exe
2996	iexplore.exe
2996	iexplore.exe
2996	iexplore.exe
2996	iexplore.exe
2996	iexplore.exe
2996	iexplore.exe
2996	iexplore.exe
2996	iexplore.exe

Suspicious use of SetWindowsHookEx 45 IoCs

pid	Process
2228	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe
1564	winlogon.exe
2624	winlogon.exe
2996	iexplore.exe
2996	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2996	iexplore.exe
2996	iexplore.exe
1428	IEXPLORE.EXE
1428	IEXPLORE.EXE
2996	iexplore.exe
2996	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2996	iexplore.exe
2996	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2996	iexplore.exe
2996	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2996	iexplore.exe
2996	iexplore.exe
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE
2996	iexplore.exe
2996	iexplore.exe
1428	IEXPLORE.EXE
1428	IEXPLORE.EXE
2996	iexplore.exe
2996	iexplore.exe
1364	IEXPLORE.EXE
1364	IEXPLORE.EXE
2996	iexplore.exe
2996	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2996	iexplore.exe
2996	iexplore.exe
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2624	winlogon.exe
2624	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2460	2504	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe	30
PID 2504 wrote to memory of 2460	2504	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe	30
PID 2504 wrote to memory of 2460	2504	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe	30
PID 2504 wrote to memory of 2460	2504	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe	30
PID 2504 wrote to memory of 2228	2504	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe	31
PID 2504 wrote to memory of 2228	2504	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe	31
PID 2504 wrote to memory of 2228	2504	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe	31
PID 2504 wrote to memory of 2228	2504	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe	31
PID 2504 wrote to memory of 2228	2504	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe	31
PID 2504 wrote to memory of 2228	2504	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe	31
PID 2504 wrote to memory of 2228	2504	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe	31
PID 2504 wrote to memory of 2228	2504	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe	31
PID 2228 wrote to memory of 1596	2228	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe	32
PID 2228 wrote to memory of 1596	2228	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe	32
PID 2228 wrote to memory of 1596	2228	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe	32
PID 2228 wrote to memory of 1596	2228	ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe	32
PID 1596 wrote to memory of 2392	1596	winlogon.exe	33
PID 1596 wrote to memory of 2392	1596	winlogon.exe	33
PID 1596 wrote to memory of 2392	1596	winlogon.exe	33
PID 1596 wrote to memory of 2392	1596	winlogon.exe	33
PID 1596 wrote to memory of 1564	1596	winlogon.exe	34
PID 1596 wrote to memory of 1564	1596	winlogon.exe	34
PID 1596 wrote to memory of 1564	1596	winlogon.exe	34
PID 1596 wrote to memory of 1564	1596	winlogon.exe	34
PID 1596 wrote to memory of 1564	1596	winlogon.exe	34
PID 1596 wrote to memory of 1564	1596	winlogon.exe	34
PID 1596 wrote to memory of 1564	1596	winlogon.exe	34
PID 1596 wrote to memory of 1564	1596	winlogon.exe	34
PID 1564 wrote to memory of 2624	1564	winlogon.exe	37
PID 1564 wrote to memory of 2624	1564	winlogon.exe	37
PID 1564 wrote to memory of 2624	1564	winlogon.exe	37
PID 1564 wrote to memory of 2624	1564	winlogon.exe	37
PID 1564 wrote to memory of 2624	1564	winlogon.exe	37
PID 1564 wrote to memory of 2624	1564	winlogon.exe	37
PID 1564 wrote to memory of 2624	1564	winlogon.exe	37
PID 1564 wrote to memory of 2624	1564	winlogon.exe	37
PID 1564 wrote to memory of 2624	1564	winlogon.exe	37
PID 2996 wrote to memory of 2688	2996	iexplore.exe	41
PID 2996 wrote to memory of 2688	2996	iexplore.exe	41
PID 2996 wrote to memory of 2688	2996	iexplore.exe	41
PID 2996 wrote to memory of 2688	2996	iexplore.exe	41
PID 2996 wrote to memory of 1428	2996	iexplore.exe	43
PID 2996 wrote to memory of 1428	2996	iexplore.exe	43
PID 2996 wrote to memory of 1428	2996	iexplore.exe	43
PID 2996 wrote to memory of 1428	2996	iexplore.exe	43
PID 2996 wrote to memory of 2916	2996	iexplore.exe	45
PID 2996 wrote to memory of 2916	2996	iexplore.exe	45
PID 2996 wrote to memory of 2916	2996	iexplore.exe	45
PID 2996 wrote to memory of 2916	2996	iexplore.exe	45
PID 2996 wrote to memory of 2500	2996	iexplore.exe	47
PID 2996 wrote to memory of 2500	2996	iexplore.exe	47
PID 2996 wrote to memory of 2500	2996	iexplore.exe	47
PID 2996 wrote to memory of 2500	2996	iexplore.exe	47
PID 2996 wrote to memory of 1616	2996	iexplore.exe	50
PID 2996 wrote to memory of 1616	2996	iexplore.exe	50
PID 2996 wrote to memory of 1616	2996	iexplore.exe	50
PID 2996 wrote to memory of 1616	2996	iexplore.exe	50
PID 2996 wrote to memory of 1364	2996	iexplore.exe	53
PID 2996 wrote to memory of 1364	2996	iexplore.exe	53
PID 2996 wrote to memory of 1364	2996	iexplore.exe	53
PID 2996 wrote to memory of 1364	2996	iexplore.exe	53
PID 2996 wrote to memory of 2852	2996	iexplore.exe	56
PID 2996 wrote to memory of 2852	2996	iexplore.exe	56
PID 2996 wrote to memory of 2852	2996	iexplore.exe	56

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe
"C:\Users\Admin\AppData\Local\Temp\ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\\svchost.exe
  2⤵
  PID:2460
- C:\Users\Admin\AppData\Local\Temp\ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\\svchost.exe
      4⤵
      PID:2392
  - - C:\Users\Admin\E696D64614\winlogon.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1564
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Modifies firewall policy service
        Modifies security service
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Windows security bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Event Triggered Execution: Image File Execution Options Injection
        Drops startup file
        Executes dropped EXE
        Windows security modification
        Adds Run key to start application
        Checks whether UAC is enabled
        Indicator Removal: Clear Persistence
        System Location Discovery: System Language Discovery
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2624

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1972

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:275473 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1428
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:209944 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:209961 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2500
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:734245 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1616
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:734261 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:2831382 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
34e3cbfd6bb6eb26b52af07f5b34774d

SHA1
53dc86ab1bd367626b4aaaf7f362e6622cc4cfd2

SHA256
2171f1435098d98883a480c19bae63569bc0da7b85a3523e3a92e7abdc0b2cab

SHA512
e94b7567f05489aeb4c09ae34076d360463eac2613d0491d8832ebae5b0c18569c5a733af142d3562d63bb58d67ceffb24e7efaf197334adcf676735694a6924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
2KB

MD5
900e4c01155c32f9f156bf3a37194429

SHA1
8c16159705a82268f9b701f0d21fdda7b8a48643

SHA256
d6b059feeb02420f9b15e5ac8c126fca51e2a8b7b0befabd5d554995614194b2

SHA512
aec0e2e26ea8edc96c2a322dd61f407227fc1817e26ccb0f22c953c306d98fca2492aa1dc7f28308a82e7d427b4930e9c4c76840914b289e18d007e63702e91f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
67e486b2f148a3fca863728242b6273e

SHA1
452a84c183d7ea5b7c015b597e94af8eef66d44a

SHA256
facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

SHA512
d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_78E9BA377D96268BAF8E57FEF7614CD5

Filesize
472B

MD5
92155dfdb177c14dc4e190ad352ce022

SHA1
1107308096edf7ca302f44693e5cbfb8972ae446

SHA256
1eb4f010d1a4f132b38e45c3541e4aed6472bbb32684839d866b27f642696900

SHA512
39b688a71d410d479924759b1a97adc50d4eae982979197de9384e51eeebc48a74f2edf9da775949dec10d5b9fce81bdb17afc805fe1003d7d4b80bf77a1933d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
2KB

MD5
2073caf8ca798b9f4f0f2e7f9f72d2b4

SHA1
9b0a0ae6fa4b58454a7c567d810cb9455cb45f50

SHA256
fe0237f6447a44321ff11cea62279732e22f5e95d5c44d699d343cd29a27d42c

SHA512
e0db8942686e342706d481a4ec01134bc4164817720ef9cc9f8ea3cc1cfaf639c24c7844f0b1f53310b7304b8c70880b7642034a8629491400de5971dfbcad70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
25ff634eb97adfe2c83100387a6b86d6

SHA1
e962c3017fe2fc6fa987ec8aeb00144dec6d11ef

SHA256
587d0a2cff2a0659b927b4f4642a8cb83b42d3f4b76daa917495a34f9e1b1ece

SHA512
b6afb5877cec803366faffa0503e3a5f6e5339e2873daf04e5cbe3ccb5bbd54b6ca0196a5389233f411e8d3799af0aa41ecc25e3d90a244360d8052d2d72e725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
d4c46aae4c8f3647a39df5a6bf7da407

SHA1
8449bbeef6a7543c96e81a1c8cd39cbc99d6b2e9

SHA256
d0454211f01b6dcfc6915ed2bca40aa30fb3a9ba2a519ea05b2468eb286cd0d4

SHA512
febe43d120479ff9ba7ac2c98a387accb831fa07213d2240e980759d6a88d9c7e23591beb8d9d6362fddffb8123c01919ba4b93ab72f93286abb6c1ac51af703

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d1bb4b51086a4ffcbfdd9f6c293857f1

SHA1
383338b8cc6f27c4d854980b919c17d76b502973

SHA256
3ac0f65ca0953b4097126c3b48e57df484a30bcbc4f7a86154a124a78cf52cb6

SHA512
1dd4b5738b07edf5ee341f22285ebe1892532039974d49fb73957d09b5fabb764fb8e17020bdf482deb0d119003fa52648fc29c54d579979ba34e991232692be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
466B

MD5
64c8d88eb1308fe7bfe8fda33087f0bf

SHA1
f8fb52e8d15747c8de9758b383f31f60ef971e41

SHA256
18b6780fa6de3c13ea3553ccaa596cbb3e2eabf07c89ccd559c91614e39939b4

SHA512
7beee839cc761503cbe448ca90dc1e3ed5b619fd8f850f3bfbd19d8e2cbbffc24dcb0f7045cc6eb8e137a836f1de652dd4e85aa6e1a759fd43e176f089005f7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
386f9a8e069e755f913b76a55318c906

SHA1
68a70b5464da93b1913418b2e6d881e28c29b211

SHA256
7655d0bab1cab34f6b11f5165da06ee183b1e5ce2ccd0619cad53f5234cc86ed

SHA512
413bbfd61148f4be2356b141b5d3186b29212e87554d7b4d5ca20d297e72df7d8c04116acae7ff3444ecbea28feedbcfbffc5e99dafdb83fdccaa81507eaf9ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31686863ddc8e4fc54c11a6fc8668680

SHA1
76080d6e9ac001dd3357645dd3ebfe0c1fba5438

SHA256
1df15fe596846357720c1237f6c5d233b09cf298b861f3c6219b594955b20018

SHA512
600f1f961d180267f8a6ae1913c5987b202a9338618a11e9669b9cc2bc61087ff6d8b66b5c5af5f6f21bca92ea8e7049fab202073e86059f8b1cddd452541c7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0389240d75b5cce2dbb11371c1ae78ac

SHA1
3b40f1ae4c6c06f536bc2ba23a8d93d8151058e7

SHA256
d5f1e9014502c3d72b66907fdf5dc195979d3b22949fa40d6e0a7ff311407312

SHA512
75ce84966cd3a7d2afe643b1480fc3a438524092d1af1b8c96c922f2f5536808e81a782cd3f25215544a7978c181ceef8e1a2406d8a6af0b91428e7d571333e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19b0e068a3fdff4b515e31ecd46f30c5

SHA1
6644e04d25ff0d4116ef9ce98f1dfca802217101

SHA256
84a83dffa4fad05d31e3ac5076deb347219776d1ab193bc4abfc746dffbed076

SHA512
3cc08dda871a5a76be76af7b4c369f85a0e6396735a102db454370175dffd808364e21cd7871b9e6ad0e2febdb5cd686f4bf78466ff21814029c1f76fab205fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ee503ddbed85d62784b2138ae44a727

SHA1
2455848f79b771f64efc2e7af786824ec709fc1c

SHA256
bcb9f5f7759eef5f6cc7472a0dfec2c74915d0d503100baaa7aaeb15bb723435

SHA512
23a03e5b707cbacddc071b4fc0dc4692d3d64e05f10e39bd05829d534b62281f2a15f0535049f9a40945f089558a848d05785ccab9fe4af99a0266ade2cb63ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3dfdc6c1403ff00e356d3e465133772

SHA1
be8dfe69480dcaf5c5288b4327885d14e7306848

SHA256
1e56d4a78984eb18856f971727c611157ee673c674e51eb8b90efe77452fc22a

SHA512
e05f238ab4ee6a84541fcd2bc15301d03cf28c6369f9dfce6b93fe5dc1a59667c5596d95070614ede5f2238cfe6bf466187e0f6ff899f5a53f413c4d2ac2857e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d77bcc828d44e393d7a700b976590072

SHA1
70ae4e93044bc5d6597f30648286f7ddd4a2ce71

SHA256
a2fc7f569186de23a2e6288b49c4ccdeb170d759ae580f2c4bd31f310f9a696b

SHA512
43029e574d050fac022724ad06899d41bbe2aaf48438f2d18c090475d68988d69c646f4a652a42b2bb4ebcecb16423525aa5b8ecf66fe098fb0fce31cf1eb6f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3884e54680f731555b422319972b5271

SHA1
2603917ba392935e1935744b67a6937e32ca32b9

SHA256
f637ec79c874e4774053da319ef87e55ca416a74cc28fdf0c459629c6cd3eae3

SHA512
bf0d49415c4c486dff26c1d32b3874094f0034f4e979845108db964420c5f8d5374f9bcfc27e142514a04b482722596bbadc69813757522874c79e07e3c8fbee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7404fe7ec6aef46ba1404008c6857ec0

SHA1
3f99dd07e98995546456efe75bf6aa096078d6fa

SHA256
5f1f3bd53bbf372b3afebc08ac8b6f73d7217a522a4fc345f13a209e405cb426

SHA512
dd51e877474435ba90a9eb1dc68c330a49ace50904c59debee9ffed95f8ddc9a400dff29c91a1c490320e11a9bfa54d831fc1244b66ba16b556f1baec6eab020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13855230e206d9bba568c4b4ed195e53

SHA1
73fd0a1c03995c987f59f77e878d7ff07e870234

SHA256
c5569a9171496fdecd477065f2b35ac2f1a2f7017db0bffed0238941c4754ce8

SHA512
37e958e5fb64b6d037743dbf461c3be6eb5d6b632ce6a65d030868cc2de120db5143d0d5e81bad094d6d6dd833d77fa8b36cd34fed12f1f6c69d1bb1724f868b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
940826a891c9cd14d693a61a44ef835c

SHA1
b3358cdd6ff95cf0f48f0a4e67c5743c2cb356d5

SHA256
a582b58d02d11b5f0d56d195597ae25630969a4dbcd471d7b9ed99f90700271a

SHA512
47f91bcf1912d349b4ad749ed52fec26dd7a706ba920dc470f6a6c8f1138e0f5a970f0a6bab0cf92f758ac63464f27afdbbe5c40ee6cb37339432292e066ed13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d8a4390eeb484eb87fc76f1772c6167

SHA1
85f575dd9765241a0dd36b868a4bf96ac16769a9

SHA256
452b95e8c6d0159c35494734a310187062a412751261b12a0198684920a98732

SHA512
3ec641ac1e403afe76ebc2f1401454cb58cd09f986a18bdc4d49af4b439333862ebf92435c1960dd6d55e0b268581c950280911d7e8bb2c42e91de9c3b5e8590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84e0a4d5b7e90fe9889716bce5ce5725

SHA1
44bc36008137585053fcf6513225b3233fc44bca

SHA256
8120af70f4e594c85edae9f0130ecece50b5a9c4315c70415f3eb8e252969fc6

SHA512
6ff9c349355b2e2a58600369085dc1dbb8a757e140bbeac3a174897c0493cc88c6e69e5ec8bf0e4319bc915888f2b438638dce4862f9a4711d644558889064c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d54681fc920707f5b589dd5c937ec827

SHA1
80d0f6995f33c77d0e142715aaac382b22efa991

SHA256
360176c9a47b254e111b764b2bbdfb3bb08f1bc2541e581d312d22660fa22f97

SHA512
d64a2a407387cebc92610fd67c71916573c139bdca978b19cafff3f2376f3123ae6ca581accf6511885c3a6ca389352958fc999bafce9cab02d53d69c2192a98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85dc5cd4011d8a84cb47fcce79897ce7

SHA1
90fb647b5006d14acb082e5cbd719881a3ff8248

SHA256
ddda6ea95255b1d93553fa0a5609305daa174daeb0222cf0210f1031d31129c8

SHA512
db655fa2b57977676a164f5ff8f068690a3986fd561eabac9967fa0da17d2063be11bd03e3fda963ce845b6e05cca1ded2391e78e383827554b9bff5e16eff16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6655f3e125faf5f40ef337fad4b8a69

SHA1
699cd19aa3a9d2a8aa3cea61df5d3c083d075134

SHA256
8c220865f929039c4b3cf5b95d210efcb89581125431ece3bdc9198f5c7bfd15

SHA512
008a9f5aec69b15e0b4a3674477402f7a9f2c301a55c507331e8347e92990b15ebfe74f55e8b7c0eeca3d388f462f921572b480a4704bd9ff688e796c363dfe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f034a31e12ed5f71091ae0483ea2de5

SHA1
c57fbabde21268ef11b3088099dfe863b5d74b50

SHA256
43a29d62d968060302cfbe6b20f7cab73ab24cb4d38c0b622d626753d68254db

SHA512
fd0da19a86c937772c39b77c139b0a5f0fc31453256a56105ef3a7f944024f75b249751cfb2a4dc1391ac859fbeb20aa0da2a48bc854889faedd5fdc989a5182

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6db26d94368ab4947cbf3959ea8c71de

SHA1
7c2da853a868b995b1986e3ca667e4ec11834783

SHA256
682f4b6232c40abe7d304ab88dbe9d370320d2ca2a32b547932e9e982e520778

SHA512
f291ffcfb1b6e6de48c3a4d59d269345cdf0b31975b19d49dfe155170cb58d798dbbc84f479278bb2823b5437048700d46193f788854d566116cd90f63356d49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dbd7ff31f3215e5f4c8bfed319d3f0a

SHA1
63ac354833daf4e811fb9055d28e7a2b0b055a09

SHA256
38d5665fb4e8c0a768a08fa9cce322943932161f1a9a765d812fcfc7b835d7fe

SHA512
22a265b0c62fab3292170c64d9dc5c91e4d6ef58dacb3b89b0928299785ca627b7d80c7ff67638cd92b095edf7f11832383072499aaf8c3ad3324adf0bf4a9e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d6451a9b6c7cf579b99f73a3162b0e7

SHA1
fbca3f60b84be28e1c3e0fb5c160a460824078b5

SHA256
41c50205f7bb9aa59ca6ca25f137d618f2542ce90797bf4e105363ef91395670

SHA512
a1ce4143dd6824d17fe71271740f3e95751a04f354df874c86ad5248f151d95e039917fbe7d162a30ac86e349a85c5e7cf9e38ca7b0f42f54db15307253cde48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c3c50f5327757641029e54b8fce9e1b

SHA1
ad46737c8d510fc4fb92132627016f69d3a443ce

SHA256
5c451a4217116e3da35192cb45a1b44fecd899db40f0e5eb011a57dc94c176b5

SHA512
6e123543e4633a26df59caeb5dd8cdabb8c35ddc1c0f106cc057837acd3f7fd193432fd1c8cb520dd31c566369ad8fd38e22b1581fd2a419bafe60f50db4f4c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f097a99bf052791b48d15761d8a81ee

SHA1
c07ccea9dd0bd6ca32e9115a84435923fc203f3b

SHA256
c0a60c025957d20292914e4d7d6c03a84883cb9c170b7fe66f077472f55b95a5

SHA512
cb4ecf339e807683b15076abf97eabc0a9c30bf5b82fa25bce9e0cecb80e057965869bbb15fa6c6904756199c90e6b09bbbe95532d5a18078ce4b20a9d3f1379

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a8cadf8096d0c4bf241efb725cfedf5

SHA1
af3c388dbd3abac60246513ff4930bc3f2fbe994

SHA256
afbe3d6c76c3591dfdf36fb35eed1581f264d2daf7a9a2e551ff0f5928a373f1

SHA512
e0fc9c250a820c09c8d262f6418c9c36d0d25eda77f54c284704a89496fb2c8413f03f9f56f0089288be587c2a37475955b8bfcf67dc43cf4c3bbc07ba9e3abd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0dccc1ce356ab15ae972323a70f56e24

SHA1
4a106f62b6effc5fcdc0e0938410fdadc54fb9be

SHA256
81cb383ce19a1cd6d7ff9cb7c0485032cfa3dec4421195cbc9d28a4ec7189f15

SHA512
fcafc350b32174ef36b50653756aaaa1d6101a39a9799d0483450d3bd42f9f4825f6987d271560ff67f5a61efafcaef6d1ad852690e97a026e27ed9124e83d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b552309dd12c571a4d83b3a272f6c1b

SHA1
59d89abea49adbe201ecf47e6d66d38457219afe

SHA256
dd72e73eb196fbc059c222b9bd9172d55a9dde5b4c08d05ab5df72f12222ae48

SHA512
67801f89badd5e0beeafa418d81069b1a5bc7fa8e743e9c9190b4dcf14cd06e091e93ca6dd1376b5a68a83f12a824ea86e2d05d7aa8c28819bf07c3b45504535

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c253b179600e56ea11166bda6e1d9ff

SHA1
b18ee49c41102909fbaf2e156cab19459179fca5

SHA256
e4a55cc0eba0bf6efbc1e7ab3addd25cb444dbc1486f3778b028b764650f69cb

SHA512
546c3b7485e4c81f14818dce062e6259fcc3ad09e42bcf465f4177f659bc70b2b87a5020b82d2a4fb6ff9fc504925e50538c666070fdcc25e6ef9c62c5fc657a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
588ff79af0e43899aeb82ca117f24082

SHA1
08b51c37825f2bbe5f84078d1da2942013d9f366

SHA256
84bc7a95e573a42f8f6c639db40da028b3137d35f847b104d7930b2776890836

SHA512
961183f3b90e5da29b5e21d20811cf3186ad3a9be7868730a1fd00230d5e75b72d7bf91e80eea969cc3ef1d78590be9895ace8338b4708655534fd86f895c7bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_78E9BA377D96268BAF8E57FEF7614CD5

Filesize
398B

MD5
093ed0c4737792b42e040b0fcb7fc09d

SHA1
1e1700b1cf8298ebd158b8093735c67399cd20ad

SHA256
c38d6543c37ebfb9b4dfc990d0f323bbb91f1d5fc84980b0a520f0cd771fcf1a

SHA512
76771a3d690bf910dbc088db3de3f1974a3dfda2a86bab67beddd77197319feb43e77914f5e7e5afe322b83936cfa341e6045f7957566d8548021f57b9dede3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
11ad94a23b73a8f67675f5415fa71fad

SHA1
7fd1ca8940f96f3dd0e46ec70b5dabd8668b7c05

SHA256
f1caec5d347bee1165f31a10f497483ec4ff4352167f5049514ab621e8772ddb

SHA512
bc0b9af771ef6081ec87b6171be766ae7dc7f600713ee2c1399e45209caf90730dcb75f9420b1e1e7a25db2ad293a4cfb372caae116fe76e982eea80da453ef1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
470B

MD5
939faa0bdb0a1993abe51ce088247a8f

SHA1
5bd4d5245a47b56da2b492ed8d10c3c122464307

SHA256
a8ddd80ed10737d285f02042db990cb3902a14ae169ec9147d546662a1fd7a7d

SHA512
6e3270232f56abff3c57fea4d152c105af5e63205d4ed87822a0f22e227d66150c194b7623e9208165c42d4f2ef131d19157c16c8c3ad2f2dd25e22f679df062

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
20fbfd9e2a7a2bccb4ed075340a48194

SHA1
03633866bf2d4c2fdd1601188ac83283c55dbec4

SHA256
e1ade0bcf351cbf8128b29fadb8d9f0c954908cefc1c4a8e87ebcd0e0b7630ae

SHA512
36855b75fed36ed76cb989dc2181f4b91e768cbe6868b81b2f09b1826a64e48670f53b4d72741fc651bca499c9253befe3647d95b73b5fa77977fa499700553e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V\errorPageStrings[1]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4648X1K\caf[1].js

Filesize
149KB

MD5
a5a2b7a4925a4fba78e1867a7396f152

SHA1
20426f78929acd7c21da0a1432bb1710563ab780

SHA256
cb573d3a327ce2b3928542e59d5c54ef9e05cf7e5a20d7453cf520f3ae8a7fa0

SHA512
0b46397c1b7d7ff4a877394c4f262ee91fc941ce53b8e3840bf19c27591e621c9d14b6ea271288d205211e08f4e484b47e3cfe964bc6a266c53c2e35f47c5f35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4648X1K\main.36e19f48[1].js

Filesize
674KB

MD5
449b102f3891baa1b7e19c676a443066

SHA1
09fc9b6b47f792e96339121fe61a7b1c53c8481e

SHA256
81a5900839e1bb0d7504909e489997d1dac54fd473face4168d9377d73cfa46f

SHA512
06162c2a757dab2dc244e22d1f022f2f65e6fb9cac72b2bbf5a7e266ac80a1392ea04c9651fd6a3535d22c59410588659331f869e56aff395cf72f3ef1321610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4648X1K\tag[1].js

Filesize
58KB

MD5
8ea06c1bae2a3c44dbeb66eeaf353fd9

SHA1
6fabee7ec09dbade4dea5554697100bb04f0cfe5

SHA256
056f06e47cf08a51513dc6f631186dc7a75a5df05ab659adfdc00c703ce71307

SHA512
ef0358c071b5489a1f0e8b39e0be9fce84d4e513338632a13afddc255344fb94d2e5ea34af06e0924956be589c928d5c76d44bc08520f205c3d7474b04d6f0c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROLMKJ86\httpErrorPagesScripts[1]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROLMKJ86\main.ef90a627[1].css

Filesize
3KB

MD5
3f821ada778691e677aef2cea8c4b4f6

SHA1
643e7b729b25c2f800469623191dc837798e9d50

SHA256
7510035d553a99fbf93eb67737b2df057ce096fa1ed7aad83cfd559e11f2320d

SHA512
8993a8ad28ed4035a022d1b7274c77a97b8235b2ddcd5e6d29f7230d375851539900d4ace652c94c4be8a8284ffd86501df420385a6e680df4222c162deff4d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5\ErrorPageTemplate[1]

Filesize
2KB

MD5
f4fe1cb77e758e1ba56b8a8ec20417c5

SHA1
f4eda06901edb98633a686b11d02f4925f827bf0

SHA256
8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f

SHA512
62514ab345b6648c5442200a8e9530dfb88a0355e262069e0a694289c39a4a1c06c6143e5961074bfac219949102a416c09733f24e8468984b96843dc222b436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5\Z8EQK09Z.htm

Filesize
220B

MD5
c5083769c6067a761d7cedf3d3b226cd

SHA1
464fa6f1b76ce965de579ed4737a25d053aab531

SHA256
96c73c6a17e768390e3d393a8cfe0c53c26a5ea46e0ae66a813487a0d558c712

SHA512
c710d7a9364cc69531d87391a08998c7e71384ccbcb359db9534f73269155e09317ced2061a0e0d5e24ad61f6bee2b25f3629920bd42d134a097c6037c7bda78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5\caf[1].js

Filesize
150KB

MD5
fb7c0a0cef9c32a71ed056fc2a69b17e

SHA1
0f564743cba5be57b330c22969ac790d6dbc1630

SHA256
d3c8f0477fed890236ffbe7ff296705c3ed37ac5bfbe4d088114f37925c486dd

SHA512
75bffc0a12303802d95d735d9fce138ee7b89991daafa41adb74c9da99da05ac9e697dcb7b4214ff2f3f43262072fe9f8ec765eb2cdb7bb6f107e5919779f8d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5\http_404_webOC[1]

Filesize
6KB

MD5
92ab50175c4b03970f264c637c78febe

SHA1
b00fbe1169da972ba4a4a84871af9eca7479000a

SHA256
3926c545ae82fc264c98d6c229a8a0999e2b59ed2bb736f1bda9e2f89e0eeac8

SHA512
3311f118963ad1eaf1b9c7fb10b67280aae1ab38358aed77c10f2587100427af58c7d008abb46ad0f59880ac51e50b5a53fc2c2a96d70f5ece4578ab72382b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5\lander[1].htm

Filesize
620B

MD5
b90de8db327e4bbd8578971715c20f6b

SHA1
4a86f6e7979314934775d934d6f00e96a3ca3418

SHA256
5e082d46aa366a8e97c98d5ea3bd3811ffd29373698ec0d22bfc5ebd79721f9b

SHA512
7abf7059fd439c388998dd00bc8093e39fe42bdd05c7a5ed8c0001903ce071bed47f9db649be9d27e657130b59739d63c8f905d1df5f4be6ebce1afb55ed333c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD57A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD619.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms

Filesize
3KB

MD5
04b1e73d3d0f7364638910ea5fd89e57

SHA1
aa5dfbd15a26a26e380cc6bcc2c2461e60154837

SHA256
eaaf0bfe74827e1c86618e81cff689e84e79e4ca08454a1713c2db333a18f4b1

SHA512
c1ca9e0644ee68b9459c41f3529c76871ec038d93d869c87705f4afc4e07c10340a81b66df69b8efe8dbc25a1e653ae2cfa2b10645aa5684581c720a449a9e87

Download Submit
\Users\Admin\E696D64614\winlogon.exe

Filesize
1.4MB

MD5
21ef66b35da57ca5d92b39de1c741f51

SHA1
2943ee9ad20ff5a3796cbe5ddb8f323a00edb042

SHA256
ed394bbed813e66e1222a28194b57d4c7e620c2e44e2d3177b871df4aaa075fc

SHA512
a79e25bdaacf86edcd3df9174bd708bdfadf6eb61b13833fbc90838fd8b08ca9c7e98b603c3aa889ce426918709b68cce14c639de3e1dfe507cdd0bc08b67c13

Download Submit
memory/1564-199-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1564-681-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1596-40-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2228-8-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2228-4-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2228-11-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2228-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2228-12-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2228-27-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2228-13-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2228-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2228-2-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2504-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2624-51-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-1356-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-1288-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-50-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-731-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-52-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-824-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-1330-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-1352-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-47-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-55-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-1381-0x00000000045B0000-0x0000000005612000-memory.dmp

Filesize
16.4MB

Download
memory/2624-3238-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-795-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-682-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-775-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-3300-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-630-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-3353-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download