806ff5a4291ace6371cfa09d584567b7d652d7b28c167a5ab9c4115e9aa4e1f7

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Worm.Win32.Ludbaruma.exe
Size

91KB
MD5

873ef5c05d08ea689a7089b2587d2330
SHA1

9aba971d627abf02ea1e0b00600912eb0f8626a5
SHA256

806ff5a4291ace6371cfa09d584567b7d652d7b28c167a5ab9c4115e9aa4e1f7
SHA512

f92df22b69780ace53fbe815b066b3dbaabe56b4f697375c6627be513ef6799f05eeb70ced00bde6c05836bd8dfb467044889af33cd37d2abf699d3aecba9b15
SSDEEP

1536:FAwEmBGz1lNNqDaG0PoxhlzmnAwEmBGz1lNNqDaG0Poxhlzm/:FGmUXNQDaG0A8nGmUXNQDaG0A8/

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	Worm.Win32.Ludbaruma.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Worm.Win32.Ludbaruma.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Worm.Win32.Ludbaruma.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Worm.Win32.Ludbaruma.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Worm.Win32.Ludbaruma.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
1880	xk.exe
2952	IExplorer.exe
3032	WINLOGON.EXE
2864	CSRSS.EXE
2816	SERVICES.EXE
1512	LSASS.EXE
1752	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
2532	Worm.Win32.Ludbaruma.exe
2532	Worm.Win32.Ludbaruma.exe
2532	Worm.Win32.Ludbaruma.exe
2532	Worm.Win32.Ludbaruma.exe
2532	Worm.Win32.Ludbaruma.exe
2532	Worm.Win32.Ludbaruma.exe
2532	Worm.Win32.Ludbaruma.exe
2532	Worm.Win32.Ludbaruma.exe
2532	Worm.Win32.Ludbaruma.exe
2532	Worm.Win32.Ludbaruma.exe
2532	Worm.Win32.Ludbaruma.exe
2532	Worm.Win32.Ludbaruma.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Worm.Win32.Ludbaruma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Worm.Win32.Ludbaruma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Worm.Win32.Ludbaruma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	Worm.Win32.Ludbaruma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Worm.Win32.Ludbaruma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Worm.Win32.Ludbaruma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Worm.Win32.Ludbaruma.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	Worm.Win32.Ludbaruma.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mig2.scr	Worm.Win32.Ludbaruma.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	Worm.Win32.Ludbaruma.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	Worm.Win32.Ludbaruma.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	Worm.Win32.Ludbaruma.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	Worm.Win32.Ludbaruma.exe
File created	C:\Windows\SysWOW64\shell.exe	Worm.Win32.Ludbaruma.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	Worm.Win32.Ludbaruma.exe
File created	C:\Windows\xk.exe	Worm.Win32.Ludbaruma.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Worm.Win32.Ludbaruma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Worm.Win32.Ludbaruma.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Worm.Win32.Ludbaruma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Worm.Win32.Ludbaruma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Worm.Win32.Ludbaruma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	Worm.Win32.Ludbaruma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Worm.Win32.Ludbaruma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Worm.Win32.Ludbaruma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Worm.Win32.Ludbaruma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	Worm.Win32.Ludbaruma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	Worm.Win32.Ludbaruma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Worm.Win32.Ludbaruma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Worm.Win32.Ludbaruma.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2532	Worm.Win32.Ludbaruma.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2532	Worm.Win32.Ludbaruma.exe
1880	xk.exe
2952	IExplorer.exe
3032	WINLOGON.EXE
2864	CSRSS.EXE
2816	SERVICES.EXE
1512	LSASS.EXE
1752	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1880	2532	Worm.Win32.Ludbaruma.exe	31
PID 2532 wrote to memory of 1880	2532	Worm.Win32.Ludbaruma.exe	31
PID 2532 wrote to memory of 1880	2532	Worm.Win32.Ludbaruma.exe	31
PID 2532 wrote to memory of 1880	2532	Worm.Win32.Ludbaruma.exe	31
PID 2532 wrote to memory of 2952	2532	Worm.Win32.Ludbaruma.exe	32
PID 2532 wrote to memory of 2952	2532	Worm.Win32.Ludbaruma.exe	32
PID 2532 wrote to memory of 2952	2532	Worm.Win32.Ludbaruma.exe	32
PID 2532 wrote to memory of 2952	2532	Worm.Win32.Ludbaruma.exe	32
PID 2532 wrote to memory of 3032	2532	Worm.Win32.Ludbaruma.exe	33
PID 2532 wrote to memory of 3032	2532	Worm.Win32.Ludbaruma.exe	33
PID 2532 wrote to memory of 3032	2532	Worm.Win32.Ludbaruma.exe	33
PID 2532 wrote to memory of 3032	2532	Worm.Win32.Ludbaruma.exe	33
PID 2532 wrote to memory of 2864	2532	Worm.Win32.Ludbaruma.exe	34
PID 2532 wrote to memory of 2864	2532	Worm.Win32.Ludbaruma.exe	34
PID 2532 wrote to memory of 2864	2532	Worm.Win32.Ludbaruma.exe	34
PID 2532 wrote to memory of 2864	2532	Worm.Win32.Ludbaruma.exe	34
PID 2532 wrote to memory of 2816	2532	Worm.Win32.Ludbaruma.exe	35
PID 2532 wrote to memory of 2816	2532	Worm.Win32.Ludbaruma.exe	35
PID 2532 wrote to memory of 2816	2532	Worm.Win32.Ludbaruma.exe	35
PID 2532 wrote to memory of 2816	2532	Worm.Win32.Ludbaruma.exe	35
PID 2532 wrote to memory of 1512	2532	Worm.Win32.Ludbaruma.exe	36
PID 2532 wrote to memory of 1512	2532	Worm.Win32.Ludbaruma.exe	36
PID 2532 wrote to memory of 1512	2532	Worm.Win32.Ludbaruma.exe	36
PID 2532 wrote to memory of 1512	2532	Worm.Win32.Ludbaruma.exe	36
PID 2532 wrote to memory of 1752	2532	Worm.Win32.Ludbaruma.exe	37
PID 2532 wrote to memory of 1752	2532	Worm.Win32.Ludbaruma.exe	37
PID 2532 wrote to memory of 1752	2532	Worm.Win32.Ludbaruma.exe	37
PID 2532 wrote to memory of 1752	2532	Worm.Win32.Ludbaruma.exe	37

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Worm.Win32.Ludbaruma.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	Worm.Win32.Ludbaruma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Worm.Win32.Ludbaruma.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Worm.Win32.Ludbaruma.exe

C:\Users\Admin\AppData\Local\Temp\Worm.Win32.Ludbaruma.exe
"C:\Users\Admin\AppData\Local\Temp\Worm.Win32.Ludbaruma.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2532
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1880
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2952
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3032
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2864
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2816
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1512
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
91KB

MD5
33320b8ac5b0a32ecd7976d812119481

SHA1
3439aa0b0235208b50ba73ae13becc654e2c2682

SHA256
a754f08354021856437b23d2cf0526d842b943587c7cb2922968e537a7ee2741

SHA512
f4f2256dbd066c8f03714d2342c88a84647a9b0c1e8a8b26cbf0ad91e6b5cd9187d1c2f78e8187ec129fede9ae8d23462e6e46f76a0e634624c6dced31e9cde0

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
91KB

MD5
9ed08bafcfeff26c17051aa0897e984c

SHA1
8aae098f663168b762f0d5965c54095674e9b145

SHA256
9d6d7624b308169ab1cae8b158e835eb75ad772c19a66f15daa3d738bf6f673b

SHA512
c07effd6a08df903e8cc8caf95966b039f8b96939222292a291d930b9eba383858a98921aa097cba05f509509f49376d269c2497694c5b20d8d4766fa9450458

Download Submit
C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
91KB

MD5
873ef5c05d08ea689a7089b2587d2330

SHA1
9aba971d627abf02ea1e0b00600912eb0f8626a5

SHA256
806ff5a4291ace6371cfa09d584567b7d652d7b28c167a5ab9c4115e9aa4e1f7

SHA512
f92df22b69780ace53fbe815b066b3dbaabe56b4f697375c6627be513ef6799f05eeb70ced00bde6c05836bd8dfb467044889af33cd37d2abf699d3aecba9b15

Download Submit
C:\Windows\xk.exe

Filesize
91KB

MD5
460781b2d17be77924bfb63aedecd164

SHA1
3f4d3f96bfd213463b501e3c11319fd1a89c2eb9

SHA256
ced6252cebba54453019cd4b16e0d34ac5d8b2cd33b64e716f37c760fcda7ea9

SHA512
743f16076cd1f0d914bf1c6ccf21361e57e219b2c08e2050d44e96e978e20815d4b1b6e23392f1a4938923382b42139ce780432ea34cc6b9589e10b3d7f82d29

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
91KB

MD5
976abd81a9b9ca10612d52722d232d8e

SHA1
daab0abd44ca9583b948a62befec0d11d97406ec

SHA256
39a4da7c50cf53c8006bb792466c04050e8d2fe4ef2827acb89680063d94f973

SHA512
0c04b928b05e0cf9468a10b47f7c6ab036f9d7f30f114966493b7c6f51b84bdc1d4e35418f1546dfa39010c53041a2dc8e7d8fc60d4fa478192b84f083b0c06e

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
91KB

MD5
fa0e61ae22461d260560afd3a4b496fd

SHA1
44f79cdce72c73227c4d5841a3da0b8781337b96

SHA256
f27c52e434f567b0c5e78dd1790c48b7c88add88cc2c169f91cf4153911422d4

SHA512
cfce97abb4b01ee106574c15aae8d60071598e8db8fa716f9ecad16af057bd2573131d29c1cb0b135fd33d6a00006ed8e59c6b6d664a5c1746d0dc3f08beea4f

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
91KB

MD5
4e2293e407e0747ccd820ce7b14b9bed

SHA1
c21683e160874c2a17bc23ec35eee8c6f8ab44b3

SHA256
f0082608fa6d51c1570a2833a9118edcef9369b3afa18d719864192cd76d8649

SHA512
f900cbd7306ef73ac7495348d9f3cb13819a58df2df638ddedf26af07026411f85c1ae0f516a9a29f651500a333bf95ed3e574c8d065011a08bd3764c1e64bec

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
5705e84ec3289fa94643be6473773675

SHA1
324d2a74262a36fa6e3efae70385a30fab41dace

SHA256
d791fa1c6f5f7f324165f74fb29b11456e627b5acadc56753eff09a1fa95e0ad

SHA512
08fec9a735bfacbedddd0fbc94367f45f05c65c3ee2f8eeafdc209088fd051e7426203a810e0dd258a2c03a17fe0380621f1303d1e39af0256a36c93359c7c14

Download Submit
memory/1512-174-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1752-186-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1880-114-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2532-133-0x0000000002620000-0x000000000264E000-memory.dmp

Filesize
184KB

Download
memory/2532-140-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2532-169-0x0000000002620000-0x000000000264E000-memory.dmp

Filesize
184KB

Download
memory/2532-145-0x0000000002620000-0x000000000264E000-memory.dmp

Filesize
184KB

Download
memory/2532-181-0x0000000002620000-0x000000000264E000-memory.dmp

Filesize
184KB

Download
memory/2532-121-0x0000000002620000-0x000000000264E000-memory.dmp

Filesize
184KB

Download
memory/2532-188-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2532-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2532-109-0x0000000002620000-0x000000000264E000-memory.dmp

Filesize
184KB

Download
memory/2532-170-0x0000000002620000-0x000000000264E000-memory.dmp

Filesize
184KB

Download
memory/2816-162-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2816-158-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2864-150-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2952-126-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2952-123-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3032-137-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download