Analysis
-
max time kernel
149s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 00:31
Static task
static1
Behavioral task
behavioral1
Sample
dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe
Resource
win10v2004-20221111-en
General
-
Target
dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe
-
Size
58KB
-
MD5
25f4773820efe20baf6a06471701bbb0
-
SHA1
9ee7e516d27b8d1e9a3cd73285c9e548f8678b44
-
SHA256
dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
-
SHA512
98b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
SSDEEP
768:6pUt1E/8mS+amkLFRccny45nHguULyEfq+NfAR3b3rI3k0pYD60a2nBdv2tEvP:6pO1Ek93yAgfGUt23brI3k0Q6F6dUGP
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
Processes:
EmangEloh.exewinlogon.exeservice.exesmss.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M81384\\Ja623507bLay.com\"" EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O07170Z\\TuxO07170Z.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M81384\\Ja623507bLay.com\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O07170Z\\TuxO07170Z.exe\"" service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M81384\\Ja623507bLay.com\"" service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O07170Z\\TuxO07170Z.exe\"" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M81384\\Ja623507bLay.com\"" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O07170Z\\TuxO07170Z.exe\"" EmangEloh.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
Processes:
smss.exeEmangEloh.exewinlogon.exeservice.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" EmangEloh.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" service.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
Processes:
EmangEloh.exewinlogon.exeservice.exesmss.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" EmangEloh.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" service.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe -
Disables RegEdit via registry modification 4 IoCs
Processes:
smss.exeEmangEloh.exewinlogon.exeservice.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" EmangEloh.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" service.exe -
Executes dropped EXE 4 IoCs
Processes:
service.exesmss.exeEmangEloh.exewinlogon.exepid process 632 service.exe 952 smss.exe 1836 EmangEloh.exe 1000 winlogon.exe -
Sets file execution options in registry 2 TTPs 16 IoCs
Processes:
smss.exeEmangEloh.exewinlogon.exeservice.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" EmangEloh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" EmangEloh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe smss.exe -
Drops startup file 5 IoCs
Processes:
dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exeservice.exesmss.exeEmangEloh.exewinlogon.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd service.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd smss.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd EmangEloh.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd winlogon.exe -
Loads dropped DLL 8 IoCs
Processes:
dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exepid process 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 16 IoCs
Processes:
smss.exewinlogon.exeservice.exeEmangEloh.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\T1813166TT4 = "C:\\Windows\\system32\\5265312630l.exe" smss.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RUN smss.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\T70Z265 = "C:\\Windows\\sa-643166.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\T1813166TT4 = "C:\\Windows\\system32\\5265312630l.exe" service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\T1813166TT4 = "C:\\Windows\\system32\\5265312630l.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\T70Z265 = "C:\\Windows\\sa-643166.exe" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\T1813166TT4 = "C:\\Windows\\system32\\5265312630l.exe" EmangEloh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\T70Z265 = "C:\\Windows\\sa-643166.exe" EmangEloh.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RUN service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\T70Z265 = "C:\\Windows\\sa-643166.exe" service.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run smss.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RUN winlogon.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run service.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RUN EmangEloh.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
EmangEloh.exeservice.exesmss.exewinlogon.exedescription ioc process File opened (read-only) \??\h: EmangEloh.exe File opened (read-only) \??\r: EmangEloh.exe File opened (read-only) \??\u: EmangEloh.exe File opened (read-only) \??\v: EmangEloh.exe File opened (read-only) \??\w: EmangEloh.exe File opened (read-only) \??\v: service.exe File opened (read-only) \??\y: smss.exe File opened (read-only) \??\j: winlogon.exe File opened (read-only) \??\o: winlogon.exe File opened (read-only) \??\k: service.exe File opened (read-only) \??\w: service.exe File opened (read-only) \??\h: smss.exe File opened (read-only) \??\k: EmangEloh.exe File opened (read-only) \??\f: winlogon.exe File opened (read-only) \??\q: smss.exe File opened (read-only) \??\j: smss.exe File opened (read-only) \??\q: winlogon.exe File opened (read-only) \??\h: service.exe File opened (read-only) \??\f: smss.exe File opened (read-only) \??\j: EmangEloh.exe File opened (read-only) \??\h: winlogon.exe File opened (read-only) \??\u: winlogon.exe File opened (read-only) \??\y: EmangEloh.exe File opened (read-only) \??\i: service.exe File opened (read-only) \??\j: service.exe File opened (read-only) \??\r: service.exe File opened (read-only) \??\u: smss.exe File opened (read-only) \??\g: winlogon.exe File opened (read-only) \??\l: winlogon.exe File opened (read-only) \??\p: EmangEloh.exe File opened (read-only) \??\s: winlogon.exe File opened (read-only) \??\w: winlogon.exe File opened (read-only) \??\y: winlogon.exe File opened (read-only) \??\x: service.exe File opened (read-only) \??\i: smss.exe File opened (read-only) \??\k: winlogon.exe File opened (read-only) \??\g: service.exe File opened (read-only) \??\N: smss.exe File opened (read-only) \??\m: smss.exe File opened (read-only) \??\f: EmangEloh.exe File opened (read-only) \??\i: EmangEloh.exe File opened (read-only) \??\s: EmangEloh.exe File opened (read-only) \??\t: EmangEloh.exe File opened (read-only) \??\v: winlogon.exe File opened (read-only) \??\m: service.exe File opened (read-only) \??\e: smss.exe File opened (read-only) \??\q: service.exe File opened (read-only) \??\i: winlogon.exe File opened (read-only) \??\l: EmangEloh.exe File opened (read-only) \??\N: winlogon.exe File opened (read-only) \??\r: winlogon.exe File opened (read-only) \??\x: winlogon.exe File opened (read-only) \??\s: service.exe File opened (read-only) \??\y: service.exe File opened (read-only) \??\r: smss.exe File opened (read-only) \??\x: smss.exe File opened (read-only) \??\z: smss.exe File opened (read-only) \??\e: EmangEloh.exe File opened (read-only) \??\g: EmangEloh.exe File opened (read-only) \??\m: EmangEloh.exe File opened (read-only) \??\m: winlogon.exe File opened (read-only) \??\t: winlogon.exe File opened (read-only) \??\p: smss.exe File opened (read-only) \??\o: service.exe -
Drops file in System32 directory 23 IoCs
Processes:
dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exesmss.exewinlogon.exeservice.exeEmangEloh.exedescription ioc process File created C:\Windows\SysWOW64\X62445go\Z005265cie.cmd dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\5265312630l.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe File created C:\Windows\SysWOW64\X62445go\Z5265cie.cmd service.exe File created C:\Windows\SysWOW64\5265312630l.exe service.exe File created C:\Windows\SysWOW64\5265312630l.exe EmangEloh.exe File opened for modification C:\Windows\SysWOW64\5265312630l.exe EmangEloh.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll winlogon.exe File created C:\Windows\SysWOW64\5265312630l.exe winlogon.exe File created \??\c:\Windows\SysWOW64\IME\shared\THe Best Ungu .scr service.exe File created C:\Windows\SysWOW64\005265312630l.exe dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe File created C:\Windows\SysWOW64\X62445go\Z5265cie.cmd smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll EmangEloh.exe File opened for modification C:\Windows\SysWOW64\5265312630l.exe service.exe File opened for modification C:\Windows\SysWOW64\X62445go\Z5265cie.cmd EmangEloh.exe File opened for modification C:\Windows\SysWOW64\X62445go\Z5265cie.cmd winlogon.exe File opened for modification \??\c:\Windows\SysWOW64\IME\shared\THe Best Ungu .scr service.exe File created \??\c:\Windows\SysWOW64\IME\shared\Data DosenKu .exe service.exe File opened for modification C:\Windows\SysWOW64\005265312630l.exe dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll service.exe File opened for modification C:\Windows\SysWOW64\5265312630l.exe smss.exe File opened for modification \??\c:\Windows\SysWOW64\IME\shared\Data DosenKu .exe service.exe -
Drops file in Program Files directory 14 IoCs
Processes:
service.exedescription ioc process File created \??\c:\Program Files (x86)\Google\Update\Download\Blink 182 .exe service.exe File opened for modification \??\c:\Program Files\DVD Maker\Shared\Norman virus Control 5.18 .exe service.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\THe Best Ungu .scr service.exe File created \??\c:\Program Files\Common Files\Microsoft Shared\Norman virus Control 5.18 .exe service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Norman virus Control 5.18 .exe service.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\Lagu - Server .scr service.exe File created \??\c:\Program Files\Windows Sidebar\Shared Gadgets\New mp3 BaraT !! .exe service.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\Download\Blink 182 .exe service.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\THe Best Ungu .scr service.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\Lagu - Server .scr service.exe File created \??\c:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Gallery .scr service.exe File opened for modification \??\c:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Gallery .scr service.exe File created \??\c:\Program Files\DVD Maker\Shared\Norman virus Control 5.18 .exe service.exe File opened for modification \??\c:\Program Files\Windows Sidebar\Shared Gadgets\New mp3 BaraT !! .exe service.exe -
Drops file in Windows directory 64 IoCs
Processes:
service.exedfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exesmss.exewinlogon.exeEmangEloh.exedescription ioc process File created \??\c:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\Lagu - Server .scr service.exe File created \??\c:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\Blink 182 .exe service.exe File created C:\Windows\sa-643166.exe dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe File created C:\Windows\M81384\smss.exe smss.exe File opened for modification C:\Windows\Ti312630ta.exe winlogon.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\Titip Folder Jangan DiHapus .exe service.exe File opened for modification C:\Windows\M81384 winlogon.exe File created \??\c:\Windows\ServiceProfiles\NetworkService\Downloads\Blink 182 .exe service.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\Love Song .scr service.exe File created \??\c:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\Data DosenKu .exe service.exe File created \??\c:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\Data DosenKu .exe service.exe File opened for modification C:\Windows\Ti312630ta.exe service.exe File opened for modification C:\Windows\Ti312630ta.exe smss.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\THe Best Ungu .scr service.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\Love Song .scr service.exe File opened for modification C:\Windows\system\msvbvm60.dll winlogon.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\Gallery .scr service.exe File opened for modification C:\Windows\system\msvbvm60.dll smss.exe File opened for modification C:\Windows\system\msvbvm60.dll service.exe File created C:\Windows\Ti312630ta.exe smss.exe File created C:\Windows\Ti312630ta.exe EmangEloh.exe File opened for modification C:\Windows\M81384\Ja623507bLay.com winlogon.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\RaHasIA .exe service.exe File opened for modification C:\Windows\sa-643166.exe winlogon.exe File opened for modification \??\c:\Windows\ServiceProfiles\NetworkService\Downloads\Blink 182 .exe service.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\Data DosenKu .exe service.exe File created \??\c:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\New mp3 BaraT !! .exe service.exe File opened for modification C:\Windows\M81384\Ja623507bLay.com smss.exe File opened for modification C:\Windows\sa-643166.exe smss.exe File opened for modification C:\Windows\sa-643166.exe EmangEloh.exe File created C:\Windows\M81384\EmangEloh.exe winlogon.exe File opened for modification C:\Windows\M81384 smss.exe File opened for modification C:\Windows\system\msvbvm60.dll EmangEloh.exe File opened for modification C:\Windows\Ti312630ta.exe EmangEloh.exe File created \??\c:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\Windows Vista setup .scr service.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\Norman virus Control 5.18 .exe service.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\Windows Vista setup .scr service.exe File created C:\Windows\M81384\Ja623507bLay.com dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe File opened for modification C:\Windows\Ti312630ta.exe dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe File created C:\Windows\[TheMoonlight].txt smss.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\Love Song .scr service.exe File created \??\c:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\Data DosenKu .exe service.exe File created C:\Windows\M81384\Ja623507bLay.com smss.exe File opened for modification \??\c:\Windows\ServiceProfiles\LocalService\Downloads\Blink 182 .exe service.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\Love Song .scr service.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\Titip Folder Jangan DiHapus .exe service.exe File opened for modification C:\Windows\M81384\EmangEloh.exe dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe File created \??\c:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\Gallery .scr service.exe File created \??\c:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\Windows Vista setup .scr service.exe File created \??\c:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\TutoriaL HAcking .exe service.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\RaHasIA .exe service.exe File created \??\c:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\Love Song .scr service.exe File created \??\c:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\Norman virus Control 5.18 .exe service.exe File opened for modification C:\Windows\M81384 EmangEloh.exe File created C:\Windows\sa-643166.exe EmangEloh.exe File opened for modification C:\Windows\[TheMoonlight].txt EmangEloh.exe File created C:\Windows\sa-643166.exe winlogon.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\Norman virus Control 5.18 .exe service.exe File created \??\c:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\Data DosenKu .exe service.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\Lagu - Server .scr service.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\New mp3 BaraT !! .exe service.exe File created \??\c:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\Norman virus Control 5.18 .exe service.exe File opened for modification C:\Windows\M81384 service.exe File opened for modification C:\Windows\sa-643166.exe service.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 8 IoCs
Processes:
smss.exeEmangEloh.exewinlogon.exeservice.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" EmangEloh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" service.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exeservice.exesmss.exeEmangEloh.exewinlogon.exepid process 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe 632 service.exe 952 smss.exe 1836 EmangEloh.exe 1000 winlogon.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exedescription pid process target process PID 1980 wrote to memory of 632 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe service.exe PID 1980 wrote to memory of 632 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe service.exe PID 1980 wrote to memory of 632 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe service.exe PID 1980 wrote to memory of 632 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe service.exe PID 1980 wrote to memory of 952 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe smss.exe PID 1980 wrote to memory of 952 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe smss.exe PID 1980 wrote to memory of 952 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe smss.exe PID 1980 wrote to memory of 952 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe smss.exe PID 1980 wrote to memory of 1836 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe EmangEloh.exe PID 1980 wrote to memory of 1836 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe EmangEloh.exe PID 1980 wrote to memory of 1836 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe EmangEloh.exe PID 1980 wrote to memory of 1836 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe EmangEloh.exe PID 1980 wrote to memory of 1000 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe winlogon.exe PID 1980 wrote to memory of 1000 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe winlogon.exe PID 1980 wrote to memory of 1000 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe winlogon.exe PID 1980 wrote to memory of 1000 1980 dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe winlogon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe"C:\Users\Admin\AppData\Local\Temp\dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O07170Z\service.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O07170Z\service.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Drops startup file
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\M81384\smss.exe"C:\Windows\M81384\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Drops startup file
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\M81384\EmangEloh.exe"C:\Windows\M81384\EmangEloh.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Drops startup file
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O07170Z\winlogon.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O07170Z\winlogon.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Drops startup file
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmdFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmdFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmdFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmdFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O07170Z\TuxO07170Z.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O07170Z\TuxO07170Z.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O07170Z\TuxO07170Z.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O07170Z\TuxO07170Z.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O07170Z\service.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O07170Z\service.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O07170Z\winlogon.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O07170Z\winlogon.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Windows\M81384\EmangEloh.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Windows\M81384\EmangEloh.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Windows\M81384\Ja623507bLay.comFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Windows\M81384\smss.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Windows\M81384\smss.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Windows\SysWOW64\5265312630l.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Windows\SysWOW64\5265312630l.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Windows\SysWOW64\X62445go\Z5265cie.cmdFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Windows\SysWOW64\X62445go\Z5265cie.cmdFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Windows\Ti312630ta.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Windows\[TheMoonlight].txtFilesize
109B
MD568c7836c8ff19e87ca33a7959a2bdff5
SHA1cc5d0205bb71c10bbed22fe47e59b1f6817daab7
SHA256883b19ec550f7ddb1e274a83d58d66c771ab10fefd136bab79483f2eb84e7fec
SHA5123656005148788ed7ac8f5b5f8f6f4736c2dc4a94771291170e61666beb81e63be2a1a0f2913233b0e3f12ddfa7f1e89da9cd8323306413395ee78b2ece7fbfe8
-
C:\Windows\[TheMoonlight].txtFilesize
109B
MD568c7836c8ff19e87ca33a7959a2bdff5
SHA1cc5d0205bb71c10bbed22fe47e59b1f6817daab7
SHA256883b19ec550f7ddb1e274a83d58d66c771ab10fefd136bab79483f2eb84e7fec
SHA5123656005148788ed7ac8f5b5f8f6f4736c2dc4a94771291170e61666beb81e63be2a1a0f2913233b0e3f12ddfa7f1e89da9cd8323306413395ee78b2ece7fbfe8
-
C:\Windows\[TheMoonlight].txtFilesize
109B
MD568c7836c8ff19e87ca33a7959a2bdff5
SHA1cc5d0205bb71c10bbed22fe47e59b1f6817daab7
SHA256883b19ec550f7ddb1e274a83d58d66c771ab10fefd136bab79483f2eb84e7fec
SHA5123656005148788ed7ac8f5b5f8f6f4736c2dc4a94771291170e61666beb81e63be2a1a0f2913233b0e3f12ddfa7f1e89da9cd8323306413395ee78b2ece7fbfe8
-
C:\Windows\sa-643166.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
C:\Windows\system\msvbvm60.dllFilesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
C:\Windows\system\msvbvm60.dllFilesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
C:\Windows\system\msvbvm60.dllFilesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
C:\Windows\system\msvbvm60.dllFilesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O07170Z\service.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O07170Z\service.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O07170Z\winlogon.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O07170Z\winlogon.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
\Windows\M81384\EmangEloh.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
\Windows\M81384\EmangEloh.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
\Windows\M81384\smss.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
\Windows\M81384\smss.exeFilesize
58KB
MD525f4773820efe20baf6a06471701bbb0
SHA19ee7e516d27b8d1e9a3cd73285c9e548f8678b44
SHA256dfc2f935f757c708c388d7fe0bf14c97af5e9e53b13b3944225e803232647305
SHA51298b092a46dbf0ec1a98395d1130c1fa1aecf36234fb015a46d32182767a7101510d04c76fb0f44838dfb99e2fa5f809c20f305ffe441c6b1528594ea1f23946a
-
memory/632-119-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/632-59-0x0000000000000000-mapping.dmp
-
memory/632-89-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/952-64-0x0000000000000000-mapping.dmp
-
memory/952-120-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/952-90-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1000-105-0x0000000000000000-mapping.dmp
-
memory/1000-122-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1000-117-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1836-93-0x0000000000000000-mapping.dmp
-
memory/1836-121-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1836-116-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1980-107-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1980-56-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1980-88-0x0000000002680000-0x00000000026A2000-memory.dmpFilesize
136KB
-
memory/1980-87-0x0000000001DD0000-0x0000000001DDF000-memory.dmpFilesize
60KB
-
memory/1980-86-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB