0caad946864f1085ab706b4d2c75d6dbcfa16def8238195ad2f6424b3db84135

Analysis

max time kernel
91s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0521acbe48a22af059350b683172a720N.exe
Size

91KB
MD5

0521acbe48a22af059350b683172a720
SHA1

e3d62fc16f5080b612657d9615238f3cdf4a3095
SHA256

0caad946864f1085ab706b4d2c75d6dbcfa16def8238195ad2f6424b3db84135
SHA512

236e4238d491f8ad4318b9a3d14cde09b755a2293bac86ed7adf9999b2440936d82fa3bed07f2e25d129483e89693a49e851e003be0584a3629e6b0c6c263b7f
SSDEEP

1536:zAwEmBZ04faWmtN4nic+6GMAwEmBZ04faWmtN4nic+6GU:zGms4Eton0MGms4Eton0U

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	0521acbe48a22af059350b683172a720N.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	0521acbe48a22af059350b683172a720N.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	0521acbe48a22af059350b683172a720N.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	0521acbe48a22af059350b683172a720N.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	0521acbe48a22af059350b683172a720N.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
1164	xk.exe
2348	IExplorer.exe
2208	WINLOGON.EXE
476	CSRSS.EXE
2568	SERVICES.EXE
1884	LSASS.EXE
644	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
2636	0521acbe48a22af059350b683172a720N.exe
2636	0521acbe48a22af059350b683172a720N.exe
2636	0521acbe48a22af059350b683172a720N.exe
2636	0521acbe48a22af059350b683172a720N.exe
2636	0521acbe48a22af059350b683172a720N.exe
2636	0521acbe48a22af059350b683172a720N.exe
2636	0521acbe48a22af059350b683172a720N.exe
2636	0521acbe48a22af059350b683172a720N.exe
2636	0521acbe48a22af059350b683172a720N.exe
2636	0521acbe48a22af059350b683172a720N.exe
2636	0521acbe48a22af059350b683172a720N.exe
2636	0521acbe48a22af059350b683172a720N.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	0521acbe48a22af059350b683172a720N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	0521acbe48a22af059350b683172a720N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	0521acbe48a22af059350b683172a720N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	0521acbe48a22af059350b683172a720N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	0521acbe48a22af059350b683172a720N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	0521acbe48a22af059350b683172a720N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	0521acbe48a22af059350b683172a720N.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	0521acbe48a22af059350b683172a720N.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\IExplorer.exe	0521acbe48a22af059350b683172a720N.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	0521acbe48a22af059350b683172a720N.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	0521acbe48a22af059350b683172a720N.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	0521acbe48a22af059350b683172a720N.exe
File created	C:\Windows\SysWOW64\shell.exe	0521acbe48a22af059350b683172a720N.exe
File created	C:\Windows\SysWOW64\Mig2.scr	0521acbe48a22af059350b683172a720N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\xk.exe	0521acbe48a22af059350b683172a720N.exe
File opened for modification	C:\Windows\xk.exe	0521acbe48a22af059350b683172a720N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0521acbe48a22af059350b683172a720N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	0521acbe48a22af059350b683172a720N.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	0521acbe48a22af059350b683172a720N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	0521acbe48a22af059350b683172a720N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	0521acbe48a22af059350b683172a720N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	0521acbe48a22af059350b683172a720N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	0521acbe48a22af059350b683172a720N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	0521acbe48a22af059350b683172a720N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	0521acbe48a22af059350b683172a720N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	0521acbe48a22af059350b683172a720N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	0521acbe48a22af059350b683172a720N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	0521acbe48a22af059350b683172a720N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2636	0521acbe48a22af059350b683172a720N.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2636	0521acbe48a22af059350b683172a720N.exe
1164	xk.exe
2348	IExplorer.exe
2208	WINLOGON.EXE
476	CSRSS.EXE
2568	SERVICES.EXE
1884	LSASS.EXE
644	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 1164	2636	0521acbe48a22af059350b683172a720N.exe	30
PID 2636 wrote to memory of 1164	2636	0521acbe48a22af059350b683172a720N.exe	30
PID 2636 wrote to memory of 1164	2636	0521acbe48a22af059350b683172a720N.exe	30
PID 2636 wrote to memory of 1164	2636	0521acbe48a22af059350b683172a720N.exe	30
PID 2636 wrote to memory of 2348	2636	0521acbe48a22af059350b683172a720N.exe	31
PID 2636 wrote to memory of 2348	2636	0521acbe48a22af059350b683172a720N.exe	31
PID 2636 wrote to memory of 2348	2636	0521acbe48a22af059350b683172a720N.exe	31
PID 2636 wrote to memory of 2348	2636	0521acbe48a22af059350b683172a720N.exe	31
PID 2636 wrote to memory of 2208	2636	0521acbe48a22af059350b683172a720N.exe	32
PID 2636 wrote to memory of 2208	2636	0521acbe48a22af059350b683172a720N.exe	32
PID 2636 wrote to memory of 2208	2636	0521acbe48a22af059350b683172a720N.exe	32
PID 2636 wrote to memory of 2208	2636	0521acbe48a22af059350b683172a720N.exe	32
PID 2636 wrote to memory of 476	2636	0521acbe48a22af059350b683172a720N.exe	33
PID 2636 wrote to memory of 476	2636	0521acbe48a22af059350b683172a720N.exe	33
PID 2636 wrote to memory of 476	2636	0521acbe48a22af059350b683172a720N.exe	33
PID 2636 wrote to memory of 476	2636	0521acbe48a22af059350b683172a720N.exe	33
PID 2636 wrote to memory of 2568	2636	0521acbe48a22af059350b683172a720N.exe	34
PID 2636 wrote to memory of 2568	2636	0521acbe48a22af059350b683172a720N.exe	34
PID 2636 wrote to memory of 2568	2636	0521acbe48a22af059350b683172a720N.exe	34
PID 2636 wrote to memory of 2568	2636	0521acbe48a22af059350b683172a720N.exe	34
PID 2636 wrote to memory of 1884	2636	0521acbe48a22af059350b683172a720N.exe	35
PID 2636 wrote to memory of 1884	2636	0521acbe48a22af059350b683172a720N.exe	35
PID 2636 wrote to memory of 1884	2636	0521acbe48a22af059350b683172a720N.exe	35
PID 2636 wrote to memory of 1884	2636	0521acbe48a22af059350b683172a720N.exe	35
PID 2636 wrote to memory of 644	2636	0521acbe48a22af059350b683172a720N.exe	36
PID 2636 wrote to memory of 644	2636	0521acbe48a22af059350b683172a720N.exe	36
PID 2636 wrote to memory of 644	2636	0521acbe48a22af059350b683172a720N.exe	36
PID 2636 wrote to memory of 644	2636	0521acbe48a22af059350b683172a720N.exe	36

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	0521acbe48a22af059350b683172a720N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	0521acbe48a22af059350b683172a720N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	0521acbe48a22af059350b683172a720N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	0521acbe48a22af059350b683172a720N.exe

C:\Users\Admin\AppData\Local\Temp\0521acbe48a22af059350b683172a720N.exe
"C:\Users\Admin\AppData\Local\Temp\0521acbe48a22af059350b683172a720N.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2636
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1164
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2348
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2208
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:476
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2568
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1884
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
91KB

MD5
0521acbe48a22af059350b683172a720

SHA1
e3d62fc16f5080b612657d9615238f3cdf4a3095

SHA256
0caad946864f1085ab706b4d2c75d6dbcfa16def8238195ad2f6424b3db84135

SHA512
236e4238d491f8ad4318b9a3d14cde09b755a2293bac86ed7adf9999b2440936d82fa3bed07f2e25d129483e89693a49e851e003be0584a3629e6b0c6c263b7f

Download Submit
C:\Windows\xk.exe

Filesize
91KB

MD5
1fd1f6d77074f738eb784dc22ec9ef94

SHA1
7568c1146af5cbc073b793ada93c3e4fdfc11019

SHA256
165e1299e0a1cb6cf6dc4f5e5dc34fe2bc63af5cf54aeadb06414afb999af4f2

SHA512
1b7e0f0d7f940d10401b6d8501d0ce7ee9a556fbfb54a10871e30c31ef789484f44f003215fcae8354ba422403d9e6a013a9569e844cba30f82c5f2b0d33b725

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
91KB

MD5
396c322e654877b36c599342d3b2241a

SHA1
61d1aac98fb6e63692055931d9bf4f77bd452e0d

SHA256
fc779aae4ff4f7b8ef6d5819f14458794bd04c6a26df511b6d95afbd0f63b626

SHA512
8113a2af2810046dd13de7b421b87a4d94c1244d45ef947bee6539d0adb82a927cadb431c4e7b2c40689e7477069a912c2da3862a0aeb6f478fcb3d00de76382

Download Submit
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
91KB

MD5
92bbb3ce677c52572094d8a6f69c3e47

SHA1
133c444179a28b9142a34216b76f7a8ccc41be4b

SHA256
6a2b9f843cd50018478b4005813d0d13d475565c051fdf9912318300ca4c68d2

SHA512
0126ad50a422051fcaef3b198895e742f15cc18acc1d36ec933d408281183f3741e700ad17d7e0ffe4e64fe7b3e046117c0a3c328e93a83b2a91b990ee1982ae

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
91KB

MD5
8c59681b60a6d96cf32e9cb303262999

SHA1
0109e7019e27d925194b575d243b33a374a59174

SHA256
788ca916aeab56c024cc4d9b5c3dae3cbe2b84afc700c66482c779307e1d9c4d

SHA512
0670b68a4ce5cc86097c23e5fb51db0eab098aa062396dddd1770619050dfe8bce3eee7e22065caacbf44616d86080312f153b88a301592bf3460c1cfc370d30

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
91KB

MD5
2ae7983de4fca48af06b56090d53ed83

SHA1
a394d16e1beabafc852427aad8153ad0eae4219b

SHA256
d3ac34a8b7ef5fa6c9287f8c5ad3c611231b5154afe9b389d5ad4fe6ddee5e9f

SHA512
5b5d7d82403d793f431fe504a9605dce08b9e71bb62280dc55c0a839dbf47141e29c834ba4eb7785d5666ed9ebe7593fd4afd2ee8d2e35376325a6ad16170264

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
91KB

MD5
af8e158ca8415a4fdd3a134b2218e60d

SHA1
dcec1d1fb61e79a67285d26c5a5e298756817857

SHA256
9ff29e156b5f087e45bd2acd2653789157ac17f5d248fdd51bd96048fe73acf7

SHA512
f0396f24fa70498253c260b2ab6ecb1924a13b4c440e0c2a4ef87c43e5d22ccea775d138e674a2e07cad46892350c1740e68fd7b1fd94dd3982b1b712bc86a85

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
4373a02af9554a09659ab6fd9695aa5c

SHA1
ee89cb36cd32a8fdf94aa58f231fc495019b3b6e

SHA256
86d6afaaed916e1d64ac1e795eb1edf99c04a42f80ae76e228507c7de4751b63

SHA512
4018d71d91ca425627008b1e746bc46afdb2e6b520811233adfba95d54e192116ebd3f8e5fdac85d270c8f89286753653600ba0ed8ca0dd4087f43c7b12375f0

Download Submit
memory/476-148-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/644-183-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1164-114-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1884-173-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1884-169-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2208-134-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2208-137-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2348-126-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2568-159-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2636-155-0x0000000003090000-0x00000000030BE000-memory.dmp

Filesize
184KB

Download
memory/2636-110-0x0000000003090000-0x00000000030BE000-memory.dmp

Filesize
184KB

Download
memory/2636-117-0x0000000003090000-0x00000000030BE000-memory.dmp

Filesize
184KB

Download
memory/2636-167-0x0000000003090000-0x00000000030BE000-memory.dmp

Filesize
184KB

Download
memory/2636-166-0x0000000003090000-0x00000000030BE000-memory.dmp

Filesize
184KB

Download
memory/2636-145-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2636-109-0x0000000003090000-0x00000000030BE000-memory.dmp

Filesize
184KB

Download
memory/2636-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2636-185-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download