Analysis

  • max time kernel
    172s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    14-10-2022 10:27

General

  • Target

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc.exe

  • Size

    40KB

  • MD5

    6780a7d7cae6ea886328e3cb1ed52120

  • SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

  • SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

  • SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • SSDEEP

    768:hpUt1E/8mS+amkLFRccny45nHguULqGnXR:hpO1Ek93yAgf2kh

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs
  • Disables RegEdit via registry modification 3 IoCs
  • Executes dropped EXE 4 IoCs
  • Sets file execution options in registry 2 TTPs 12 IoCs
  • Drops startup file 5 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 12 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 6 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc.exe
    "C:\Users\Admin\AppData\Local\Temp\80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:112
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      PID:992
    • C:\Windows\M13516\smss.exe
      "C:\Windows\M13516\smss.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Sets file execution options in registry
      • Drops startup file
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1844
    • C:\Windows\M13516\EmangEloh.exe
      "C:\Windows\M13516\EmangEloh.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Sets file execution options in registry
      • Drops startup file
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1724
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Sets file execution options in registry
      • Drops startup file
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1312

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\TuxO41414Z.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\TuxO41414Z.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\TuxO41414Z.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\TuxO41414Z.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Windows\M13516\EmangEloh.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Windows\M13516\EmangEloh.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Windows\M13516\Ja634608bLay.com

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Windows\M13516\smss.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Windows\M13516\smss.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Windows\SysWOW64\885154323741l.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Windows\SysWOW64\X38112go\Z885154cie.cmd

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Windows\SysWOW64\X38112go\Z885154cie.cmd

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Windows\SysWOW64\X38112go\Z885154cie.cmd

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Windows\SysWOW64\X38112go\Z885154cie.cmd

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Windows\Ti323741ta.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Windows\[TheMoonlight].txt

    Filesize

    109B

    MD5

    68c7836c8ff19e87ca33a7959a2bdff5

    SHA1

    cc5d0205bb71c10bbed22fe47e59b1f6817daab7

    SHA256

    883b19ec550f7ddb1e274a83d58d66c771ab10fefd136bab79483f2eb84e7fec

    SHA512

    3656005148788ed7ac8f5b5f8f6f4736c2dc4a94771291170e61666beb81e63be2a1a0f2913233b0e3f12ddfa7f1e89da9cd8323306413395ee78b2ece7fbfe8

  • C:\Windows\[TheMoonlight].txt

    Filesize

    109B

    MD5

    68c7836c8ff19e87ca33a7959a2bdff5

    SHA1

    cc5d0205bb71c10bbed22fe47e59b1f6817daab7

    SHA256

    883b19ec550f7ddb1e274a83d58d66c771ab10fefd136bab79483f2eb84e7fec

    SHA512

    3656005148788ed7ac8f5b5f8f6f4736c2dc4a94771291170e61666beb81e63be2a1a0f2913233b0e3f12ddfa7f1e89da9cd8323306413395ee78b2ece7fbfe8

  • C:\Windows\sa-533055.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • C:\Windows\system\msvbvm60.dll

    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

  • C:\Windows\system\msvbvm60.dll

    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

  • C:\Windows\system\msvbvm60.dll

    Filesize

    1.3MB

    MD5

    db6d527a137c72a9753e0694cf50ee9b

    SHA1

    6496c00e87210afe369e431b32238ebc03f1de70

    SHA256

    73bcd2b5e3a2a112734c948c78338bf1b44353ea9d36cb8ec84c3fecdb2db0bb

    SHA512

    70966f87d74999621cedd212c5da0698ba8d4977cee7698a8b80fd9cf420f31a8463c5addbe6863c9630575f2717a67dc15d8c223044dfc6974ef811cf38eb92

  • C:\Windows\system\msvbvm60.dll

    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

  • \Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • \Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • \Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • \Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • \Windows\M13516\EmangEloh.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • \Windows\M13516\EmangEloh.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • \Windows\M13516\smss.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • \Windows\M13516\smss.exe

    Filesize

    40KB

    MD5

    6780a7d7cae6ea886328e3cb1ed52120

    SHA1

    d35d4aeae63358168edab27ab6f03ef01e0dae99

    SHA256

    80a7aea258653fb74738ee1089042e26851e69d6c3e52a80bae72f4c041429cc

    SHA512

    b102b0d79be9d569480138effa87b133080e9c124cfac3eb64b52881c54407a850099f53981fff179ef60a6295645748a9ec7eb34b20ffacf5e0005e4d3c7ca3

  • memory/112-88-0x0000000003370000-0x000000000337A000-memory.dmp

    Filesize

    40KB

  • memory/112-113-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/112-54-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/112-89-0x0000000003370000-0x000000000338C000-memory.dmp

    Filesize

    112KB

  • memory/112-93-0x0000000003380000-0x000000000339C000-memory.dmp

    Filesize

    112KB

  • memory/112-57-0x0000000075E31000-0x0000000075E33000-memory.dmp

    Filesize

    8KB

  • memory/112-92-0x0000000003380000-0x000000000339C000-memory.dmp

    Filesize

    112KB

  • memory/112-90-0x0000000003370000-0x000000000338C000-memory.dmp

    Filesize

    112KB

  • memory/992-91-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/992-122-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1312-121-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1312-125-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1724-120-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1724-124-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1844-94-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1844-123-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB