Analysis
- max time kernel
116s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 10:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe
- Size 4.9MB
- Sample260731-mtjpaagh76
- SHA256 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a
- MD5 a624f7b6860ceef328201becab826645
- SHA1 be2a84ce070c29d3a2e18119da41cfa1a4f36f24
- SHA512 856d7ff795c3e2061c987eb2f4fe52d40edd53059c04777c4b8d5b24b0f03276dbe4c4f34584dfde25b8e4a534dd882f09f309700e2bfbab9268de7a3ccf0ba5
- SSDEEP 98304:NGZgk1qBNEh1hiO0QW13cNT/edqfLhBNiH/p+TOO+HQr9jqT+fd:0hYNu14DQWpcNDe4LYHQk
- TLSH T182362373527A0049E0E1CC3D8627FFE431F75AA64A81A8BC56EBB9C325355A1F213E53
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 16 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe - Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\HpSvc\Parameters\ServiceDll = "C:\\Program Files (x86)\\Ludashi\\lpi\\HpSvc.dll" ComputerZTray.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\HpSvc\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" ComputerZTray.exe - Executes dropped EXE 6 IoCs
pid Process 892 HardwareProtect_x64.sys 5216 LdsHelper.exe 3556 ComputerZTray.exe 2388 computercenter.exe 4376 ComputerZTray.exe 3976 ComputerZService.exe - Loads dropped DLL 44 IoCs
pid Process 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 5216 LdsHelper.exe 3556 ComputerZTray.exe 3556 ComputerZTray.exe 3556 ComputerZTray.exe 3556 ComputerZTray.exe 3556 ComputerZTray.exe 3556 ComputerZTray.exe 3556 ComputerZTray.exe 3556 ComputerZTray.exe 3556 ComputerZTray.exe 3556 ComputerZTray.exe 3556 ComputerZTray.exe 3556 ComputerZTray.exe 2808 svchost.exe 2808 svchost.exe 2388 computercenter.exe 2388 computercenter.exe 2388 computercenter.exe 2388 computercenter.exe 2388 computercenter.exe 2388 computercenter.exe 2388 computercenter.exe 2388 computercenter.exe 3556 ComputerZTray.exe 2808 svchost.exe 2388 computercenter.exe 4376 ComputerZTray.exe 2388 computercenter.exe 2388 computercenter.exe 3556 ComputerZTray.exe 2388 computercenter.exe 3556 ComputerZTray.exe 2388 computercenter.exe 2388 computercenter.exe 3976 ComputerZService.exe 3976 ComputerZService.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Writes to the Master Boot Record (MBR) 1 TTPs 6 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 LdsHelper.exe File opened for modification \??\PhysicalDrive0 ComputerZTray.exe File opened for modification \??\PhysicalDrive0 computercenter.exe File opened for modification \??\PhysicalDrive0 ComputerZTray.exe File opened for modification \??\PhysicalDrive0 ComputerZService.exe File opened for modification \??\PhysicalDrive0 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\cef_extensions.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\fi.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\sk.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\sw.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\natives_blob.bin 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\HardwareProtect.sys 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\fa.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\ja.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\sl.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\sw.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\ComputerZ.set LdsHelper.exe File opened for modification C:\Program Files (x86)\Ludashi\ComputerZ.set ComputerZTray.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\cs.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\hi.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\gu.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\es.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\et.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\ar.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\cef_200_percent.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\en-GB.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\fil.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\he.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\hr.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\cef.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\es.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\it.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\it.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\ko.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\mr.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\{AC123CBD-2EEF-42b4-8CE8-743017C3E055}.tf 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\cef_200_percent.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\ro.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\ta.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\cef_resources.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\LICENSE.txt 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\LICENSE.txt 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\bg.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\en-US.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\es-419.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\de.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\he.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\ca.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\es-419.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\kn.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\d3dcompiler_43.dll 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\libcef.dll 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\widevinecdmadapter.dll 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\wow_helper.exe 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\ja.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\lv.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\pt-PT.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\snapshot_blob.bin 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\de.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\ta.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\locales\zh-TW.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\version.txt 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File opened for modification C:\Program Files (x86)\Ludashi\Utils\cef\d3dcompiler_47.dll 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\ml.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\pl.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\ru.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\d3dcompiler_47.dll 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe File created C:\Program Files (x86)\Ludashi\Utils\cef\locales\ms.pak 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LdsHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerZTray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language computercenter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerZTray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerZService.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce7f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c06200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f1400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e00000074006800610077007400650000007e000000010000000800000000c0032f2df8d60168000000010000000000000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b812000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d03000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b816800000001000000000000007e000000010000000800000000c0032f2df8d6010b000000010000000e00000074006800610077007400650000001d00000001000000100000005b3b67000eeb80022e42605b6b3b72401400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748506200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f53000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703010f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 5216 LdsHelper.exe 5216 LdsHelper.exe 3556 ComputerZTray.exe 3556 ComputerZTray.exe 3556 ComputerZTray.exe 3556 ComputerZTray.exe 3556 ComputerZTray.exe 3556 ComputerZTray.exe 2808 svchost.exe 2808 svchost.exe 2808 svchost.exe 2808 svchost.exe 4376 ComputerZTray.exe 4376 ComputerZTray.exe 4376 ComputerZTray.exe 4376 ComputerZTray.exe 4376 ComputerZTray.exe 4376 ComputerZTray.exe 3556 ComputerZTray.exe 3556 ComputerZTray.exe 3976 ComputerZService.exe 3976 ComputerZService.exe 2388 computercenter.exe 2388 computercenter.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe Token: SeDebugPrivilege 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe Token: SeDebugPrivilege 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe Token: SeDebugPrivilege 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe Token: SeDebugPrivilege 2388 computercenter.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3556 ComputerZTray.exe 3556 ComputerZTray.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3728 wrote to memory of 5216 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 93 PID 3728 wrote to memory of 3556 3728 2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe 94 PID 3556 wrote to memory of 2388 3556 ComputerZTray.exe 97 PID 3556 wrote to memory of 3976 3556 ComputerZTray.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe"C:\Users\Admin\AppData\Local\Temp\2a14c75af96e6b65f6c2682711919f6779ec741c1afd272e35e48b17e648236a.exe"1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Program Files (x86)\Ludashi\Utils\LdsHelper.exe"C:\Program Files (x86)\Ludashi\Utils\LdsHelper.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5216
-
-
C:\Program Files (x86)\Ludashi\ComputerZTray.exe"C:\Program Files (x86)\Ludashi\ComputerZTray.exe" /NoFloat /disable_panel /disable_temp_alarm /HideBand2⤵
- Server Software Component: Terminal Services DLL
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Program Files (x86)\Ludashi\computercenter.exe"C:\Program Files (x86)\Ludashi\computercenter.exe" "C:\Program Files (x86)\Ludashi\ComputerZTray.exe" /NoFloat /disable_panel /disable_temp_alarm /HideBand3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388
-
-
C:\Program Files (x86)\Ludashi\ComputerZService.exe"C:\Program Files (x86)\Ludashi\ComputerZService.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3976 -
C:\Program Files (x86)\Ludashi\Utils\dll_service.exe"C:\Program Files (x86)\Ludashi\Utils\dll_service.exe" --dll="ComputerZ_HardwareDll.dll" --entry="DirectXVersionProcess" --wnd=7211504⤵PID:4548
-
-
C:\Program Files (x86)\Ludashi\Utils\dll_service.exe"C:\Program Files (x86)\Ludashi\Utils\dll_service.exe" --dll="ComputerZ_HardwareDll.dll" --entry="OpenCLTestProcess" --wnd=7211504⤵PID:1072
-
-
C:\Program Files (x86)\Ludashi\Utils\dll_service.exe"C:\Program Files (x86)\Ludashi\Utils\dll_service.exe" --dll="ComputerZ_HardwareDll.dll" --entry="NvidiaMonitorSizeOfProcess" --wnd=7211504⤵PID:5316
-
-
C:\Program Files (x86)\Ludashi\Utils\dll_service.exe"C:\Program Files (x86)\Ludashi\Utils\dll_service.exe" --dll="ComputerZ_HardwareDll.dll" --entry="WMITestProcess" --wnd=7211504⤵PID:1608
-
-
C:\Program Files (x86)\Ludashi\ComputerZService_x64.exe"C:\Program Files (x86)\Ludashi\ComputerZService_x64.exe" --dll="HardwareEx_x64.dll" --entry="HardwareExProcess" --wnd=721150 --server --firstrun4⤵PID:4692
-
-
C:\Program Files (x86)\Ludashi\Hardware\hdw_disk_scan.exe--ppid=39764⤵PID:2216
-
-
-
-
C:\Program Files (x86)\Ludashi\HardwareProtect_x64.sys"C:\Program Files (x86)\Ludashi\HardwareProtect_x64.sys"1⤵
- Executes dropped EXE
PID:892
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1140
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s HpSvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2808
-
C:\Program Files (x86)\Ludashi\ComputerZTray.exe"C:\Program Files (x86)\Ludashi\ComputerZTray.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4376
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs1⤵PID:1992
-
C:\Program Files (x86)\Ludashi\ComputerZ_x64.sys"C:\Program Files (x86)\Ludashi\ComputerZ_x64.sys"1⤵PID:2480
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Modify Registry
2Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Ludashi\360Conf.dll
- Size 287KB
- SHA256 bb82423b24a3ab1b54bea0246e3478818aee2c625cf84b5128ef282915a8465d
- MD5 4731241f01bab84b3b10f844d057dbb2
- SHA1 fe6190df827ed844a4507ecf01fc7b1cca0cc9f4
- SHA512 cf0f0ae5369e91030502e546367893e9ee134ee27d0278a638e7c80e3c7fa4a254175665e3d27d326d65266afe350d842536877d1d4b0aef43b9b2d6068fa9a9
- SSDEEP 3072:ZT+U3PPxMBToCpGnKDa+VNdTTtVhl9GZcAHQO0MzUfPR/IVxOEvWTBfd7ZnYX1m7:BZt1+l/h2cv71fBIaEvWTBFz9RRxF
- TLSH T14A548D10BBC6C1B2DFDE16780465D72D527AB6502BE0D5C7EB982A5ACE333C129352CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\ComputerMonZ.dll
- Size 3.6MB
- SHA256 6584de3cd40de9e0428eaff6f549a9c78eaf4fc45d28be24205007521f9628c4
- MD5 c308758bd0d70abf40693f9e4d19a2a7
- SHA1 b382bd754b2beffd87f5a86bdd939401e0203a8d
- SHA512 fae52d7e4417209bfbac80da4e69af2cc6d92b2976e03b53c9f36fc4bf253ecb7a46b62a2768a47a0c3706817d36a632f4f1fcd84c8d32cc93ab2af808af3e43
- SSDEEP 49152:EczHD3TXaHBtlQsWNFA36h7j8NNoqnBC7/Kz2RaAgBkzlWijEs78dwhVQBL:EcfTXQjK54NoTC6oNEM2rhy
- TLSH T1A806D0227A41C035D5AD0172497CEB6E455DEE620B7446DB73CCBA7A0F300E35A3AA6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\ComputerZ.set
- Size 103B
- SHA256 9248fc38967db2ba90458e059065d754c7c6bea735883f364ceb0549dc1552bf
- MD5 dee78481c71782d19bc4ae43f724637c
- SHA1 4e7c8ecba2608e52347359388bfd438c998d8d51
- SHA512 da8c1d8e3360668592c197f937e4316301eb7e2670f500f2bb3b0c4d2b3a7fc91d81147416ecc1a19ffdf794720d7543015f3c932e591bc6227c2e3197666940
- TLSH T144B0122F6524704C54653719137370E1CB5127D81B3181349332880FF512F08184E995
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Ludashi\ComputerZ.set
- Size 158B
- SHA256 4a7e3b96ab8954088bba66c27f5b2a644c97493f18f79fd31a850222730ce223
- MD5 aa00344b581a3e2ce5f54b421424028e
- SHA1 6e8d258a0e85026dd66a59cb98783f0435e55b4a
- SHA512 4452d8f8e0fa7210e9cf30dc216420fe87aa1c772e5f4a01b54e8f02307f7c45c1a69fd4c033802a3236b682feea4ed612932c9b192a6eefafc52b9526c80fb8
- TLSH T124C0801D51151001607A4718513331E0C7A557841B35C03082354D0EE467B0464DD9B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Ludashi\ComputerZ.set
- Size 170B
- SHA256 b1d0f6bc53d8f2c326bb0ce681968f58fb91acf7c2d7c2eacd494440bf056e50
- MD5 2d0fc540d6ccf7f8a47568f370731e51
- SHA1 b6fb1448ff857310931c197844c23faa41981ed2
- SHA512 40abf16fbef1703d2e5fc889009ae874ea0023aca5c29a64d6aa5032d42b7a0ca3dddbcf190d76bbcd5d76b984608da9fc664dce32861118c3759ce46c09a78b
- TLSH T161C0801D51191011647A5728517331F0C7E557C41B35C43487355D0EED67B4865DD9BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Ludashi\ComputerZ.set
- Size 184B
- SHA256 1b37b10935ce5326cfe77f46d90b9d93733385f273c003309fd3011b70096c7b
- MD5 e7406e6edfa5a540319df8adf33d33ec
- SHA1 77ebef816574b5d13b2ba77088d69f92483982bb
- SHA512 e98905873e2a3af54e334b482c1f18b3d9d0aa26d973c4bc1591cf76f169fe6f03caa6739b1994005b6ee5ae431e40cb5dfeaaa8e2a548ff773a6b1b8adca0f0
- TLSH T1F0C0221965191006A03A472851B332E0C6A447C02B3484248320490EEC63B0865DD8FB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Ludashi\ComputerZ.set
- Size 327B
- SHA256 7e70b8d664b37d9898224e00637f64e47a20b0df9e67d5f2c08bb16e0185bf7c
- MD5 2bc4e501188c4808f5dedeb393a7bc68
- SHA1 55ee8686a8132e2e7a609c279fdf5f54b33689bb
- SHA512 35268d1d93f6e01a6d6691218ec922212d21f7e0ee6bc118120643e397e91f5c5dfc2792da5c1b7549fe087c6aa1b445047cb2e3e282fc02db70c70ecf068484
- TLSH T1A1E02D1F352A005510390639703320C0C1C853C00B36C132E714840CEFA2A5573FE8FB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Ludashi\ComputerZ.set
- Size 680B
- SHA256 86b6787d8afa37e9c28ccf34102a6b322bdb87d52660c88a17561ad727d82f67
- MD5 907bbc9f12e20635250a09af5ffb8a82
- SHA1 013953871ca4088d2dbd7c153ba7332d4da63570
- SHA512 2d81209ba49d92a1958134c8ff07fe10c62e458c8eb9d9f57addfedb8fd9f8d05542c10ea7629bbc5a499f0a2be3f2ab1932433911ba9c2da66b9380228e2f63
- TLSH T1CF01442E3038D0906035226865332589C6CD13C10F79C53D6774990C4C9771C179A8FB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Ludashi\ComputerZ.set
- Size 710B
- SHA256 65c5b399db0080ad8b06d4ea648abbec8c662f41d515f57ad0906811d70509bc
- MD5 a46c9e51398591afad8790d35f2b17d1
- SHA1 ee7bc9186d3207a66d020dfc82323fc2262dc8f0
- SHA512 68b1d86f7e47b18345548f17c04d317fda1efe27f94381b7e8a2090b4e2c5035a5cf95f74c9d7a3a7abc954359c35d2792243ff1a673bff3347763957e5558bb
- TLSH T17601102E7028D090A03632686633258AC6CD17C10F79C63D6774AA0C8D9B71D17AA8FF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Ludashi\ComputerZ.set
- Size 822B
- SHA256 a0dba26ca05ef7ded707e40b25829003034448debe31ca11274b41f7c51723f8
- MD5 ee384b21a00a188f0229b86aacbeec11
- SHA1 7a5a9233a8e0d975a716ec87872d028783d8cc43
- SHA512 eccaf993ef5b5c8255dc9c5f41dff2c6fcfbb8028103beb06fda9396b341d8cfafd49a412a23504d5baead939cbb2ee4d7e47a88c493e4c31012ed7b5dfce6bb
- TLSH T19B015E2D302482A5A03A2229673326C9C2CD03C00B78CA3853716A0C8CF6A1A139ECFA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Ludashi\ComputerZ10.dll
- Size 779KB
- SHA256 9447277c3f36148d9af207331d101e8e21691b445fdf1073d11209c1c30a7057
- MD5 36306abfdc45a1cd4f0c21b7d7419ead
- SHA1 db1ea3080716e20071b6c1f6fb8469bc4b8109ce
- SHA512 a33c30d2d073dc30580c42744b903666fcfd97b0263d5515a41b31d07d26b81c6d86a6ed7378218a9930e5099e76c99f8519841746b7c1338a7d487527717d0c
- SSDEEP 12288:cE+nMoN5Ts4XzEM7QySZ+JS5fP8yqXiFWM8dbCb/eEYKhUi6wl2ApNPnZ1MBk:3+nnzFFSZuyrD+bCb/eEYK+Kl2ENzMy
- TLSH T10A05BF117592C079E5AD1072583DEB7A407DAE310F7089DBABE47A2E4E305E35F39A23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\ComputerZTray.exe
- Size 8.4MB
- SHA256 151d5c2cdee63352a32010bba1b2fd34d39eb4fe4b8ad45d8acfb70715c63b20
- MD5 e9042e8c7b59b84fb6f57517798cae52
- SHA1 30ab0ec13983a6bd9037d3ad0ba7dfa5750f650c
- SHA512 e9e2f0d43400a21e796c3769c8a91546e6ae121ebe04788d1fb6d724595e2b3493720d756e54b6e25b7db6c3fedec8836042d44715dc23f95af5e2509db1f4d1
- SSDEEP 196608:GCscLt2ZJ1AD15fK/1paqJ9QKGEumFPAxaKoxAp3nr2t:Qn3Ify/186xTjKXNu
- TLSH T172963373126084B8D1E6C97C8D373EE232F50A128AC074B695DD79CB68F6DE0B5E3952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\ComputerZ_CN.exe
- Size 3.7MB
- SHA256 e50ded7fa0ba74eb10bccc03f9fdb022d9fb6bbc68bc4755f7324e5f2cc36ebc
- MD5 b833bcb9bfe16563c36be0c430b848b9
- SHA1 a90866f92d6c8af51f58baf08a2982ada27233cb
- SHA512 3c47f162c7503450d4c9ba1e499aa222e47211f96815db2f0d33659758cdcc27801271f33677142f8092cdbc80c7fd1910a29197846d61f073928afb40dc071b
- SSDEEP 98304:h/Fvsdk1uUsXiIl1vEDHjU7xVCZw8HYM+7:JIk1uvXiIQDg7XOJ+
- TLSH T10006CE216549F866D0716E705B36B7F1971FAD74BBADC9CB86883D0A06783C23E20B53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\ComputerZ_HardwareDll.dll
- Size 11.7MB
- SHA256 27a09cadc1b4737ffd8cfb989ba73385332e02cd1662771a449cb0454c3ca3a4
- MD5 af71a585a9e19d0dbbc121cac849f2b9
- SHA1 531e5bd0d8b0cfbcfec8b381cadf1a7af5b9d7a5
- SHA512 f83b55f1df7e6c32510a596555bdf7c41a0fb28666a5df68a15143c2daaf526284dc14b6e1d178ec2ad22222c6968eac3128259aba50c617475ff3af2aab86c3
- SSDEEP 98304:oLIFzAH5QDONPenAAh4SB35slvTA0EFe0GGEnCZVoRZ9shv++ZhmydPZICMmEp5j:oLIq5QDw2xv0AuGRo02+ZhmydCjmEH
- TLSH T16EC69C21755AC175E09D157199BC9ABA083C7A7A1B7184CBE3D84F962DF24C32E30F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\DataMgr.dll
- Size 976KB
- SHA256 d069c6509ba8608ab15f301f57016ba7dcce42e35201a4c2c4e97167e0ce54b7
- MD5 2ed7532cc0ffcc67f948c8d1469504c2
- SHA1 3e84b817fd88786c680dbf5587b24035c0a2846c
- SHA512 7173c8bd56a2f6e103ad1fe684c5f0bb8aacaac07f705e7646057fe9c44f1b483650ec89d5c048cdb8b73b99f38147252ee863651e6de11582c275f61d274665
- SSDEEP 12288:QoyigEOKXAFWW0f9r/832ye+oQv8XoIKjMZdwrNMViSYCIB3ldk:yfFWfC2nuxadwr686Gldk
- TLSH T195258D013B0DC435EA8D0172AC39FB59057DAA221FE281D77AD567BE1D703C35B3AA26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\HardwareProtectEx.sys
- Size 823KB
- SHA256 0ec17f2a91a39ac5bbfcfedcbf2b2d6203cffd6cb4acff1100a17e7947143aa9
- MD5 17886cea8ca119d81c18386db2d60dcb
- SHA1 f32ee26e2f714274cdd0263c5d283ba7acaf8556
- SHA512 c6dbf58f3f655f41a0488f0b508ddd9b29963c9259b8b5ae6cd6b7ab65a7715715f05a0fc3bd91744b69dd5be30decb788b61c1ff8b2c91e32ece98a9b97f8c1
- SSDEEP 24576:8Cq1mY70XDZq03xtsYLH+RJP2DzLOdD7twaJs:8Wa0MkLebwGD5wn
- TLSH T14B05D07216650006E1F6DC7A863BBDE131FA2E334B01E4B585A675C61871BF2FB23993
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\HardwareProtectEx_x64.sys
- Size 1.5MB
- SHA256 e7387e12a0cddaa29a6397f226fdf21143d4c5419500cc614c09a555bb3bda00
- MD5 e0214b87cfd2696be7251a9a172c5c3c
- SHA1 32b14f8c830e9c2be4ea5e6a6306e8b03d44f15f
- SHA512 16caaa2af15504463963373b8e14ade78d8024e5e4b4d9a821dcee1441baa0dc1f38e06d9bff9d2488436ac09d1fb12865759e79e3ce75a57fab9ed5bfdfe10e
- SSDEEP 24576:vk6zLqo4ez+wjebMNp9dJteOdn26Ib9/PU3pZiOs27Wp99dGm0gbv4S2gOZSLV9X:vk6zeovz3H9dJtLHI63hA95jt5OADZc4
- TLSH T1A565CFE96140339CC01FC8309223BD05B1F2791E0FA556FB75A2BAD06B9F9D1E935B4A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\HardwareProtectSlim.sys
- Size 717KB
- SHA256 b78ec94f6512f32d431bafb074cecd8480210ee9b9b2a40eb889414e7f7a0423
- MD5 bc999ef2f36ff70d992fa3b67e514cfb
- SHA1 304dd7e223ea1e18e983360bc9dd003985ba1b58
- SHA512 f580ac422ccc8e1eb44b128b16c013551f52a269bb2424f394fceed43d4552caad3f7a32e5a1419bcf5a7437013838a84f62ae31f2ead651ddcffe5d94f9e3eb
- SSDEEP 12288:VbQxJxKNP+MVLQyVKwSLTMpxV29BQy8Ihh5FVcp51NbtetBHshuXAZgOsxAq3kE+:FtKwZxV2XQdcvFVEXNxmBHsZZ1gUEQ+i
- TLSH T1F2F4C02722750006E1EBDC798A3BBEB131F61F734B41D8B945ADB5C51A226E1FA13E13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\HardwareProtectSlim_x64.sys
- Size 1.3MB
- SHA256 b090e6fbea1a7260b195ccf58564719405efadf7b3b5eb80d1564389f04c9bbc
- MD5 d2840a4a5a86bf1047724cc06b37a2e8
- SHA1 811b7ec3b686393827d47b67f30b6cee1b6b92e6
- SHA512 90cbb26c020ddf2583a9edfeaf52c9350629996af9e473b7fcb4bff342019095d847450455ad3a88087030e3b12bca36d4f5f2aa1a0b8ef566e6f5eea79bceed
- SSDEEP 24576:IjcCgm6eSMG7dtxf92Lo1sOmfic9uQ/D914gBu9OZ9yWt6vf:qgBezudYL2sOEicT/D9OJWt6n
- TLSH T13F55C0AC6154338CC01E84345233AE46B1F1A90F4BD499DBB9EBBE806BBF991D915F0D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\SiteUIHelper.dll
- Size 291KB
- SHA256 00687641802ea47ba4d269c71321341d07ffe11e9acd40d389a46302ed1cdd1e
- MD5 7eca0dc1aeb511d25576ccdb10eb5dc9
- SHA1 f58595dcc43d1609845914da67b2c118910460f6
- SHA512 d6406b295037c3fbb5d6814917805aff8836c5eb50c3cc7cd827ef0725570a7b005af6c72faf374032a2463a01fc7115070c5d3fc047535aa0ab23ed4b64e28c
- SSDEEP 6144:qIZdeAJCNQ8RV32jXiFkUnORzrOlKtyh209s:/ZdexRIjiFkUAzKXh209s
- TLSH T156549E10B9828432D9AE08301A75CBAA45BD75306FF0CACBE7941A7D5F316C36735B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\CefHelper.dll
- Size 477KB
- SHA256 d85bfd004e2ca8dbdfa72a4bdcb1510df76ed56d46ef5128500883c8c7f7c8fb
- MD5 91d986307ab1e56f7f77710664cdb70d
- SHA1 18fe10c7b1ec55632c03b9f06f9d881a022c970a
- SHA512 480659e912ef3053a4542eb2e8eaa3a70df92569e9834d950d9d7ee07e8c9d740b59f1eaed90276454ab71211da41d2f3d945cc486539cba7be3a5c5c0a61e32
- SSDEEP 6144:ExtpXjPTkSCZ+eP7RoWsfopcnXHKOnnfJL+V6BDkfec0AU3Py5Gxg5GAOPLCUoXO:0TwSCZbVbpc7xaV6BgfWK5GxVFLQxA1d
- TLSH T1FDA48D107546C032D4BD21B059389B6A446DAE710B7D48DBA3E83A7B5EB05D3EF31E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\CefRes.dll
- Size 24.2MB
- SHA256 6af751a5f0b73c1ccb723afd0089ea7bcecf0e302afe03f10040fb9c11ce05c1
- MD5 009b2a92ea877e1c8b33b13cc17137d4
- SHA1 fe41711307e7a596e5b30f0ac00d7b75a6002d04
- SHA512 6b68d45bd7707e4bfa3bf8ed0bb9f73205c5c002c634d9e6619a1e7996859d6cf6624037b8cb0c730a7965d8dd7566121401bf4726484814879cb6372684fc0f
- SSDEEP 786432:0nyHxH6qXv9CNFfljNusavohsIB8mU4oKr3Sx61Qr+:0nOlkNF6NohsIBZ53WcQr+
- TLSH T1434733B7545CDF79C95ACC348AB0B425671D35D8CC28C062F98E8ED38825E136FB5AE2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\ComputerZ12.dll
- Size 956KB
- SHA256 019380b69ab5410d923abc86487d636e28dc51fb03015ef15b7c5be7be13b4b3
- MD5 d4bedaf01cc67ad161cd454cff3ddb93
- SHA1 36571a19ae58c8ae9d1505cc0b6b673be47b1756
- SHA512 d121d8d2676f6426aa94ee31af93c60ce72b451c8d48cf1e98ce844fba997da859a2140e7d2f4fd2c34ca9f1fd1ace3b8a84c8befa74d035879a036b0671ea3c
- SSDEEP 24576:oo9/+kHra7cezowFHCKJ4EWSjgHiz7Iv4i72JlVPS:Lraj8wF7JEzCz7IvsJlVa
- TLSH T1D4258C513A09C032D6AD01B15C38EB6A40BC7F760B7188CBBBD87A6A5D705D39B35E27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\ComputerZ12_x64.dll
- Size 1.2MB
- SHA256 a876bee4db2c330ca4d6e959ba878c28a2032d2da4a03a1a4b5e1dae9c8612d5
- MD5 0e426bd24d7a8b9058622259a6da352b
- SHA1 ab833eee8362f1f32537a436e1fb95b810010db4
- SHA512 d7c90110f053158db57e1d1d6d9790dff03efda64b2186a0b0da26bde06d58a77d580cfc497ebe037cdf7da398292b7b1e35b377f52bd6f60f5699aca4f39200
- SSDEEP 24576:gQ6Ul1T5Z8A4tZllnW/8OrmipDYdZTUCuMaW1Fumoo:R6Uly7lOi4wZgDMZuPo
- TLSH T111559E1577A841B9D1BBD138CD634A0AE6B2788607718BDF02A0566E1F37BE28F3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\ComputerZ8.dll
- Size 241KB
- SHA256 c27454a2e8b56665a9282fd774b8568da3aad3a00b1ff673c5115a28acdb5f25
- MD5 08d4addb59ec78303aeeb2b08030defb
- SHA1 ea058e83945ef8e20712ff1c7659d528362d1b46
- SHA512 ef792cda42ebca4ea3c6547b0c7f4d1aa603cb71922db154b96b22deef6ba22d1a5cb23849cf168281aaf7c956fbd46976e929ae15f3295491724c363e567b6c
- SSDEEP 6144:CgrMEjsxnVxjGbHsu/mbq8bzE5zN9k8G+Ee:sEjmKbHsu/mbPqz08G+z
- TLSH T1FB348D507681C476DAEF1430567AC7775ABDBE304B60C8CBB3D86AAD4E701C16A38B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\ComputerZ8_x64.dll
- Size 288KB
- SHA256 f2e0d6fa5d7590bfc694ffe222e503dc7171ce585bde4feec3f165899caf09a1
- MD5 5a0f33714bf8ae637fb6800473819af7
- SHA1 b788684a669362765f472083fc316f7d36c0eeaf
- SHA512 71113af332c7e78a8cf9a1a7221d4c10c8b6db6f61f739b3ed3755d50e130dbe26e6a73e2c370be5fb9c89ea3f711f5027a19e8df32920407fe8fb67a5236dae
- SSDEEP 6144:mNLgy6+o4RF/pmabfLEK/Is9+q+ga4o5bAoJa8VCdPw4iGby0nKg:mNLgEzVmUfL5/LOJOw4Zbnf
- TLSH T1FE544959B7A40CB5E977C23E89538615EBF2BC520B60D6DF03A0436A1F337D29939B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\LDSBasic.dll
- Size 1.7MB
- SHA256 fb3b48b2980ac6cbecd7c579a58e0358dcfe03ea2d66c839e965627c4612a619
- MD5 2d3d1b3fd61d0230161b1c43e367df45
- SHA1 a1090c691dd54b9bc2509c0e81d00cfeb6c2db32
- SHA512 217f7f1f41c26e0ac9910d10f0ff2d538acc0156595244f33d4bce018a8097d1911d5a668e3a6d889e5147b27a40b7cd6904e2d8e1d49dd53eb184468fdb1764
- SSDEEP 49152:7lMT8cA4VPho161nINsq0695cPOieKd3gRBP:hMTPQ1EImAcPNvd3i
- TLSH T1F7859E127A82C031E4D900B252BD9FF91D3D6B311B3984D7A7A42CA599705E3BB39B1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\LdsVolumeCtrl.dll
- Size 104KB
- SHA256 23785aa5bae50bf822f3b2306fda41743b5937d770a8d9f391fae8f50497e20b
- MD5 e3de14a4c2e1ea9c73d6e865a0fab837
- SHA1 489f2b30c5e6c2af516e69ccad1f96d34411e66c
- SHA512 941d8ec98afa5acd4b6a9d52c126e86c1e1f3460660171f70631124a422ec24b7f3c9ceca17eca01142b398a71cda045e136ffd420c01eba8cc4c883ef0cb0ef
- SSDEEP 3072:ng5WCCe0hkvVvM/X/fugOZHtn27D5QitdK:gUChMmIX4e9QitdK
- TLSH T1A0A34A11B5908471E8BF4D3E0421DE741B3E7524DFA1EEEB379422AB8E752D09E34E1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\Ldshelper.exe
- Size 871KB
- SHA256 ae9ea86fcc401d29e5b92e2cb6e6b6fe0cfbee7408f781b2e217a509a533cc94
- MD5 789ff3ad5461728f393f86ffc0351fc6
- SHA1 c5d994ac9dfe8440ddc9fd4c8cebe9776cf13356
- SHA512 c7500c88125b278de8e17a602d96d26b703aabbbd3624913afa0e56d313ec0a8abc0080794061de8e5f4688bf45c0aa136019509420437222e8452e5da8c62c1
- SSDEEP 12288:aIbgCz99pFHOthpPwU7VHrQ3cAH9mMzXxnJg967HiCoOTkgL6UWXM0Svt5:aIbfDiZVLQV8ITfT7uUSst5
- TLSH T123158E123A82C07BE47212715478AB7624BEBF311B264AD763D81B794D706D35E32F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\LuDaShiHelper.dll
- Size 164KB
- SHA256 04b4b37315904097e7d12d72400dd43c3f1afa39147f974299e506a152a75542
- MD5 48484aa35450ac9595af42af04dd7f4e
- SHA1 734653c55ba2a66e893b3884e9fe31d57851051c
- SHA512 cafcb978b36c0ad7aa4255f207dcd7b69c32217c959f03c4a63dd6f67d4f9a7e1fd008787f2ba38deabeefb5e4b58c1a7e274baf327005ad35e33b0f00758a3c
- SSDEEP 3072:+OkwEdyQACW5+qS5wevVC2ZLkVwDj76maqI9OK7FGQOq2naR5s8MMMM3o68hho:NkeQa5fSnVVZLkkPle9pFGtjNo
- TLSH T149F39D817BA0C07AD69B283C5129D7725E7B79714B74C9C3B3945F798E207C0E93A38A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\NavAd.dll
- Size 281KB
- SHA256 c4a019be64262055113cbc0be66d57eb56d750fd0cf57af623d589c94d3dc1c1
- MD5 b235e69a3ae8f02e68bb94190bd238f9
- SHA1 7747450aa888f6a59258c574a2a5a0cef5a06d54
- SHA512 9cb74d447accfed346292370de31cef6b1c53a29b7d9a4b147dc50840941cee6ee65147ca8dc71c7cf4491e88fee1c6f0a86183c65f2bf22ab8cb38a4eef489a
- SSDEEP 3072:+x2SNmWD+iJNyGr9fuK3Okb8Qm80CIkSNPsiSDPzPnH7ikGJXq4KzCEO7t23Vha+:C9uK3j8KOshP7b/GZqjJoeRB90K
- TLSH T10554AE50BB81C473D9CE09355166D77A4BBA753117A4C2C3FF881E2D4E312D2AA3A39E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\NavLauncher.dll
- Size 111KB
- SHA256 b3b6820713c5c8e6354eb8a48f83d18ab7253b2dbec38d2b6e49a550fb18edea
- MD5 81c7432015c24ed91800f759dc2bfabc
- SHA1 d94828fd9dca99f840701437a1c041f647c58dfc
- SHA512 950067663e276aee30a912602c8ba7a00bc18d8e9cb3417da51be068a44e6e54eb31d6f8ec92e68ec84275926abd75517ec0c289ddb804d952fc0bce3c795ca4
- SSDEEP 1536:Zwhx8YtODcFm8JrGLe2fUGR6ly1mmXNrkbj3V+2XWOy1jEKu5k2nCc3h0X:Zw5xo8JGq3flycmdmnWvjE35k+mX
- TLSH T102B39D117750D032D09A683E4165E771AB3FB9B18BA5CCC3BB6417B94F603D0EA3A35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\NavLauncher64.dll
- Size 392KB
- SHA256 97e71f6b65f749b070d47d22bf0c5776d79180e19cd4bbbb5a9a33da037ef5c3
- MD5 fdc2298ccfff6d6b43c2d0f7779ef9dd
- SHA1 8bb48b41cf55f9baf177eee720ad7cf3fe3ebce0
- SHA512 0024dd6e63e6de0d7b585ea0f03eb6bd4dd30104a70861eb2b09bbe7d577a4f25a6941f0dd2513b51a73b979a174d92afc81507085e2d784dfc7b81e7414c8a7
- SSDEEP 6144:OBh2VAxGWMUzFZ0zth75xbKpw/GI2qzlKlrjo1Yu9J/oOCeZIPohj+FGODuBjSn9:OBEax4UJZ4th75xGpw/2qYuSPoI9uBO9
- TLSH T1AF844B15F7E504A9F173953889738A02E676BC5A0770CAEF2364421A1F77FD09E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\PCStoreSetup_officialwebsite.dll
- Size 10.3MB
- SHA256 ed93f5fc7d3bc958b15f4f57a149abd16cf58c985dbac75d592cc41c3acf7345
- MD5 214063c2e8eb56472421ffcf066fcc5e
- SHA1 0802b450986e2c954fa13018e3fda122a57b7c47
- SHA512 7e5f8b00a00b4130db7bb69d863001d24b38c510d1294487878bc224c673dc280c1962e477048720caa81d6cd237a37c4b947c8490dd4822de43b1b1a96b8ff5
- SSDEEP 196608:KBgr0YdgKthQjWXOEBMelTIJau/+OdeuutIKB2s3feeLVOUAev:Br/dgKthWB2vRILLdJ4IKY+fJws
- TLSH T188B6F1A2F776C031D58A0230E4AABB69C8FB9E30332541C35E947EB45865EF1553F27A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\PageMgr.dll
- Size 425KB
- SHA256 eff4f5d5632a3ffdc06ee91b80f429df3a85d3b4c73916a2a08fac433230bdbd
- MD5 019559fa067a3d9393d6ef37eed4719c
- SHA1 35fbd0221ac8bad7a14f8d7fa86750d89fd595bb
- SHA512 48b6fc945d356ca57e0c72249f39d1fd1adbec6276050c0cce247d725a3a1162a3c61c0badcbd0180f16abd705969f1ad7ab2f9de331b1e3521bd0c959b96eba
- SSDEEP 6144:rgEqNM0xrQN1qt/rudziR7MValhsflB1/OcyNRzptrGe2ZlK0DY96:rgEeMarQNEcihMValithy3zS/lK0U9
- TLSH T12E949E00F5418432D5AE053478B8DB6B193D7E205BF984D7B7D86B6F1D312E21B38AAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\Pop.dll
- Size 779KB
- SHA256 7d2d9b02acbee9a0afe04d6e7f9d3f4336ca9e31cfa0ad73c8bfc031fb0058e0
- MD5 f6deffeb114254e0bcece46eb8951a5b
- SHA1 b1ba2d37c6fb3776e525ae0de522e6939715f36b
- SHA512 9e2f830e08bf8aaac84c7b757a7bbc5b763141710015ae41dc075effb375fd7915700be05d78a9661be8d3543ae02029f02d15e1c21f98988e16800d607427da
- SSDEEP 24576:S+ZmX6IbNAl2SrOOtNGai4C5ndGu7wK0m:5ZIbNAHtNHcndGewK0m
- TLSH T160057C21364AC031F5AD017158389BBA446DBE350F7188DBE7D4AF694EB06C39E36F26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\PopEx.dll
- Size 554KB
- SHA256 2d7fcf14674527f524f3ec19d090b9c8367cfc7db6533b4e88c6a769836c5597
- MD5 c6494b04750e6757252e88cf5c061530
- SHA1 e8e0becd8e5daa11529e5d5c3ae3051db6b0ebdd
- SHA512 fc45d135239d3273813fb22ba59620b2bf1ce973cab9f7b8a59d47d4347fc7a5f8c3ef97a51c2e859f2f081d8e9e90b7e79ef41371835efb02ea379a2d19952a
- SSDEEP 12288:wWbNeF+VF+XqURBFvR/aHTUfSgRKKj17HMoMqm:wWbNPMqoqTUfSgBx7HMoMqm
- TLSH T1D5C47D113942C036E17D127049A8A76605ADBD710BB199DBF7D82B3A6EF01C3EB35B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\ProductInfo.dat
- Size 87KB
- SHA256 e10a0a93fa88bcae6618fcb71051cf3c893bc19409ad6fb9578c2bd8a8fb77f4
- MD5 c4e602bd780397e61daab7394ae39b28
- SHA1 81abf2e28c681d99999a7c046e0629d03031f898
- SHA512 01e9247813038f4a66f4dc1642542984a95e2ee8d0d1580a52ad7cf5c51e5d8e2fb904a3438955d9600a9f22a51d88cea1f663df309153959beb2099c4efa1fe
- SSDEEP 1536:nrjn9HLVkiwDoE+vPHEres/uick8zjtGYStlqdkMcgRFZseAzY47:nJLqoZ/Eredtx2X
- TLSH T1C69359D2B83BBA451C18D7C87AF9CA2A51ADF152E3E4A5F84555BF66CF30CC31798280
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\WebDataMgr.dll
- Size 677KB
- SHA256 ddb9a485fef65a3a92ef94f9169a1ad3996d92d450ac947052eef91be1f0dd79
- MD5 c7053f00f6267d5a5e9cc09df392a651
- SHA1 b324e8f786faa6f80f3a6f0fb6523eb270e8af7f
- SHA512 cb78b7c913e8222210037a2cd903781fd99f23bc4433e23de50f4ddc0b8631b94bf730e23729130e0866cccf4272e49160f49d8c87fb7f9a3bed43a9128f899a
- SSDEEP 12288:oDzmQCE7CKxhxwD8Ewp4ru9imPLer4C6HPjiXTJu4+c/e1osQEkrIE8NUPRpe576:oDCdE7rxwdwFFPjqk4+WAQEkrIVNUPmu
- TLSH T151E49F127945C031F56D00B2693CEB7A94BDAF310BB049DB9BD42E2A4D705D3AE36F26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\WebView.dll
- Size 1.9MB
- SHA256 3cb47fd6f2e653382c93006dd47eb9d2aca6b47e80c05992a5355cb9843c97ee
- MD5 e68618982c94bc388d59de8cae81ea5a
- SHA1 6f472bec25b114292221c87b24aa883f2eb64448
- SHA512 91c56505ca14d2d621407d5dc0e33c4c10416d4061bd30a5a3d8e9f56f34d02b0a588cbb92d39590249c069e3aceb34bbf826d2539750c4f3fc7343e3d4d5c65
- SSDEEP 24576:ipnc50hFCb5OuCko9pNMgqV+kaKzEpvB+pj+Bop3j0G567ZIjky:iVc5TipHbKgHOgop3jlot6ky
- TLSH T19B957C2139C18226FEFF01BB8AFC691D045DE9A00B6859D741D816DF9A249E37F31E63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\Websocket.dll
- Size 1.8MB
- SHA256 8238b12809fa9540566b373e97e3947a8543d27def5a6cdca428d8516256dffb
- MD5 1c659410366b145d81cdbf3c92878faf
- SHA1 e87c7811afc4b2fc7c08750a03027381c4cb609e
- SHA512 c82fe7e7943cb9c6d2f5e9f5904ae41096182d2ae777460721f563781305cff9296d470fb118fb4e30ea29f55e67f230de41e604dc418c8fbecd206353487ebb
- SSDEEP 49152:72r/zV2z0AIuJiUweowIFSKP/M6s3+d3NTs0RY:6DzV2z0BtDx0gMR3+ds
- TLSH T11595CF12FB428572E58E0371553A9B7F883DAA640B3189C7D7D02D7E8D711E3263B72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\arctrl.dll
- Size 551KB
- SHA256 d9dec9914a31e6396349186659c6ffb351cfb0766a8b5f9108fbaa41c92462d5
- MD5 5d5ff285798b4fb701632f92a598142d
- SHA1 709d2346fd44ae3171afc065589f0db547b49eaf
- SHA512 456a41902614f7c838c1cf68a96f551fad428629ac8f0738091f4b9ce73b3862f63ff95d6856f93ddff64578d05998aa0927c29fd03d94b15fe78b121692b942
- SSDEEP 12288:bvdt4elcUC69bpNhxpWPzGxeVvx/ToGfnrUjd:bvdy/29qGxivx/THS
- TLSH T1D6C47D113A42C032D5BD117159BCEB6A14AD6E710B7149DBB3E82A3A5EF05C3AF31E27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\instcore.dll
- Size 411KB
- SHA256 36200786c7e9c0b66636b0be13b8d15ceeb21ea797b59b4bd118ac21e3417207
- MD5 47b2c31bc568b8692b607bef27f4fa1d
- SHA1 00e542b7fca1ee66030adaf40c8bbfaade17dd87
- SHA512 bcd09ff477433baf937da073157f1800e0a03a95f792d7b62cb4f0d52b5d6446698192186dcbaf090d9a0627a5c1711d2b1f9d8589495e91268900bde8ea7f19
- SSDEEP 12288:JWr6dCOsaIjXinR996KzfyXm051SDhSWI//VDF+:kweaIM99dTynSdtK/VB+
- TLSH T1A1948E11B543C032E86E01742D78ABA7497C6A714BB949EBE3C85E7F9E301D25E31E27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\js_basic.dll
- Size 1.1MB
- SHA256 4f66bf85f00110ca3ee21d1e038b25c97c13e2f91cd514217ad59fca23ac5c02
- MD5 6cf181e7db1b5d7776ddf5044c6188a9
- SHA1 4da3f1865575d3eee8d420ac61015b7b9ef3c4d5
- SHA512 d2ca52fa7362d7cb830807981b03efd4c78e9bfee2917b16b6b87b9f17393dbf2f938acc68f1f0aef7f55f7d6bf7113c4c06bd4aa1be1d2d196ab86ee050a294
- SSDEEP 24576:KAMmL5atpg6j8lBHfRxxXz3m5FMOUFvYIFOB:fxyS/hjW56OUCIFOB
- TLSH T11D358D213506C031D86C02B0593DEBA9846DBB771B7148DB67D8AEA96D305D3BB32F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\netul.dll
- Size 1.9MB
- SHA256 480c4c286a55562468d29da6771d38020d81c0af9d3883be10fd4a2f3b50d0ec
- MD5 7c450e5f5ce44c5acb8f3b27f5f1dded
- SHA1 095c36b0db24a11389d901540e8b76c7aea518b0
- SHA512 c70a53d23d70cf93f3f9f40fbcb3cb7d49378185aa0c97683439900f5f2dae0cb7f6e279c856d56299dc993ffca786cd8e52239f2f2806096073f21bb00b63a4
- SSDEEP 49152:bJKFNvgb9uHrzE/6OctNYdtD3QX3Lzoa7TO9GuPCNtRVIhDVgr:bJ64b9uHrzE/6O6S2LzIGtNR
- TLSH T11795AF12FB8285B2E5DE013951BB5B7F4E3A6A240328C9D3DBD02DB58D312D1763E399
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\product_helper.dll
- Size 727KB
- SHA256 db382ea923e2ec3da7f004b932faa7854ac723efd3a4d01d87f96d4bb5f145d7
- MD5 75654073797ec30585cb0d0531f741a3
- SHA1 8d6ea13c4f767191a286fd012b20443772d4341d
- SHA512 ea13fb5c67344540398ee4467c66301681f1bf452bdc7a739d8eb611b98c89cf845e424283f0862e2bcf8650a7f803bf884e6e54f971b2bdd1ccd2a9e2cc103d
- SSDEEP 12288:2dE9voAwemkedaB+i8kjKD6mtzpsjYnrNwA5JYmdwJauQ:2dEtol9YEipK5tzp5QJ4
- TLSH T141F47C423742E0BAD44F0271501DDB3E5E761A255732CDE79ED0ACB89DBA3C1193AE2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\Utils\product_helper_x64.dll
- Size 839KB
- SHA256 affe4376e85fb36d30c31ee3cecb5dbd82e97d87d1fd04aff2b35789055189f3
- MD5 551e02af61cd1324f18ad0951f87eba7
- SHA1 8a33d2332f345bb29b7409b7173f590473cc1f2a
- SHA512 e686f1883ebc1ea02a086e916ea315b4404c931e7b854bb31cf38d87a3ad51f840bd6ea0d0fed4489d33e6e9396f345285a76f3f235f94ad2bb3b1ef115e7268
- SSDEEP 12288:rj9jBYRL0gdMZYS+cAgdu26BQHcgZpc5IfJqSoDDVYZu:/9jBaddMZvAgdu2FPcOJTSVYZu
- TLSH T10B052912674EA8A9C06BC474838B45226A7178CB0B357AFF029465793EBFBF40B7D354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\game\gametray.dll
- Size 457KB
- SHA256 16ff1a3abe13bb4f406ebcb1badcd90d29bc1244cae587b8b560c13e4b6b9af8
- MD5 39bbb7af971f719b5b2aea41defff699
- SHA1 37483ba9fb0bba070a11a7e81bbcbb02b624edad
- SHA512 2f2db044bfe42f6c3acc3acb3959db8a739b0057b43b1a920c6c5b899c96368333e799f4106531a457a383d32d892599c53bc7efc6e1856d2263bd1f0f617de8
- SSDEEP 12288:iZ6T4MdO/VSfWoituArlAf+rwnu28abEIpyhv/:i4xd03l0Iwu284ax/
- TLSH T145A48D107587C032D96E11B0683DDA6B146D6D650B7888DBA7E83A7F5EB01C39F31E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\sites.dll
- Size 1.4MB
- SHA256 4bf0a6d8c9ddbd671ceefe0e58d39e942bcf631cd7aa43604fbd1aaa41a5f814
- MD5 bcad5c8aeb6756c24e1c3d2d62a3e6a9
- SHA1 4082d5561dcb55f81d2751ae98ab01f113361885
- SHA512 2998794ae6693b0330990ce7fdfdea0cd37b05a7142d293805c2067237349387eab0cf60fc32e6840de74979b8048e6557a76a5472865a9178dcd97e5a8d1862
- SSDEEP 24576:eJ7DIuF1zWl97vJepviZy6Jy+VNkvWzj/+WtF9o6BXW0WJ:eRDPLzWl97xlAWDXkvsj/+WtLo6BGH
- TLSH T157659D1237C1C47BD17E0372DE1A73F597F5E2311A31AA0BA7C44A1C1F34A87DA2AA56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\themes\default\default_theme.ui
- Size 90KB
- SHA256 602dae8b624b29498c5c13d58f65a3697b82e238bf7870c9f5c93eda3cc7ec8a
- MD5 cdf53b97941b9140fdb70420cf8b0d09
- SHA1 c72caf3a88984b8ee78fd94a2a72e0c6105da1b0
- SHA512 012231f4e7a0940e983f50c2aa4635734e72c7d760c21d51b31330db2e15b4ef4e2f4f2cf84320be65a1aeb9fe31c5844c10277d3df929a9ab3a35daf8a1d5ba
- SSDEEP 1536:TwtjPM95WstSEidoKjsLacVtlwahlT502HnjFHKD/XDQhkiR5:KjPM95ftlvb
- TLSH T1DB933A21F38CA94AC35489732AFE4424564FEC678BB0A827FC16B83761561F24C697FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\uninst.exe
- Size 1.8MB
- SHA256 8e5d49a673265dc01e73389c21d2984fab56bb1539d7814066cef7fe86e3bc18
- MD5 cdb7bcd1dba461952a30e0230228b86b
- SHA1 2bcadb2421a334a4cb47973fcb0bdf7f0858b642
- SHA512 d0bf8fd3622fbb15dde11671d41ffa6420896e995cc5577f7ca96e6f4ba7741ebc9885fd06383b529a5b013600531f013ba2032e2f36759e0eb0e59205e99ef6
- SSDEEP 24576:RxWKvdyQh/AvFMOU+w0scsjrwzML+TsnEEwiNrXcchsYGq7Rc0QJoCNOnuXdNgV:rWCth/S0LA4LU2NrXXhsnYWSuXd2V
- TLSH T1B7959E213A42C036D96A10B1897CEBB955ADAE305F3141C7A3D83B3E5E706D35E35B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\updatecfg.ini
- Size 10KB
- SHA256 cb0566575c3191856fc9091d2b7f78514a22dff148327fdde4047865a5d7cb37
- MD5 d2a3fc1fbe1d8e096e7663155fc3dd10
- SHA1 a91fe70068a463059a4f9bf5ab2dec458918dae4
- SHA512 245db5973c435cae573414dd0e1648fd1921e53a235e3fb74bdb6be859420c417d5525f616ec69b9b5e200d4552b5d64d48b9e7915f7aa1c3df49c2756284dc5
- SSDEEP 192:KZxRuzjrzvvUTIm1DHs4Ir7OIrU2bjd2e3pDKhEYdrafozt4ie:c5Em1Qj3XxOS
- TLSH T1E422EBB45031D49F2433DB90E6B5B9F0939C3BDFE591C801A19C661B5C43FB36AAE298
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\updatecfg.ini
- Size 10KB
- SHA256 d1b0478bdda791e85d566b98fa3fb044f05a4005eb472ee67cddef0fd79fe0d4
- MD5 6d69ccae3a9f80900500ea73e615102b
- SHA1 d92026a0201bef3c04e7de2711fa7321874a3c87
- SHA512 9ffdb19c6e8dee24f7edaed501494ddbad627226bccb6d0e178ae66095ba728d4c5039264fa32f92ff08ea3bfb6cf8ad064469884d425c13e4afd551e3e48f18
- SSDEEP 192:KZxRjzjozvnUbIm1DHs4Ir7OIrU2bjd2e3pDKhEYdrafozt4i2:cpcm1Qj3XxOK
- TLSH T14622DBB45031D48F2423DB90E7B5B9F0939C2BDFF691C801A19C661B5C43FB36AAE294
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\updatecfg.ini
- Size 10KB
- SHA256 089f09220731d48b3a06fa0a101d4712e77de9edaa1c8784abe445452de2e69d
- MD5 c65d7e4d80cde1aef056f9cf5f17b353
- SHA1 04e1dc8db3f876c724b36dde13bb4913825875e7
- SHA512 ff0fa9ff5a05feda7b70315cf9b93bed972ed64f05d4d2e560cc0e10a419d96be98c11e1f392a8060deff4f32634d9c84d4d4f844cd531a745354715ca85734d
- SSDEEP 192:KZxRjzjozvnUbIm1DHs4Ir7OIrU2bjd2e3pDKhEYdrafozt4iSP:cpcm1Qj3XxOuP
- TLSH T1CD22CBB45031D49F2433DB90E7B5B9F0939C2BDFF6918801A19C661B5C43FB36AAE294
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\updatecfg.ini
- Size 10KB
- SHA256 4e7cf3931e6702f0e82ce220024336892d41d5dc42dafb076de44902458b44ca
- MD5 b4840843ff08a0840e2a4d4523ccd8cc
- SHA1 d3baf4b19caa30ac19cd9f1903f51fcf7dc706a0
- SHA512 7721538d383fa695ba8ab6a4c576b902a170703922f8e014118546bdfca705c2141acb95d23b6e0206a34423182301c62e8f71499b40cdeb15e87780ab231ce3
- SSDEEP 192:KZxRjzjozvnUb7msD9j4Ir7OIrU2bjd2e3pDKhEYdrafozt4i2:cpfmsxj3XxOK
- TLSH T12122CDB45031D48F2423EB91E7B5BDF0939C2BDFF6919801A18C661B5C43FB36A9E294
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Ludashi\updatecfg.ini
- Size 10KB
- SHA256 15d7a0d2138d1b7442af05b82eee8d8b2c4cc77d6d6f839fed581734b62ce5b4
- MD5 ea151a3e017e9ddb996ec6c721cd4b49
- SHA1 c6ea55cd3d43cd6a8c1b73de0fec049fb71cba92
- SHA512 da1f78fcd54d36958187d0ad4fa9592d8bc6bdac831adfd223e40ba1bc8ddcb8e170ea1bbfd7b237def8b4129ae2a1f6d72a071d8b706a4b80cb79fd53917b0e
- SSDEEP 192:KZxRjzjozvnUb7msD9j4Ir7OIrU2bjd2e3pDKhEYdrafozt4iq:cpfmsxj3XxOG
- TLSH T15422CCB45031D49F2423EB90E7B5B9F0939C2BDFF6918C01A18C661B5C43FB36A9E294
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BWL9CVZL\pc[1].htm
- Size 37B
- SHA256 b96fff2e4edb3bd0c1ed901021b69a2dffe7040b022a409b47a66ec4a00d9e91
- MD5 ada78a022ea49f281ec66c46d0e079c2
- SHA1 e21d7168ddfb77b723d01e2d8a24001f9524f20b
- SHA512 24933940a69bbcd247636316ed9b7373020b86c00984fbed79a7f635c8e4620910d86a3340e58ee57611a9c5c5542e499bc5813416d0e4b640eeb5a7a01756b4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\lds_setup.log
- Size 375B
- SHA256 22f6e574ccd677133010e314322123a966a2d626b61362f877cab30d99b12ec9
- MD5 cb7b8bab569f8c23c1662072ee399249
- SHA1 98b5fb4f3d22681a3562d0bb9a456b6d53702a3d
- SHA512 779108aea8e2e522f6f06af4ea65a3307f45fda18cdaf63f6128b7e477b4816fabc97ec26f44916a9d43e9d101f8593a8f3cf7b063cd6e1200e212b1b660ac6c
- TLSH T133E04F9D006569F1D99C262FB9831F1D999ABE52182A30372B76347C8BC2077497DC32
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lds_setup.log
- Size 2KB
- SHA256 245633c13c5a4df0b84309fcb98093a0d0fbc60d364865368b85f350c3e025c4
- MD5 54619c6149e8acc67de626cbb73a4b33
- SHA1 e7aaf029814b08f85ee885dccc2abb7a0650f97d
- SHA512 75f65d7f9009cefc5e34613c96e22b7bd4b6a59f3a79d3259da24a9d772d3566be481dd7769239526272b288dd17aff7313ac8a01b0281534382d780c0c00d4f
- TLSH T152413A4E016E35F1E44D2515B7D21D394DC9BE82103A21322F37B86DAFD64B299FDD22
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lds_setup.log
- Size 4KB
- SHA256 120364a0c45ee1ea4834b1238a9ff3abc5dfa56fd77fca55e71c02b07021935c
- MD5 92cae0e435412d3f6cdec2abcbb07939
- SHA1 c06fad64b74b63748d1050622c4f9b5ce5101d6d
- SHA512 30a2d6b3606f92eb7429578adecab2da8eaa2b264fc80cc5fe84428e3efd430988bd3dba83073bda63d206391cf676273e8f5f7e6d8ef274054f139bcf41683d
- SSDEEP 48:KN5DC6+PWMmEXkpnpolkU1BBVSRDikd8EPc8s1XisLeabY6Q5QXJM81F8GtDuqpw:KN1C6almmk1
- TLSH T1B5816C8E016E35F0945D2115B7D21C394DC9BE52103A25322F37B86CBFDA4B2A8FDD22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lds_setup.log
- Size 4KB
- SHA256 ddf0c21252a37409d86a18512009a2944a77e1def504a39b6fe6fd1d89a7863b
- MD5 f01755b7f10ceb963627bc0c46b7fde8
- SHA1 ae81fccc75396c3991cf412141311ef9e3c1319d
- SHA512 8b360d0b70f90d16992c882b03279feb5227698a11a01ff50157d7a22d48242543175a5b4c3a022aad1e5a1b9c63300a63702885cc69a99f184af097c2229407
- SSDEEP 48:KN5DC6+PWMmEXkpnpolkU1BBVSRDikd8EPc8s1XisLeabY6Q5QXJM81F8GtDuqpW:KN1C6almmkSE93
- TLSH T183A17C9E006E35F0944D2115B7D21C394DC9BE52103A25332F37B86CBFDA4B2A8FD922
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{434BE9D9-1490-4e46-98B3-2770AFCE9CE5}.tmp\7z.dll
- Size 1.1MB
- SHA256 0edad8a1af22d5b97c1f324791c86243a6ecce7b5a9d2f30415af99aba9129c3
- MD5 2706693dda10c6cc79eed24c56d4e5ef
- SHA1 4f34ef1bd49273a0d260b9dab15c73eb0ccb6383
- SHA512 7e7f7ae894528587ba33b6e10999549bb9a2ec2748b5662fa1b8806e5f4ce33af47507b3ef2954f2747a76b5b7c775c1cd671061f577c5016d1f8ba165bbe21c
- SSDEEP 24576:3Z+lCPq8bgPqPRzWu+sjvNfEz0z/JiJXoslp:olCPnbgiPRzWFsjvNffJtsf
- TLSH T1F7358D25F7F5C4B8C68E52328534E6A510F9F62BCA20918B76D02F6F7F314E6C624E85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{937CAB9E-0122-40f3-A6AB-B0F650BD782C}.tmp\NetBridge.dll
- Size 238KB
- SHA256 beeaf8b72f7008e9adabacfcd85e32a50747a0dfb5c86802aeb973bd1f5c3d2f
- MD5 8786d469338c30e0ba9fedfc62bd5197
- SHA1 5fb12028ceae9772f938e1b98b699f0e02e32718
- SHA512 5db1e5b78e62cda81a63e8e712e720f87a7c7a539237a55a9098c076f9fb4e0b5adb83383c23657b4ccc90c117e55e3946a399cdf3d15cb94444b203d9d6c45c
- SSDEEP 6144:pJlU7zM4nGH4Ye1XBINNN8YCh2Jo9TB7PTkRcS:p/SMH4YUXBIfPdo9T1VS
- TLSH T15A34AF527B81C073C58F163540E6C72A5A79A265036CC6D7B3586FB69F203D2BA363CE
- MD5 SHA1 SHA512 SSDEEP TLSH