28ca1fb4d6dc4e583f6170ce4b873a0b9d4eaa2af0d188503bd480d270d384ac

Analysis

max time kernel
42s
max time network
44s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2023 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Injector.exe
Size

288KB
MD5

f2920ef418cf74b3603f9729b5ed0f30
SHA1

ce803090d9acb75843c96be7264eea927623f0ea
SHA256

28ca1fb4d6dc4e583f6170ce4b873a0b9d4eaa2af0d188503bd480d270d384ac
SHA512

4556832f617dbf5e560a12e2061d30003e8f82b9bdb047004068f5676f64da677cb9fa108a0d4fa3cfcef727e2f58beba6e9790ca346ba2233d8ca501566e237
SSDEEP

6144:vTIL8ouxrGLc9v5ei1f/VlCnU17py8IeGw+VOFIInwm9FB6:vTecmc2M/UU1FlU10FA

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Control Panel\International\Geo\Nation	Injector.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Control Panel\International\Geo\Nation	winlogon.exe

Executes dropped EXE 11 IoCs

pid	Process
1168	csrss.exe
320	dllhost.exe
4592	lsass.exe
4536	wininit.exe
2564	winlogon.exe
1236	ctfmon.exe
2816	lsass.exe
3136	dllhost.exe
3272	wininit.exe
3948	ctfmon.exe
4604	winlogon.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000023135-142.dat	upx
behavioral1/files/0x0009000000023135-150.dat	upx
behavioral1/files/0x0009000000023135-176.dat	upx
behavioral1/memory/1168-225-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1168-231-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
32	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
524	schtasks.exe
2732	schtasks.exe
3928	schtasks.exe
3272	schtasks.exe
3024	schtasks.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
4996	timeout.exe
4552	timeout.exe
792	timeout.exe
1248	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1008	tasklist.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
456	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3612	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
320	dllhost.exe
320	dllhost.exe
4536	wininit.exe
4536	wininit.exe
4592	lsass.exe
4592	lsass.exe
1236	ctfmon.exe
1236	ctfmon.exe
2564	winlogon.exe
2564	winlogon.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4888	Injector.exe
Token: SeDebugPrivilege	4592	lsass.exe
Token: SeDebugPrivilege	4536	wininit.exe
Token: SeDebugPrivilege	2564	winlogon.exe
Token: SeDebugPrivilege	320	dllhost.exe
Token: SeDebugPrivilege	1236	ctfmon.exe
Token: SeDebugPrivilege	4592	lsass.exe
Token: SeDebugPrivilege	320	dllhost.exe
Token: SeDebugPrivilege	4536	wininit.exe
Token: SeDebugPrivilege	1236	ctfmon.exe
Token: SeDebugPrivilege	2564	winlogon.exe
Token: SeDebugPrivilege	1008	tasklist.exe
Token: SeDebugPrivilege	456	taskkill.exe
Token: SeDebugPrivilege	2816	lsass.exe
Token: SeDebugPrivilege	3136	dllhost.exe
Token: SeDebugPrivilege	3272	wininit.exe
Token: SeDebugPrivilege	4604	winlogon.exe
Token: SeDebugPrivilege	3948	ctfmon.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
320	dllhost.exe
4536	wininit.exe
4592	lsass.exe
1236	ctfmon.exe
2564	winlogon.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 1168	4888	Injector.exe	87
PID 4888 wrote to memory of 1168	4888	Injector.exe	87
PID 4888 wrote to memory of 1168	4888	Injector.exe	87
PID 4888 wrote to memory of 320	4888	Injector.exe	88
PID 4888 wrote to memory of 320	4888	Injector.exe	88
PID 4888 wrote to memory of 4592	4888	Injector.exe	89
PID 4888 wrote to memory of 4592	4888	Injector.exe	89
PID 4888 wrote to memory of 4536	4888	Injector.exe	90
PID 4888 wrote to memory of 4536	4888	Injector.exe	90
PID 4888 wrote to memory of 2564	4888	Injector.exe	92
PID 4888 wrote to memory of 2564	4888	Injector.exe	92
PID 4888 wrote to memory of 1236	4888	Injector.exe	91
PID 4888 wrote to memory of 1236	4888	Injector.exe	91
PID 4888 wrote to memory of 3256	4888	Injector.exe	93
PID 4888 wrote to memory of 3256	4888	Injector.exe	93
PID 3256 wrote to memory of 4996	3256	cmd.exe	95
PID 3256 wrote to memory of 4996	3256	cmd.exe	95
PID 1168 wrote to memory of 4620	1168	csrss.exe	97
PID 1168 wrote to memory of 4620	1168	csrss.exe	97
PID 4620 wrote to memory of 3612	4620	cmd.exe	100
PID 4620 wrote to memory of 3612	4620	cmd.exe	100
PID 4620 wrote to memory of 4552	4620	cmd.exe	102
PID 4620 wrote to memory of 4552	4620	cmd.exe	102
PID 4620 wrote to memory of 792	4620	cmd.exe	103
PID 4620 wrote to memory of 792	4620	cmd.exe	103
PID 4592 wrote to memory of 524	4592	lsass.exe	106
PID 4592 wrote to memory of 524	4592	lsass.exe	106
PID 320 wrote to memory of 3928	320	dllhost.exe	109
PID 320 wrote to memory of 3928	320	dllhost.exe	109
PID 4536 wrote to memory of 3024	4536	wininit.exe	105
PID 4536 wrote to memory of 3024	4536	wininit.exe	105
PID 1236 wrote to memory of 2732	1236	ctfmon.exe	107
PID 1236 wrote to memory of 2732	1236	ctfmon.exe	107
PID 2564 wrote to memory of 3272	2564	winlogon.exe	113
PID 2564 wrote to memory of 3272	2564	winlogon.exe	113
PID 4620 wrote to memory of 1248	4620	cmd.exe	116
PID 4620 wrote to memory of 1248	4620	cmd.exe	116
PID 4620 wrote to memory of 1008	4620	cmd.exe	122
PID 4620 wrote to memory of 1008	4620	cmd.exe	122
PID 4620 wrote to memory of 456	4620	cmd.exe	123
PID 4620 wrote to memory of 456	4620	cmd.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Injector.exe
"C:\Users\Admin\AppData\Local\Temp\Injector.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Users\Admin\AppData\Local\Temp\csrss.exe
  "C:\Users\Admin\AppData\Local\Temp\csrss.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\807F.tmp\8080.tmp\8081.bat C:\Users\Admin\AppData\Local\Temp\csrss.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\system32\PING.EXE
      ping 8.8.8.8
      4⤵
      Runs ping.exe
      PID:3612
  - - C:\Windows\system32\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:4552
  - - C:\Windows\system32\timeout.exe
      timeout 9
      4⤵
      Delays execution with timeout.exe
      PID:792
  - - C:\Windows\system32\timeout.exe
      timeout 5
      4⤵
      Delays execution with timeout.exe
      PID:1248
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1008
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:456
- C:\Users\Admin\AppData\Local\dllhost.exe
  "C:\Users\Admin\AppData\Local\dllhost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "dllhost" /tr "C:\Users\Admin\AppData\Local\dllhost.exe"
    3⤵
    - Creates scheduled task(s)
    PID:3928
- C:\Users\Admin\AppData\Local\lsass.exe
  "C:\Users\Admin\AppData\Local\lsass.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "lsass" /tr "C:\Users\Admin\AppData\Local\lsass.exe"
    3⤵
    - Creates scheduled task(s)
    PID:524
- C:\Users\Admin\AppData\Local\wininit.exe
  "C:\Users\Admin\AppData\Local\wininit.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "wininit" /tr "C:\Users\Admin\AppData\Local\wininit.exe"
    3⤵
    - Creates scheduled task(s)
    PID:3024
- C:\Users\Public\ctfmon.exe
  "C:\Users\Public\ctfmon.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "ctfmon" /tr "C:\Users\Public\ctfmon.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2732
- C:\Users\Admin\AppData\Local\winlogon.exe
  "C:\Users\Admin\AppData\Local\winlogon.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "winlogon" /tr "C:\Users\Admin\AppData\Local\winlogon.exe"
    3⤵
    - Creates scheduled task(s)
    PID:3272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp808F.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4996

C:\Users\Admin\AppData\Local\lsass.exe
C:\Users\Admin\AppData\Local\lsass.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2816

C:\Users\Admin\AppData\Local\dllhost.exe
C:\Users\Admin\AppData\Local\dllhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Users\Admin\AppData\Local\wininit.exe
C:\Users\Admin\AppData\Local\wininit.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3272

C:\Users\Admin\AppData\Local\winlogon.exe
C:\Users\Admin\AppData\Local\winlogon.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4604

C:\Users\Public\ctfmon.exe
C:\Users\Public\ctfmon.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ctfmon.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Temp\807F.tmp\8080.tmp\8081.bat

Filesize
112B

MD5
35c08e166787c0f045a3d6289a4ef450

SHA1
ac10a70f11bd78b922d94023d550d3cb65842954

SHA256
9bb3e63ee8a1b25a41381577784345e0f5df67cd1d8539ae182f8b2f4c2d6bf8

SHA512
7ef7c3f82ce23eed00d396c16ea32e54e2cb4d1259b50201e56b0378daa97486f8eb01a4f780bee770a06dd4e92e4331e07e30dd5631b21db52428475d8f46aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss.exe

Filesize
45KB

MD5
a92e58e8cdd59fb7a5b5d4b7273dc691

SHA1
20aa3581a9ae014443007267a2a1811258d4f8ee

SHA256
5445e682c5aadc0bc0fcb626592848867167b33eca7c68fbb7f18169b2aaa69e

SHA512
7719c32f554310aa3c64ee562f98ad442977eb3d58cc2233f69bf2b872ca427d1098c10fd818881ab45a298e3a28c5dcf779fcf4ac9bf46e4a5bc8fb0381994a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss.exe

Filesize
45KB

MD5
a92e58e8cdd59fb7a5b5d4b7273dc691

SHA1
20aa3581a9ae014443007267a2a1811258d4f8ee

SHA256
5445e682c5aadc0bc0fcb626592848867167b33eca7c68fbb7f18169b2aaa69e

SHA512
7719c32f554310aa3c64ee562f98ad442977eb3d58cc2233f69bf2b872ca427d1098c10fd818881ab45a298e3a28c5dcf779fcf4ac9bf46e4a5bc8fb0381994a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss.exe

Filesize
45KB

MD5
a92e58e8cdd59fb7a5b5d4b7273dc691

SHA1
20aa3581a9ae014443007267a2a1811258d4f8ee

SHA256
5445e682c5aadc0bc0fcb626592848867167b33eca7c68fbb7f18169b2aaa69e

SHA512
7719c32f554310aa3c64ee562f98ad442977eb3d58cc2233f69bf2b872ca427d1098c10fd818881ab45a298e3a28c5dcf779fcf4ac9bf46e4a5bc8fb0381994a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp808F.tmp.bat

Filesize
160B

MD5
52fc7380fff6327e9f30e8e1e5eacefa

SHA1
dab9348a87eb6b1a96a3d8bae612815e9ca7c034

SHA256
3318e6bc4763112ce86ce1a0bdc42eac438bb095d77207e8fa3e5e44490b31e4

SHA512
77139ef7b4bea4c41a8fc4da31df491b1e18a15d7f250b2b4f9cc066074cba820c22b4b627ec76f0a4da46e4774e00f2d6a9e5f4d58cdd180d702704c0b06e2f

Download Submit
C:\Users\Admin\AppData\Local\dllhost.exe

Filesize
64KB

MD5
59b27010cb5627898bfa934d6442ac4c

SHA1
d9b8fad367b16fe60e4dd9a52e1f15a47b80efd7

SHA256
01cd0422ea3a7676714bf0e8cf68c611ea9a3bd6a26b02126a54dc7efb7ba753

SHA512
7c8da8728fe0f340f02efc96d9c3baa8881c5199fedb4ccfdb0adc1c554efea7cc6ae5e47a84a14981087f3660ebc5249cce10acaf2c8665df0491008b29fd6f

Download Submit
C:\Users\Admin\AppData\Local\dllhost.exe

Filesize
64KB

MD5
59b27010cb5627898bfa934d6442ac4c

SHA1
d9b8fad367b16fe60e4dd9a52e1f15a47b80efd7

SHA256
01cd0422ea3a7676714bf0e8cf68c611ea9a3bd6a26b02126a54dc7efb7ba753

SHA512
7c8da8728fe0f340f02efc96d9c3baa8881c5199fedb4ccfdb0adc1c554efea7cc6ae5e47a84a14981087f3660ebc5249cce10acaf2c8665df0491008b29fd6f

Download Submit
C:\Users\Admin\AppData\Local\dllhost.exe

Filesize
64KB

MD5
59b27010cb5627898bfa934d6442ac4c

SHA1
d9b8fad367b16fe60e4dd9a52e1f15a47b80efd7

SHA256
01cd0422ea3a7676714bf0e8cf68c611ea9a3bd6a26b02126a54dc7efb7ba753

SHA512
7c8da8728fe0f340f02efc96d9c3baa8881c5199fedb4ccfdb0adc1c554efea7cc6ae5e47a84a14981087f3660ebc5249cce10acaf2c8665df0491008b29fd6f

Download Submit
C:\Users\Admin\AppData\Local\dllhost.exe

Filesize
64KB

MD5
59b27010cb5627898bfa934d6442ac4c

SHA1
d9b8fad367b16fe60e4dd9a52e1f15a47b80efd7

SHA256
01cd0422ea3a7676714bf0e8cf68c611ea9a3bd6a26b02126a54dc7efb7ba753

SHA512
7c8da8728fe0f340f02efc96d9c3baa8881c5199fedb4ccfdb0adc1c554efea7cc6ae5e47a84a14981087f3660ebc5249cce10acaf2c8665df0491008b29fd6f

Download Submit
C:\Users\Admin\AppData\Local\lsass.exe

Filesize
58KB

MD5
bbdf0460782f4f4a2082914c5eee8938

SHA1
b7ce1dd4d1cb2c576dce6d976ae20c6b391455c9

SHA256
b2f2a0e633c622e5bdd4645476079119fdae7f1cf8746436a1c61376bcdb8528

SHA512
6e197c13e52e2b5db11e9021f304a6c117503574917c648fcb7037363822743ebef351ef50647e57bf90b2d5b7ea8662104f1d019f09aa791bd6ac02cfa82082

Download Submit
C:\Users\Admin\AppData\Local\lsass.exe

Filesize
58KB

MD5
bbdf0460782f4f4a2082914c5eee8938

SHA1
b7ce1dd4d1cb2c576dce6d976ae20c6b391455c9

SHA256
b2f2a0e633c622e5bdd4645476079119fdae7f1cf8746436a1c61376bcdb8528

SHA512
6e197c13e52e2b5db11e9021f304a6c117503574917c648fcb7037363822743ebef351ef50647e57bf90b2d5b7ea8662104f1d019f09aa791bd6ac02cfa82082

Download Submit
C:\Users\Admin\AppData\Local\lsass.exe

Filesize
58KB

MD5
bbdf0460782f4f4a2082914c5eee8938

SHA1
b7ce1dd4d1cb2c576dce6d976ae20c6b391455c9

SHA256
b2f2a0e633c622e5bdd4645476079119fdae7f1cf8746436a1c61376bcdb8528

SHA512
6e197c13e52e2b5db11e9021f304a6c117503574917c648fcb7037363822743ebef351ef50647e57bf90b2d5b7ea8662104f1d019f09aa791bd6ac02cfa82082

Download Submit
C:\Users\Admin\AppData\Local\lsass.exe

Filesize
58KB

MD5
bbdf0460782f4f4a2082914c5eee8938

SHA1
b7ce1dd4d1cb2c576dce6d976ae20c6b391455c9

SHA256
b2f2a0e633c622e5bdd4645476079119fdae7f1cf8746436a1c61376bcdb8528

SHA512
6e197c13e52e2b5db11e9021f304a6c117503574917c648fcb7037363822743ebef351ef50647e57bf90b2d5b7ea8662104f1d019f09aa791bd6ac02cfa82082

Download Submit
C:\Users\Admin\AppData\Local\wininit.exe

Filesize
66KB

MD5
21ac888a0b9afb08b26e70661b98f464

SHA1
b0ed1831c8976bf20735e18c86e8a7be6ad9f378

SHA256
31ac27b77c0d54281f4ed4d122b66deff2fedd04f24c9c43631b7a3040e381c3

SHA512
1e66c82b73dffbd64cc9b3f6600c172b0045d1dc8d5f51fc7b5878397ac848fb75bdaa15af1844dc5b2e2aec3f13287887c2ece9347a8cdd7dd08e2e2c1486aa

Download Submit
C:\Users\Admin\AppData\Local\wininit.exe

Filesize
66KB

MD5
21ac888a0b9afb08b26e70661b98f464

SHA1
b0ed1831c8976bf20735e18c86e8a7be6ad9f378

SHA256
31ac27b77c0d54281f4ed4d122b66deff2fedd04f24c9c43631b7a3040e381c3

SHA512
1e66c82b73dffbd64cc9b3f6600c172b0045d1dc8d5f51fc7b5878397ac848fb75bdaa15af1844dc5b2e2aec3f13287887c2ece9347a8cdd7dd08e2e2c1486aa

Download Submit
C:\Users\Admin\AppData\Local\wininit.exe

Filesize
66KB

MD5
21ac888a0b9afb08b26e70661b98f464

SHA1
b0ed1831c8976bf20735e18c86e8a7be6ad9f378

SHA256
31ac27b77c0d54281f4ed4d122b66deff2fedd04f24c9c43631b7a3040e381c3

SHA512
1e66c82b73dffbd64cc9b3f6600c172b0045d1dc8d5f51fc7b5878397ac848fb75bdaa15af1844dc5b2e2aec3f13287887c2ece9347a8cdd7dd08e2e2c1486aa

Download Submit
C:\Users\Admin\AppData\Local\wininit.exe

Filesize
66KB

MD5
21ac888a0b9afb08b26e70661b98f464

SHA1
b0ed1831c8976bf20735e18c86e8a7be6ad9f378

SHA256
31ac27b77c0d54281f4ed4d122b66deff2fedd04f24c9c43631b7a3040e381c3

SHA512
1e66c82b73dffbd64cc9b3f6600c172b0045d1dc8d5f51fc7b5878397ac848fb75bdaa15af1844dc5b2e2aec3f13287887c2ece9347a8cdd7dd08e2e2c1486aa

Download Submit
C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
109KB

MD5
5145359a4097367f9d9afd24091208ae

SHA1
77ea09be2cbf83cf40e5c4a746f1cbdb05785686

SHA256
d674f4a389393b731d930103e4115573f693e831e17973b3c3d4bd263fc93716

SHA512
55beb0abe6370cefd41c267acb58e2c050b981693b4eef577c07f9707a76bb22835b1485ae26124b62e7ebf82e448a61b7962ef82a7f2c08f782126f8855c398

Download Submit
C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
109KB

MD5
5145359a4097367f9d9afd24091208ae

SHA1
77ea09be2cbf83cf40e5c4a746f1cbdb05785686

SHA256
d674f4a389393b731d930103e4115573f693e831e17973b3c3d4bd263fc93716

SHA512
55beb0abe6370cefd41c267acb58e2c050b981693b4eef577c07f9707a76bb22835b1485ae26124b62e7ebf82e448a61b7962ef82a7f2c08f782126f8855c398

Download Submit
C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
109KB

MD5
5145359a4097367f9d9afd24091208ae

SHA1
77ea09be2cbf83cf40e5c4a746f1cbdb05785686

SHA256
d674f4a389393b731d930103e4115573f693e831e17973b3c3d4bd263fc93716

SHA512
55beb0abe6370cefd41c267acb58e2c050b981693b4eef577c07f9707a76bb22835b1485ae26124b62e7ebf82e448a61b7962ef82a7f2c08f782126f8855c398

Download Submit
C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
109KB

MD5
5145359a4097367f9d9afd24091208ae

SHA1
77ea09be2cbf83cf40e5c4a746f1cbdb05785686

SHA256
d674f4a389393b731d930103e4115573f693e831e17973b3c3d4bd263fc93716

SHA512
55beb0abe6370cefd41c267acb58e2c050b981693b4eef577c07f9707a76bb22835b1485ae26124b62e7ebf82e448a61b7962ef82a7f2c08f782126f8855c398

Download Submit
C:\Users\Public\ctfmon.exe

Filesize
64KB

MD5
2946d986354c504635a4bc2543a276f4

SHA1
6cdf2129a845f05c5adfff70e1b8f47a1db801f7

SHA256
d1342baf41a20e9f2ae8e6299834bf1c22e3d5b3b59d0a817b6a043b66c7fdee

SHA512
1b771d3c69a93afeaa9762fddb09871219b8036bbc592b1abdcecfd981842cb2c7dcd34f7347620e7c52a0bc63a07bd931b1014727e00c4f0e18073fe5fea71b

Download Submit
C:\Users\Public\ctfmon.exe

Filesize
64KB

MD5
2946d986354c504635a4bc2543a276f4

SHA1
6cdf2129a845f05c5adfff70e1b8f47a1db801f7

SHA256
d1342baf41a20e9f2ae8e6299834bf1c22e3d5b3b59d0a817b6a043b66c7fdee

SHA512
1b771d3c69a93afeaa9762fddb09871219b8036bbc592b1abdcecfd981842cb2c7dcd34f7347620e7c52a0bc63a07bd931b1014727e00c4f0e18073fe5fea71b

Download Submit
C:\Users\Public\ctfmon.exe

Filesize
64KB

MD5
2946d986354c504635a4bc2543a276f4

SHA1
6cdf2129a845f05c5adfff70e1b8f47a1db801f7

SHA256
d1342baf41a20e9f2ae8e6299834bf1c22e3d5b3b59d0a817b6a043b66c7fdee

SHA512
1b771d3c69a93afeaa9762fddb09871219b8036bbc592b1abdcecfd981842cb2c7dcd34f7347620e7c52a0bc63a07bd931b1014727e00c4f0e18073fe5fea71b

Download Submit
C:\Users\Public\ctfmon.exe

Filesize
64KB

MD5
2946d986354c504635a4bc2543a276f4

SHA1
6cdf2129a845f05c5adfff70e1b8f47a1db801f7

SHA256
d1342baf41a20e9f2ae8e6299834bf1c22e3d5b3b59d0a817b6a043b66c7fdee

SHA512
1b771d3c69a93afeaa9762fddb09871219b8036bbc592b1abdcecfd981842cb2c7dcd34f7347620e7c52a0bc63a07bd931b1014727e00c4f0e18073fe5fea71b

Download Submit
memory/320-234-0x000000001B1E0000-0x000000001B1F0000-memory.dmp

Filesize
64KB

Download
memory/320-187-0x0000000000380000-0x0000000000396000-memory.dmp

Filesize
88KB

Download
memory/320-229-0x000000001B1E0000-0x000000001B1F0000-memory.dmp

Filesize
64KB

Download
memory/1168-225-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1168-231-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1236-235-0x0000000000B40000-0x0000000000B50000-memory.dmp

Filesize
64KB

Download
memory/1236-220-0x0000000000330000-0x0000000000346000-memory.dmp

Filesize
88KB

Download
memory/1236-230-0x0000000000B40000-0x0000000000B50000-memory.dmp

Filesize
64KB

Download
memory/2564-233-0x000000001BC90000-0x000000001BCA0000-memory.dmp

Filesize
64KB

Download
memory/2564-228-0x000000001BC90000-0x000000001BCA0000-memory.dmp

Filesize
64KB

Download
memory/2564-217-0x0000000000E10000-0x0000000000E30000-memory.dmp

Filesize
128KB

Download
memory/4536-227-0x000000001BB50000-0x000000001BB60000-memory.dmp

Filesize
64KB

Download
memory/4536-232-0x000000001BB50000-0x000000001BB60000-memory.dmp

Filesize
64KB

Download
memory/4536-200-0x0000000000F30000-0x0000000000F46000-memory.dmp

Filesize
88KB

Download
memory/4592-185-0x0000000000CB0000-0x0000000000CC4000-memory.dmp

Filesize
80KB

Download
memory/4888-218-0x000000001D770000-0x000000001DC3E000-memory.dmp

Filesize
4.8MB

Download
memory/4888-137-0x00000000015B0000-0x00000000015C0000-memory.dmp

Filesize
64KB

Download
memory/4888-136-0x000000001BB50000-0x000000001BBB2000-memory.dmp

Filesize
392KB

Download
memory/4888-135-0x000000001BA30000-0x000000001BAD6000-memory.dmp

Filesize
664KB

Download
memory/4888-133-0x00000000015B0000-0x00000000015C0000-memory.dmp

Filesize
64KB

Download
memory/4888-134-0x0000000000AD0000-0x0000000000B1A000-memory.dmp

Filesize
296KB

Download