dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 14:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
Size

148KB
MD5

ddae26632cbf076fb6369373af4b87c6
SHA1

701f8c64644162dc86141a58a659d71037484315
SHA256

dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035
SHA512

e411b3e3384349cd539d189ff78a8215e17e50178cbb8ea976c5f2f5b1f5b398597d2540846fe6ef9d12267a0ddc1c8d99214ee10395ce0ae8c135f9d01a9d3f
SSDEEP

3072:NKjntrgpq7EB8Plv02Ms8Zy4ZSptu8gJq3L1iEfVfe:NKjt1jc2MpR8Kq7YEw

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\\SKQ4D2J.exe\""	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\\SKQ4D2J.exe\""	lsass.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe

ACProtect 1.3x - 1.4x DLL software 4 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0003000000022df8-156.dat	acprotect
behavioral2/files/0x0003000000022df8-161.dat	acprotect
behavioral2/files/0x0003000000022df8-160.dat	acprotect
behavioral2/files/0x0003000000022df8-157.dat	acprotect

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 5 IoCs

pid	Process
2972	service.exe
4880	smss.exe
4380	system.exe
4952	winlogon.exe
4240	lsass.exe

Sets file execution options in registry 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\\regedit.cmd"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\\regedit.cmd"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	system.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2260-132-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/files/0x0001000000022dfc-137.dat	upx
behavioral2/files/0x0001000000022e03-140.dat	upx
behavioral2/files/0x0001000000022e03-141.dat	upx
behavioral2/files/0x0001000000022e00-145.dat	upx
behavioral2/files/0x0001000000022e00-146.dat	upx
behavioral2/files/0x0001000000022dff-151.dat	upx
behavioral2/files/0x0001000000022dfc-136.dat	upx
behavioral2/files/0x0001000000022dff-152.dat	upx
behavioral2/files/0x0003000000022df8-156.dat	upx
behavioral2/files/0x0003000000022df8-161.dat	upx
behavioral2/files/0x0003000000022df8-160.dat	upx
behavioral2/files/0x0003000000022df8-157.dat	upx
behavioral2/files/0x0001000000022e01-183.dat	upx
behavioral2/files/0x0001000000022e0a-209.dat	upx
behavioral2/files/0x0001000000022e21-208.dat	upx
behavioral2/memory/2260-214-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/files/0x0001000000022e08-207.dat	upx
behavioral2/files/0x0001000000022e07-206.dat	upx
behavioral2/memory/2972-215-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/4880-216-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/4380-217-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/4952-218-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/4240-219-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/files/0x0001000000022e06-205.dat	upx
behavioral2/files/0x0001000000022e05-204.dat	upx
behavioral2/files/0x0001000000022e20-203.dat	upx
behavioral2/files/0x0001000000022e1f-202.dat	upx
behavioral2/files/0x0001000000022e0a-200.dat	upx
behavioral2/files/0x0001000000022e1a-199.dat	upx
behavioral2/files/0x0001000000022e08-198.dat	upx
behavioral2/files/0x0001000000022e07-197.dat	upx
behavioral2/files/0x0001000000022e06-196.dat	upx
behavioral2/files/0x0001000000022e05-195.dat	upx
behavioral2/files/0x0001000000022e19-194.dat	upx
behavioral2/files/0x0001000000022e18-193.dat	upx
behavioral2/files/0x0001000000022e0a-191.dat	upx
behavioral2/files/0x0001000000022e17-190.dat	upx
behavioral2/files/0x0001000000022e08-189.dat	upx
behavioral2/files/0x0001000000022e07-188.dat	upx
behavioral2/files/0x0001000000022e06-187.dat	upx
behavioral2/files/0x0001000000022e05-186.dat	upx
behavioral2/files/0x0001000000022e16-185.dat	upx
behavioral2/files/0x0001000000022e15-184.dat	upx
behavioral2/files/0x0001000000022e0a-182.dat	upx
behavioral2/files/0x0001000000022e09-181.dat	upx
behavioral2/files/0x0001000000022e08-180.dat	upx
behavioral2/files/0x0001000000022e07-179.dat	upx
behavioral2/files/0x0001000000022e06-178.dat	upx
behavioral2/files/0x0001000000022e05-177.dat	upx
behavioral2/files/0x0001000000022e04-176.dat	upx
behavioral2/files/0x0001000000022e02-175.dat	upx
behavioral2/files/0x0001000000022e01-174.dat	upx
behavioral2/files/0x0001000000022e01-172.dat	upx
behavioral2/files/0x0001000000022e01-170.dat	upx
behavioral2/files/0x0001000000022e01-168.dat	upx
behavioral2/memory/2972-220-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/4952-221-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/4240-222-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/4380-223-0x0000000010000000-0x0000000010075000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	lsass.exe

Loads dropped DLL 1 IoCs

pid	Process
4380	system.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sOU5I7N0 = "C:\\Windows\\system32\\UON1U6PQVH0C0Y.exe"	system.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RUN	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0D2JVH = "C:\\Windows\\LNX5I7N.exe"	system.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\RUN	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sOU5I7N0 = "C:\\Windows\\system32\\UON1U6PQVH0C0Y.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RUN	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0D2JVH = "C:\\Windows\\LNX5I7N.exe"	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\RUN	system.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	service.exe
File opened (read-only)	\??\J:	service.exe
File opened (read-only)	\??\N:	service.exe
File opened (read-only)	\??\S:	service.exe
File opened (read-only)	\??\T:	service.exe
File opened (read-only)	\??\W:	service.exe
File opened (read-only)	\??\X:	service.exe
File opened (read-only)	\??\E:	service.exe
File opened (read-only)	\??\F:	service.exe
File opened (read-only)	\??\G:	service.exe
File opened (read-only)	\??\L:	service.exe
File opened (read-only)	\??\Q:	service.exe
File opened (read-only)	\??\U:	service.exe
File opened (read-only)	\??\M:	service.exe
File opened (read-only)	\??\O:	service.exe
File opened (read-only)	\??\P:	service.exe
File opened (read-only)	\??\V:	service.exe
File opened (read-only)	\??\Z:	service.exe
File opened (read-only)	\??\H:	service.exe
File opened (read-only)	\??\I:	service.exe
File opened (read-only)	\??\K:	service.exe
File opened (read-only)	\??\R:	service.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\MEF6I7S\UON1U6P.cmd	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\UON1U6PQVH0C0Y.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\DCF6L4V.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S\UON1U6P.cmd	smss.exe
File opened for modification	C:\Windows\SysWOW64\DCF6L4V.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\DCF6L4V.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S\UON1U6P.cmd	service.exe
File opened for modification	C:\Windows\SysWOW64\DCF6L4V.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\UON1U6PQVH0C0Y.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\UON1U6PQVH0C0Y.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\UON1U6PQVH0C0Y.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S	lsass.exe
File opened for modification	C:\Windows\SysWOW64\UON1U6PQVH0C0Y.exe	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S	system.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S\UON1U6P.cmd	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S	service.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\DCF6L4V.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\DCF6L4V.exe	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S	smss.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\UON1U6PQVH0C0Y.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S\UON1U6P.cmd	system.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S\UON1U6P.cmd	lsass.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LNX5I7N.exe	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	smss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	service.exe
File opened for modification	C:\Windows\moonlight.dll	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
File opened for modification	C:\Windows\cypreg.dll	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\ILH6L3E.com	service.exe
File opened for modification	C:\Windows\LNX5I7N.exe	winlogon.exe
File opened for modification	C:\Windows\moonlight.dll	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	winlogon.exe
File opened for modification	C:\Windows\lsass.exe	lsass.exe
File opened for modification	C:\Windows\LNX5I7N.exe	system.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	winlogon.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	smss.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	winlogon.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	winlogon.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	smss.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\SKQ4D2J.exe	service.exe
File created	C:\Windows\MooNlight.R.txt	smss.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\SKQ4D2J.exe	lsass.exe
File opened for modification	C:\Windows\moonlight.dll	smss.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	smss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}	winlogon.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	service.exe
File opened for modification	C:\Windows\cypreg.dll	winlogon.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\SKQ4D2J.exe	smss.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\SKQ4D2J.exe	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}	service.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	smss.exe
File opened for modification	C:\Windows\QVH0C0Y.exe	smss.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\ILH6L3E.com	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\MYpIC.zip	system.exe
File opened for modification	C:\Windows\cypreg.dll	smss.exe
File opened for modification	C:\Windows\cypreg.dll	system.exe
File opened for modification	C:\Windows\QVH0C0Y.exe	service.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\ILH6L3E.com	winlogon.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\ILH6L3E.com	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	winlogon.exe
File opened for modification	C:\Windows\QVH0C0Y.exe	winlogon.exe
File opened for modification	C:\Windows\lsass.exe	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\ILH6L3E.com	smss.exe
File opened for modification	C:\Windows\moonlight.dll	winlogon.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	service.exe
File opened for modification	C:\Windows\moonlight.dll	system.exe
File opened for modification	C:\Windows\lsass.exe	winlogon.exe
File opened for modification	C:\Windows\QVH0C0Y.exe	system.exe
File opened for modification	C:\Windows\LNX5I7N.exe	service.exe
File opened for modification	C:\Windows\cypreg.dll	lsass.exe
File opened for modification	C:\Windows\QVH0C0Y.exe	lsass.exe
File created	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\zia01700	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	system.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	4380	system.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2260	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
2972	service.exe
4880	smss.exe
4380	system.exe
4952	winlogon.exe
4240	lsass.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2972	2260	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe	83
PID 2260 wrote to memory of 2972	2260	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe	83
PID 2260 wrote to memory of 2972	2260	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe	83
PID 2260 wrote to memory of 4880	2260	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe	84
PID 2260 wrote to memory of 4880	2260	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe	84
PID 2260 wrote to memory of 4880	2260	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe	84
PID 2260 wrote to memory of 4380	2260	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe	86
PID 2260 wrote to memory of 4380	2260	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe	86
PID 2260 wrote to memory of 4380	2260	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe	86
PID 2260 wrote to memory of 4952	2260	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe	85
PID 2260 wrote to memory of 4952	2260	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe	85
PID 2260 wrote to memory of 4952	2260	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe	85
PID 2260 wrote to memory of 4240	2260	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe	87
PID 2260 wrote to memory of 4240	2260	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe	87
PID 2260 wrote to memory of 4240	2260	dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe	87

C:\Users\Admin\AppData\Local\Temp\dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe
"C:\Users\Admin\AppData\Local\Temp\dcf46ab8880af38e23bb49ba8a606c9149cf7434fbf05bbac68f05acd4bbc035.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe
  "C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2972
- C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe
  "C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:4880
- C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe
  "C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:4952
- C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe
  "C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Sets file execution options in registry
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4380
- C:\Windows\lsass.exe
  "C:\Windows\lsass.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Sets file execution options in registry
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\ILH6L3E.com

Filesize
148KB

MD5
cbf8af0f87197282a3f9c64c560e53f8

SHA1
86f559890d09cfb779a74385f78335c2d3cd6db2

SHA256
1735ec1b44ea2ad6e2fbdfb80028f020aa20a2d68b49ac53b2df6c383dc01dad

SHA512
9e9c53d6dc7d66533269daf410390f707e02de30507c00783d228d50519817a542f9d3a81bdf81caa085511381c83c4f2c4c4dc6b5f98dd32acb03ea248e170f

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\ILH6L3E.com

Filesize
148KB

MD5
cbf8af0f87197282a3f9c64c560e53f8

SHA1
86f559890d09cfb779a74385f78335c2d3cd6db2

SHA256
1735ec1b44ea2ad6e2fbdfb80028f020aa20a2d68b49ac53b2df6c383dc01dad

SHA512
9e9c53d6dc7d66533269daf410390f707e02de30507c00783d228d50519817a542f9d3a81bdf81caa085511381c83c4f2c4c4dc6b5f98dd32acb03ea248e170f

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\ILH6L3E.com

Filesize
148KB

MD5
cbf8af0f87197282a3f9c64c560e53f8

SHA1
86f559890d09cfb779a74385f78335c2d3cd6db2

SHA256
1735ec1b44ea2ad6e2fbdfb80028f020aa20a2d68b49ac53b2df6c383dc01dad

SHA512
9e9c53d6dc7d66533269daf410390f707e02de30507c00783d228d50519817a542f9d3a81bdf81caa085511381c83c4f2c4c4dc6b5f98dd32acb03ea248e170f

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\ILH6L3E.com

Filesize
148KB

MD5
cbf8af0f87197282a3f9c64c560e53f8

SHA1
86f559890d09cfb779a74385f78335c2d3cd6db2

SHA256
1735ec1b44ea2ad6e2fbdfb80028f020aa20a2d68b49ac53b2df6c383dc01dad

SHA512
9e9c53d6dc7d66533269daf410390f707e02de30507c00783d228d50519817a542f9d3a81bdf81caa085511381c83c4f2c4c4dc6b5f98dd32acb03ea248e170f

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\SKQ4D2J.exe

Filesize
148KB

MD5
b5b61582dee53ec504e17e1041dbe4d4

SHA1
bf783642066b75b483899a8e97b439283762c344

SHA256
2aaf0766808726403305f2457c02040d495a4f97debdeecaf6d4a82d4edad5a9

SHA512
29c1d9a04c8636a3d00f89d9ca8d0fd9e76018fac78dfd5b5ea4cfa1567324c0c4f09aa69e3d0a808e986909acc325fc2d8957884c16228cea6e797687fc560c

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\SKQ4D2J.exe

Filesize
148KB

MD5
b22e46a364977fb431fc8e21526a2eab

SHA1
ba849edddbb2ab591fe9bc7cc0e38c31a6df52b7

SHA256
b83e8cb180e6e458f460029943ee92e03c972d4f14f6abb0bcdb164dc1447108

SHA512
72718529979de3e65822fb970cfb19f5fbcd45bbae6901e7c973e640278f62d0e7a7277ac75ffd3b14be4c2a50cb9a93e39937b4b2ca159e079acff85f64b7da

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\SKQ4D2J.exe

Filesize
148KB

MD5
b22e46a364977fb431fc8e21526a2eab

SHA1
ba849edddbb2ab591fe9bc7cc0e38c31a6df52b7

SHA256
b83e8cb180e6e458f460029943ee92e03c972d4f14f6abb0bcdb164dc1447108

SHA512
72718529979de3e65822fb970cfb19f5fbcd45bbae6901e7c973e640278f62d0e7a7277ac75ffd3b14be4c2a50cb9a93e39937b4b2ca159e079acff85f64b7da

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\SKQ4D2J.exe

Filesize
148KB

MD5
ef57c52a2bf14721623563677c7b4444

SHA1
3060b89d9bbca8dce92d249ef657113d96fea052

SHA256
a7e496d3be19dd02953e8e810632707910435b2b4bffaefd08ab31e72f51fee0

SHA512
ed565b890ff3debdd6279baf2b7c446901b541b8f7ebb2214febfa5539e2ab236df26f2f11b586ac87da4940eb26ddc2fce9e2fa06b47cd4e005ae598f8126a0

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd

Filesize
148KB

MD5
ef57c52a2bf14721623563677c7b4444

SHA1
3060b89d9bbca8dce92d249ef657113d96fea052

SHA256
a7e496d3be19dd02953e8e810632707910435b2b4bffaefd08ab31e72f51fee0

SHA512
ed565b890ff3debdd6279baf2b7c446901b541b8f7ebb2214febfa5539e2ab236df26f2f11b586ac87da4940eb26ddc2fce9e2fa06b47cd4e005ae598f8126a0

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd

Filesize
148KB

MD5
5436d8caba239c74081f3fafef6576da

SHA1
0e8ff3a9d1427b051a24fdbd7f0b21fe928687c2

SHA256
1cc56d32d8bad9ed082e382aa1000cc255336fcb599228c933c25df47e4b9b8b

SHA512
b43ccbc2653ca7a03de5d734f98d7697aa1214ae6ed5c8b0abcc6514041d08f59cc40fe24dfcbfde77e3cb02d767dd474104e8582fe048f6da63a331afc8661f

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd

Filesize
148KB

MD5
a33f765cd1e9f419b280f8c2f8c1742a

SHA1
de2748c1e47f5b53d9f5536d11281f2f1c377d4c

SHA256
82af20711268950de1d0d5e1b289e8e947b72c6a1d705dad63a3dbe829ba76a2

SHA512
0b33130286bdd406146bba8a2e281464efb07625efac1340ac0813ba5412124c71d8414bded7a62151e5e11868e788b8f76fcacee63027eeb3fd444277ff95b9

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd

Filesize
148KB

MD5
21735a55f1150d00cdb55a08df749d11

SHA1
27637be48063b2eaf5fef1a4f74f92e7f43c1223

SHA256
cd94a41bc7c814e4a916123c5b015ed31c56312bc0e06c3cfa7a435367511403

SHA512
f6ab3c0577a755a8abb3ca75459cd238fde3cdd93d1474879c02cfaa491cedb976f017401363718a098dc9cd66f89ed0c9f6b661b7abe6fb000e1d6ce5e7d30e

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe

Filesize
148KB

MD5
b80543045b3c2ea5a81e405b905e8785

SHA1
0fc7a61070b09d0f172be65360e2ac5d0950026c

SHA256
edef0e239b2e30026b98395c8006dc10635967bdc6311b506d7a29bcac308c27

SHA512
59017cc50cbb1087235fab9ddfc1c8eb094e647b33018c8035419379318e3cdfef8f992f9db0f3822e91969478c113b80963d13391e679a5d1c39de29482afa9

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe

Filesize
148KB

MD5
b80543045b3c2ea5a81e405b905e8785

SHA1
0fc7a61070b09d0f172be65360e2ac5d0950026c

SHA256
edef0e239b2e30026b98395c8006dc10635967bdc6311b506d7a29bcac308c27

SHA512
59017cc50cbb1087235fab9ddfc1c8eb094e647b33018c8035419379318e3cdfef8f992f9db0f3822e91969478c113b80963d13391e679a5d1c39de29482afa9

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe

Filesize
148KB

MD5
f79f4946217d19aff4c9ed25c1fd8ff6

SHA1
2b6edd50129b6fc03cf79f2573078453e4ead500

SHA256
0245c5085bbac44647b138608ac0c398b3401aab9f94c5064dce39bf5ca1b35e

SHA512
fe7b46065a2860ecb62e01a391c3b77c26e52acef9c53cc867fa2a6811ab990f94496129c58f0c89ac058a42b32c1ecc6416fbe332cd6e0fba39fac50b70e03e

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe

Filesize
148KB

MD5
f79f4946217d19aff4c9ed25c1fd8ff6

SHA1
2b6edd50129b6fc03cf79f2573078453e4ead500

SHA256
0245c5085bbac44647b138608ac0c398b3401aab9f94c5064dce39bf5ca1b35e

SHA512
fe7b46065a2860ecb62e01a391c3b77c26e52acef9c53cc867fa2a6811ab990f94496129c58f0c89ac058a42b32c1ecc6416fbe332cd6e0fba39fac50b70e03e

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe

Filesize
148KB

MD5
d1e33b3f102745093b43f4d5ab032857

SHA1
36fd523544c6206a086bfad05e0b6565b21872dd

SHA256
2ca74a19fe38fe0502ac18d150ab67ab7682a8a7ffc3c0e1048b6e7750af7552

SHA512
83f6e041c7122b3a5e98976034d84825d9c69c541108bce61cdcfe8ebc7272040429f1762ffdb6aad979a760bae1eeb442bdc7c91961efa3dea3d4ca73c1e2c5

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe

Filesize
148KB

MD5
d1e33b3f102745093b43f4d5ab032857

SHA1
36fd523544c6206a086bfad05e0b6565b21872dd

SHA256
2ca74a19fe38fe0502ac18d150ab67ab7682a8a7ffc3c0e1048b6e7750af7552

SHA512
83f6e041c7122b3a5e98976034d84825d9c69c541108bce61cdcfe8ebc7272040429f1762ffdb6aad979a760bae1eeb442bdc7c91961efa3dea3d4ca73c1e2c5

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe

Filesize
148KB

MD5
a8e40cba176f465168cfa65409862ffe

SHA1
e655b65ad81625e2bc5f5aeb9317ef58be1c0edb

SHA256
7062b88b1ca0953de134e5e208c68959fa47fc1ef460de0dd8a110f3f3467787

SHA512
ade195f40429ff901124fd80451f6f6d8290bb17ab844084ea8c271b3d5d513d1fb09aa40092de6a01e4afe9e004a79535108df369f7fa96042a46b28fd881c9

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe

Filesize
148KB

MD5
a8e40cba176f465168cfa65409862ffe

SHA1
e655b65ad81625e2bc5f5aeb9317ef58be1c0edb

SHA256
7062b88b1ca0953de134e5e208c68959fa47fc1ef460de0dd8a110f3f3467787

SHA512
ade195f40429ff901124fd80451f6f6d8290bb17ab844084ea8c271b3d5d513d1fb09aa40092de6a01e4afe9e004a79535108df369f7fa96042a46b28fd881c9

Download Submit
C:\Windows\LNX5I7N.exe

Filesize
148KB

MD5
81eb54e4d7639180b5c9d58a829bf5d0

SHA1
43eaf3e2c4e33dde13fdcc86dcd9dd231a3e33e9

SHA256
0c2a6322a1d6262a1f41ae97438e8be5ddace55f24ed73ffd09a9cb15b1d6fc1

SHA512
fea4353b599e19b2fef2c89e178450fe2290748f763922831ee954a4e8a600a40850b2306c6adee0a58e4eed6e927a5393450ec504e2d4c00c76d23080bad8a3

Download Submit
C:\Windows\LNX5I7N.exe

Filesize
148KB

MD5
81eb54e4d7639180b5c9d58a829bf5d0

SHA1
43eaf3e2c4e33dde13fdcc86dcd9dd231a3e33e9

SHA256
0c2a6322a1d6262a1f41ae97438e8be5ddace55f24ed73ffd09a9cb15b1d6fc1

SHA512
fea4353b599e19b2fef2c89e178450fe2290748f763922831ee954a4e8a600a40850b2306c6adee0a58e4eed6e927a5393450ec504e2d4c00c76d23080bad8a3

Download Submit
C:\Windows\LNX5I7N.exe

Filesize
148KB

MD5
81eb54e4d7639180b5c9d58a829bf5d0

SHA1
43eaf3e2c4e33dde13fdcc86dcd9dd231a3e33e9

SHA256
0c2a6322a1d6262a1f41ae97438e8be5ddace55f24ed73ffd09a9cb15b1d6fc1

SHA512
fea4353b599e19b2fef2c89e178450fe2290748f763922831ee954a4e8a600a40850b2306c6adee0a58e4eed6e927a5393450ec504e2d4c00c76d23080bad8a3

Download Submit
C:\Windows\LNX5I7N.exe

Filesize
148KB

MD5
81eb54e4d7639180b5c9d58a829bf5d0

SHA1
43eaf3e2c4e33dde13fdcc86dcd9dd231a3e33e9

SHA256
0c2a6322a1d6262a1f41ae97438e8be5ddace55f24ed73ffd09a9cb15b1d6fc1

SHA512
fea4353b599e19b2fef2c89e178450fe2290748f763922831ee954a4e8a600a40850b2306c6adee0a58e4eed6e927a5393450ec504e2d4c00c76d23080bad8a3

Download Submit
C:\Windows\QVH0C0Y.exe

Filesize
148KB

MD5
ac441c7151e7b7685c62312fa677a8fb

SHA1
e36ee8e0f2c710370224a5c2b79517dd8588c588

SHA256
d925615b954f903d59ea6eebbab3fe8683ef7b315038ef978b5aed2bb49975e8

SHA512
793be2f1829ea994c785f78e8c863204517e9c6e0cfc2854928c91caab135ab890d040ccb20f7ed0da250b6e7b64cc7f0e3e919a6e86aaf34479e7b103a206ad

Download Submit
C:\Windows\QVH0C0Y.exe

Filesize
148KB

MD5
ac441c7151e7b7685c62312fa677a8fb

SHA1
e36ee8e0f2c710370224a5c2b79517dd8588c588

SHA256
d925615b954f903d59ea6eebbab3fe8683ef7b315038ef978b5aed2bb49975e8

SHA512
793be2f1829ea994c785f78e8c863204517e9c6e0cfc2854928c91caab135ab890d040ccb20f7ed0da250b6e7b64cc7f0e3e919a6e86aaf34479e7b103a206ad

Download Submit
C:\Windows\QVH0C0Y.exe

Filesize
148KB

MD5
ac441c7151e7b7685c62312fa677a8fb

SHA1
e36ee8e0f2c710370224a5c2b79517dd8588c588

SHA256
d925615b954f903d59ea6eebbab3fe8683ef7b315038ef978b5aed2bb49975e8

SHA512
793be2f1829ea994c785f78e8c863204517e9c6e0cfc2854928c91caab135ab890d040ccb20f7ed0da250b6e7b64cc7f0e3e919a6e86aaf34479e7b103a206ad

Download Submit
C:\Windows\QVH0C0Y.exe

Filesize
148KB

MD5
ac441c7151e7b7685c62312fa677a8fb

SHA1
e36ee8e0f2c710370224a5c2b79517dd8588c588

SHA256
d925615b954f903d59ea6eebbab3fe8683ef7b315038ef978b5aed2bb49975e8

SHA512
793be2f1829ea994c785f78e8c863204517e9c6e0cfc2854928c91caab135ab890d040ccb20f7ed0da250b6e7b64cc7f0e3e919a6e86aaf34479e7b103a206ad

Download Submit
C:\Windows\SysWOW64\DCF6L4V.exe

Filesize
148KB

MD5
6684c6e129a1efffe5ca505e5d75f318

SHA1
0d2fac65148d8e619a36955d12685ad65cf4f54f

SHA256
d3f60b9b54a521e9e0895c1cb0f7f421c64eabf878b74436fcf6825a2bfb760f

SHA512
cd452d7ff7d77971d32ceb732f752ece36e2311b1960eb90af437b3e3f9c432bdf8bc2e862f88d02471c15d3cf6018d1c6db7520e8ddc95203c131b3c603e79b

Download Submit
C:\Windows\SysWOW64\DCF6L4V.exe

Filesize
148KB

MD5
6684c6e129a1efffe5ca505e5d75f318

SHA1
0d2fac65148d8e619a36955d12685ad65cf4f54f

SHA256
d3f60b9b54a521e9e0895c1cb0f7f421c64eabf878b74436fcf6825a2bfb760f

SHA512
cd452d7ff7d77971d32ceb732f752ece36e2311b1960eb90af437b3e3f9c432bdf8bc2e862f88d02471c15d3cf6018d1c6db7520e8ddc95203c131b3c603e79b

Download Submit
C:\Windows\SysWOW64\DCF6L4V.exe

Filesize
148KB

MD5
6684c6e129a1efffe5ca505e5d75f318

SHA1
0d2fac65148d8e619a36955d12685ad65cf4f54f

SHA256
d3f60b9b54a521e9e0895c1cb0f7f421c64eabf878b74436fcf6825a2bfb760f

SHA512
cd452d7ff7d77971d32ceb732f752ece36e2311b1960eb90af437b3e3f9c432bdf8bc2e862f88d02471c15d3cf6018d1c6db7520e8ddc95203c131b3c603e79b

Download Submit
C:\Windows\SysWOW64\DCF6L4V.exe

Filesize
148KB

MD5
6684c6e129a1efffe5ca505e5d75f318

SHA1
0d2fac65148d8e619a36955d12685ad65cf4f54f

SHA256
d3f60b9b54a521e9e0895c1cb0f7f421c64eabf878b74436fcf6825a2bfb760f

SHA512
cd452d7ff7d77971d32ceb732f752ece36e2311b1960eb90af437b3e3f9c432bdf8bc2e862f88d02471c15d3cf6018d1c6db7520e8ddc95203c131b3c603e79b

Download Submit
C:\Windows\SysWOW64\MEF6I7S\UON1U6P.cmd

Filesize
148KB

MD5
f79f4946217d19aff4c9ed25c1fd8ff6

SHA1
2b6edd50129b6fc03cf79f2573078453e4ead500

SHA256
0245c5085bbac44647b138608ac0c398b3401aab9f94c5064dce39bf5ca1b35e

SHA512
fe7b46065a2860ecb62e01a391c3b77c26e52acef9c53cc867fa2a6811ab990f94496129c58f0c89ac058a42b32c1ecc6416fbe332cd6e0fba39fac50b70e03e

Download Submit
C:\Windows\SysWOW64\MEF6I7S\UON1U6P.cmd

Filesize
148KB

MD5
63893cc10b878ba6c932ee5f54769e91

SHA1
21eab9560a36fb746ef6eb989887a8b7764d1168

SHA256
960162707107a2cdf279de76e4434f5b4f37adf87c054e3f064a57deef24987c

SHA512
d77bcb6665a710c5e1b62e7af16cdd256c126cfc1a0c8faaa2a03fe53b2e971f442ae4d5b2ba194327b76b2c08f829821ba1790fbb94290e8316a83e65787f2c

Download Submit
C:\Windows\SysWOW64\MEF6I7S\UON1U6P.cmd

Filesize
148KB

MD5
b8c6724ad1be8f58682b52382878c005

SHA1
4c9f4fdcc327b25cb179242e08671902d6ea78c1

SHA256
1e1746364ba0fcab2addd302e0bb49181d75195b9de597da3064c9ee23f8eb4b

SHA512
5ef938119abe2d68598c06469f427314509362cddc45931bbee1ac821d6b10a6283c2ff18962a7d6e59b94418fb7b5ddc16049a6e92bea69d256279c9de8d18a

Download Submit
C:\Windows\SysWOW64\MEF6I7S\UON1U6P.cmd

Filesize
148KB

MD5
75bbcd2f980995257601cb5513c64d80

SHA1
b6903e0c4294dc10c76da103bc04ce471cee9dc4

SHA256
3ea0311a04f000a13125a9feb764d0160d9c90b40975ce51ba81514b177a1234

SHA512
3d72d99ef7096c8a2d51b6eba66eb0cc08c8086690bc6fd279c77b99fddf798c6cf4b4e01ffeb7869f77f8cb382dde3aab9394e3c119121c2f2fc4cfe59be53e

Download Submit
C:\Windows\SysWOW64\UON1U6PQVH0C0Y.exe

Filesize
148KB

MD5
a8e40cba176f465168cfa65409862ffe

SHA1
e655b65ad81625e2bc5f5aeb9317ef58be1c0edb

SHA256
7062b88b1ca0953de134e5e208c68959fa47fc1ef460de0dd8a110f3f3467787

SHA512
ade195f40429ff901124fd80451f6f6d8290bb17ab844084ea8c271b3d5d513d1fb09aa40092de6a01e4afe9e004a79535108df369f7fa96042a46b28fd881c9

Download Submit
C:\Windows\SysWOW64\UON1U6PQVH0C0Y.exe

Filesize
148KB

MD5
a8e40cba176f465168cfa65409862ffe

SHA1
e655b65ad81625e2bc5f5aeb9317ef58be1c0edb

SHA256
7062b88b1ca0953de134e5e208c68959fa47fc1ef460de0dd8a110f3f3467787

SHA512
ade195f40429ff901124fd80451f6f6d8290bb17ab844084ea8c271b3d5d513d1fb09aa40092de6a01e4afe9e004a79535108df369f7fa96042a46b28fd881c9

Download Submit
C:\Windows\SysWOW64\UON1U6PQVH0C0Y.exe

Filesize
148KB

MD5
a8e40cba176f465168cfa65409862ffe

SHA1
e655b65ad81625e2bc5f5aeb9317ef58be1c0edb

SHA256
7062b88b1ca0953de134e5e208c68959fa47fc1ef460de0dd8a110f3f3467787

SHA512
ade195f40429ff901124fd80451f6f6d8290bb17ab844084ea8c271b3d5d513d1fb09aa40092de6a01e4afe9e004a79535108df369f7fa96042a46b28fd881c9

Download Submit
C:\Windows\SysWOW64\UON1U6PQVH0C0Y.exe

Filesize
148KB

MD5
a8e40cba176f465168cfa65409862ffe

SHA1
e655b65ad81625e2bc5f5aeb9317ef58be1c0edb

SHA256
7062b88b1ca0953de134e5e208c68959fa47fc1ef460de0dd8a110f3f3467787

SHA512
ade195f40429ff901124fd80451f6f6d8290bb17ab844084ea8c271b3d5d513d1fb09aa40092de6a01e4afe9e004a79535108df369f7fa96042a46b28fd881c9

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
127B

MD5
7cb19e03fb0d71b3ee56660c684a9119

SHA1
ac04e14253c6dd80fad6dc270ecdf1e3804144c7

SHA256
79b6b506aa43af506f0fc81294eeff03709d9b4c4fb20d1a72108a0ef2c01433

SHA512
528a23a153a0edb1d04cfd3fcb646294b9301467bff5864be6ac2e87c28a6606a8e51dce42af5e489b2c69700c12883ec13e1b306032217574e05068aee5d960

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
440aacec5e927384cf09ed86a42b48ac

SHA1
22249fed505abe316dfaaf1aebaa8986689ade5c

SHA256
24dc89c0f84f14de398ad8f165d7f525d7a1d6bad26005020ba6b9a48f513542

SHA512
dab67a837acbc5875d185eb3aa9d6a88b74af9a089fccb8b8381c7ac1465cae377df9abcf936d73876e113a371cb31f611908bc269c33b41318057d16ea6ca66

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
440aacec5e927384cf09ed86a42b48ac

SHA1
22249fed505abe316dfaaf1aebaa8986689ade5c

SHA256
24dc89c0f84f14de398ad8f165d7f525d7a1d6bad26005020ba6b9a48f513542

SHA512
dab67a837acbc5875d185eb3aa9d6a88b74af9a089fccb8b8381c7ac1465cae377df9abcf936d73876e113a371cb31f611908bc269c33b41318057d16ea6ca66

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
440aacec5e927384cf09ed86a42b48ac

SHA1
22249fed505abe316dfaaf1aebaa8986689ade5c

SHA256
24dc89c0f84f14de398ad8f165d7f525d7a1d6bad26005020ba6b9a48f513542

SHA512
dab67a837acbc5875d185eb3aa9d6a88b74af9a089fccb8b8381c7ac1465cae377df9abcf936d73876e113a371cb31f611908bc269c33b41318057d16ea6ca66

Download Submit
C:\Windows\cypreg.dll

Filesize
361KB

MD5
016153e7d87da4663906542e9984ed56

SHA1
98bcd3fa50dfe9cc40e7cfc6d2473676bdfe1c78

SHA256
ff8e86e1e77eabbbd74fbac06432a73af90663e4ec1ca8083a94cf10adadbd30

SHA512
1e8990ccdf6857cabdec0abaeba1ac68cd67f769ff2a9c40d13bbc09980895793284c861bbd5ced0557cddbe5efd92d07f9f339bdf30d1935a80f0af21a30093

Download Submit
C:\Windows\cypreg.dll

Filesize
361KB

MD5
1e1e0ba48fa72dc5e7b482afd9d3a7e0

SHA1
2a930121ef6839a0905d253ddeae565b45a95782

SHA256
94ca13a7007fb2c1db881f79c436a1b392e7a41ff8e126f5d3b4f32cfe2183c9

SHA512
70e0886004a164817cad5829d588fda560527579842d4fed654a2bfbe2999e473aebd8f67ac733362c107c5c40245cbf58906e7934e6138e43ce630c850fcc7d

Download Submit
C:\Windows\cypreg.dll

Filesize
361KB

MD5
1e1e0ba48fa72dc5e7b482afd9d3a7e0

SHA1
2a930121ef6839a0905d253ddeae565b45a95782

SHA256
94ca13a7007fb2c1db881f79c436a1b392e7a41ff8e126f5d3b4f32cfe2183c9

SHA512
70e0886004a164817cad5829d588fda560527579842d4fed654a2bfbe2999e473aebd8f67ac733362c107c5c40245cbf58906e7934e6138e43ce630c850fcc7d

Download Submit
C:\Windows\cypreg.dll

Filesize
361KB

MD5
143a309d8d59ee6bfce708236c2f639f

SHA1
c940d4ac73e516517a237efa55d76ebbb741868e

SHA256
5fdbe88a4bc1b80f513e0d64cbb68bb477d486687032de7d86ddc0cea00cade4

SHA512
6652aeeac6c8ffa5f9e51773c0191bcea1d138e384e909e02d8c2a20fbd0dfb56555a26b2725496a49709b99a66d4c105c20cbcba7c5dab2b869ceaaff2a566e

Download Submit
C:\Windows\lsass.exe

Filesize
148KB

MD5
a8e40cba176f465168cfa65409862ffe

SHA1
e655b65ad81625e2bc5f5aeb9317ef58be1c0edb

SHA256
7062b88b1ca0953de134e5e208c68959fa47fc1ef460de0dd8a110f3f3467787

SHA512
ade195f40429ff901124fd80451f6f6d8290bb17ab844084ea8c271b3d5d513d1fb09aa40092de6a01e4afe9e004a79535108df369f7fa96042a46b28fd881c9

Download Submit
C:\Windows\lsass.exe

Filesize
148KB

MD5
a8e40cba176f465168cfa65409862ffe

SHA1
e655b65ad81625e2bc5f5aeb9317ef58be1c0edb

SHA256
7062b88b1ca0953de134e5e208c68959fa47fc1ef460de0dd8a110f3f3467787

SHA512
ade195f40429ff901124fd80451f6f6d8290bb17ab844084ea8c271b3d5d513d1fb09aa40092de6a01e4afe9e004a79535108df369f7fa96042a46b28fd881c9

Download Submit
C:\Windows\lsass.exe

Filesize
148KB

MD5
a8e40cba176f465168cfa65409862ffe

SHA1
e655b65ad81625e2bc5f5aeb9317ef58be1c0edb

SHA256
7062b88b1ca0953de134e5e208c68959fa47fc1ef460de0dd8a110f3f3467787

SHA512
ade195f40429ff901124fd80451f6f6d8290bb17ab844084ea8c271b3d5d513d1fb09aa40092de6a01e4afe9e004a79535108df369f7fa96042a46b28fd881c9

Download Submit
C:\Windows\lsass.exe

Filesize
148KB

MD5
a8e40cba176f465168cfa65409862ffe

SHA1
e655b65ad81625e2bc5f5aeb9317ef58be1c0edb

SHA256
7062b88b1ca0953de134e5e208c68959fa47fc1ef460de0dd8a110f3f3467787

SHA512
ade195f40429ff901124fd80451f6f6d8290bb17ab844084ea8c271b3d5d513d1fb09aa40092de6a01e4afe9e004a79535108df369f7fa96042a46b28fd881c9

Download Submit
C:\Windows\lsass.exe

Filesize
148KB

MD5
a8e40cba176f465168cfa65409862ffe

SHA1
e655b65ad81625e2bc5f5aeb9317ef58be1c0edb

SHA256
7062b88b1ca0953de134e5e208c68959fa47fc1ef460de0dd8a110f3f3467787

SHA512
ade195f40429ff901124fd80451f6f6d8290bb17ab844084ea8c271b3d5d513d1fb09aa40092de6a01e4afe9e004a79535108df369f7fa96042a46b28fd881c9

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.4MB

MD5
f45f8d9fa3e4b3cec0d13e83ab9efaee

SHA1
05a098f8a554143aabcdb839afd82d5ca3923b55

SHA256
e13fb59a98f3d4bc9f1826c79dd36e53b587b7353823dd952183f0f3502725da

SHA512
71c2bf5214e36d1d38726a466b43e8e43319e47ca58483e18ee71d289baa4198f9d6a271e5a9cf66fdfbbdabd3dfc31768e750a262fd008f5bc3fc1eaca3caad

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.4MB

MD5
c6e72c1e418663017ccfea1bedf7eee7

SHA1
797a84957ebd22647d8e7ac62a81061496ea2ef2

SHA256
d6f15036a1fd7489d7c2a04dcb2be2f44dd9a0e752e5206698f7b462970f2e9a

SHA512
3f693de5fa31421e9a5c4ecf9182ac654a388a4934bc58b9e5e509419ea0e371d458ed8fe838f742003b3a250347e92ef9c23eac32f2cdca46fe494ff771191c

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.4MB

MD5
c6e72c1e418663017ccfea1bedf7eee7

SHA1
797a84957ebd22647d8e7ac62a81061496ea2ef2

SHA256
d6f15036a1fd7489d7c2a04dcb2be2f44dd9a0e752e5206698f7b462970f2e9a

SHA512
3f693de5fa31421e9a5c4ecf9182ac654a388a4934bc58b9e5e509419ea0e371d458ed8fe838f742003b3a250347e92ef9c23eac32f2cdca46fe494ff771191c

Download Submit
memory/2260-132-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2260-214-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2972-215-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2972-220-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4240-222-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4240-219-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4380-217-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4380-223-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/4880-216-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4952-218-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4952-221-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads