139cafabaf0bf3d30f1bc4b2d1bef10e453b54b8ee3b8274d4d86adc04fa99df

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
27-11-2023 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77d8924e9c8ea62a75bfb95218703760.exe
Size

472KB
MD5

77d8924e9c8ea62a75bfb95218703760
SHA1

cc7d083564b86433af52b92a7114da24bf1d5ca8
SHA256

139cafabaf0bf3d30f1bc4b2d1bef10e453b54b8ee3b8274d4d86adc04fa99df
SHA512

8c0eb852fd31670f6abfc1c324258702e9a079c5a1abc875509afd9e4a117143b83b16c93b087ea8935f318888af8b98c99d5c9d118e9751dce673d76335e5dc
SSDEEP

6144:UY+32WWluqvHpVmXWEjFJRWci+WUd20rUU5EYCTvaBju4zk9OW:/nWwvHpVmXpjJIUd2cUusvalxzk9OW

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\\UNT6G3M.exe\""	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\\UNT6G3M.exe\""	lsass.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Sets file execution options in registry 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\\regedit.cmd"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\\regedit.cmd"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe

ACProtect 1.3x - 1.4x DLL software 6 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0034000000015601-110.dat	acprotect
behavioral1/files/0x0034000000015601-145.dat	acprotect
behavioral1/files/0x0034000000015601-76.dat	acprotect
behavioral1/files/0x0034000000015601-184.dat	acprotect
behavioral1/files/0x0034000000015601-183.dat	acprotect
behavioral1/files/0x0034000000015601-214.dat	acprotect

Executes dropped EXE 4 IoCs

pid	Process
2444	service.exe
2724	smss.exe
2440	system.exe
1980	lsass.exe

Loads dropped DLL 6 IoCs

pid	Process
1752	77d8924e9c8ea62a75bfb95218703760.exe
1752	77d8924e9c8ea62a75bfb95218703760.exe
1752	77d8924e9c8ea62a75bfb95218703760.exe
1752	77d8924e9c8ea62a75bfb95218703760.exe
1752	77d8924e9c8ea62a75bfb95218703760.exe
1752	77d8924e9c8ea62a75bfb95218703760.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0034000000015601-110.dat	upx
behavioral1/files/0x0034000000015601-145.dat	upx
behavioral1/files/0x0034000000015601-76.dat	upx
behavioral1/files/0x0034000000015601-184.dat	upx
behavioral1/files/0x0034000000015601-183.dat	upx
behavioral1/files/0x0034000000015601-214.dat	upx
behavioral1/memory/2440-219-0x0000000010000000-0x0000000010075000-memory.dmp	upx
behavioral1/memory/2440-230-0x0000000010000000-0x0000000010075000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\0G3MXJ = "C:\\Windows\\OQD6L0Q.exe"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\sFL6L0Q0 = "C:\\Windows\\system32\\WRQ3X8STXJ1F1E.exe"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\0G3MXJ = "C:\\Windows\\OQD6L0Q.exe"	system.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\sFL6L0Q0 = "C:\\Windows\\system32\\WRQ3X8STXJ1F1E.exe"	lsass.exe

Drops desktop.ini file(s) 28 IoCs

description	ioc	Process
File created	\??\UNC\AHLBRYJO\S$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\B$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\C$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\G$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\D$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\E$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\R$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\T$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\U$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\X$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\A$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\N$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\I$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\J$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\K$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\L$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\M$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\Z$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\O$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\P$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\Q$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\W$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\ADMIN$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\H$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\V$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\F$\desktop.ini	lsass.exe
File created	\??\UNC\AHLBRYJO\Y$\desktop.ini	lsass.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	service.exe
File opened (read-only)	\??\Z:	service.exe
File opened (read-only)	\??\G:	service.exe
File opened (read-only)	\??\I:	service.exe
File opened (read-only)	\??\N:	service.exe
File opened (read-only)	\??\P:	service.exe
File opened (read-only)	\??\T:	service.exe
File opened (read-only)	\??\O:	service.exe
File opened (read-only)	\??\V:	service.exe
File opened (read-only)	\??\W:	service.exe
File opened (read-only)	\??\E:	service.exe
File opened (read-only)	\??\J:	service.exe
File opened (read-only)	\??\K:	service.exe
File opened (read-only)	\??\L:	service.exe
File opened (read-only)	\??\M:	service.exe
File opened (read-only)	\??\Y:	service.exe
File opened (read-only)	\??\Q:	service.exe
File opened (read-only)	\??\H:	service.exe
File opened (read-only)	\??\R:	service.exe
File opened (read-only)	\??\S:	service.exe
File opened (read-only)	\??\U:	service.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\PHI7L8V\WRQ3X8S.cmd	service.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\GFI7N5Y.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\PHI7L8V\WRQ3X8S.cmd	system.exe
File opened for modification	C:\Windows\SysWOW64\PHI7L8V	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\SysWOW64\GFI7N5Y.exe	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\WRQ3X8STXJ1F1E.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\PHI7L8V	smss.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\SysWOW64\PHI7L8V\WRQ3X8S.cmd	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\SysWOW64\GFI7N5Y.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\PHI7L8V\WRQ3X8S.cmd	lsass.exe
File opened for modification	C:\Windows\SysWOW64\WRQ3X8STXJ1F1E.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\WRQ3X8STXJ1F1E.exe	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\WRQ3X8STXJ1F1E.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\PHI7L8V	lsass.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\SysWOW64\PHI7L8V	service.exe
File opened for modification	C:\Windows\SysWOW64\GFI7N5Y.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\GFI7N5Y.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\PHI7L8V\WRQ3X8S.cmd	smss.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\WRQ3X8STXJ1F1E.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\SysWOW64\PHI7L8V	system.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\KOK7O5H.com	system.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\KOK7O5H.com	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	service.exe
File opened for modification	C:\Windows\cypreg.dll	service.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	service.exe
File opened for modification	C:\Windows\OQD6L0Q.exe	service.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\KOK7O5H.com	smss.exe
File created	C:\Windows\MooNlight.R.txt	smss.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}	lsass.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	smss.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}	smss.exe
File opened for modification	C:\Windows\cypreg.dll	smss.exe
File opened for modification	C:\Windows\cypreg.dll	system.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	system.exe
File opened for modification	C:\Windows\OQD6L0Q.exe	system.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	lsass.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}	service.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	service.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	system.exe
File opened for modification	C:\Windows\64enc.en	system.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}	system.exe
File opened for modification	C:\Windows\moonlight.dll	service.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	service.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	lsass.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	lsass.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\UNT6G3M.exe	lsass.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\UNT6G3M.exe	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\lsass.exe	service.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\UNT6G3M.exe	service.exe
File opened for modification	C:\Windows\lsass.exe	system.exe
File opened for modification	C:\Windows\OQD6L0Q.exe	lsass.exe
File opened for modification	C:\Windows\lsass.exe	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\TXJ1F1E.exe	smss.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	system.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\lsass.exe	smss.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\UNT6G3M.exe	system.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	lsass.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\KOK7O5H.com	lsass.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\TXJ1F1E.exe	service.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\OQD6L0Q.exe	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	smss.exe
File opened for modification	C:\Windows\moonlight.dll	system.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	lsass.exe
File opened for modification	C:\Windows\TXJ1F1E.exe	lsass.exe
File opened for modification	C:\Windows\moonlight.dll	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\TXJ1F1E.exe	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\cypreg.dll	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	service.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	smss.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	system.exe
File opened for modification	C:\Windows\moonlight.dll	lsass.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	lsass.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	77d8924e9c8ea62a75bfb95218703760.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	smss.exe
File opened for modification	C:\Windows\OQD6L0Q.exe	smss.exe
File opened for modification	C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\UNT6G3M.exe	smss.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	lsass.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	2440	system.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1752	77d8924e9c8ea62a75bfb95218703760.exe
2444	service.exe
2724	smss.exe
2440	system.exe
1980	lsass.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2444	1752	77d8924e9c8ea62a75bfb95218703760.exe	28
PID 1752 wrote to memory of 2444	1752	77d8924e9c8ea62a75bfb95218703760.exe	28
PID 1752 wrote to memory of 2444	1752	77d8924e9c8ea62a75bfb95218703760.exe	28
PID 1752 wrote to memory of 2444	1752	77d8924e9c8ea62a75bfb95218703760.exe	28
PID 1752 wrote to memory of 2724	1752	77d8924e9c8ea62a75bfb95218703760.exe	29
PID 1752 wrote to memory of 2724	1752	77d8924e9c8ea62a75bfb95218703760.exe	29
PID 1752 wrote to memory of 2724	1752	77d8924e9c8ea62a75bfb95218703760.exe	29
PID 1752 wrote to memory of 2724	1752	77d8924e9c8ea62a75bfb95218703760.exe	29
PID 1752 wrote to memory of 2440	1752	77d8924e9c8ea62a75bfb95218703760.exe	30
PID 1752 wrote to memory of 2440	1752	77d8924e9c8ea62a75bfb95218703760.exe	30
PID 1752 wrote to memory of 2440	1752	77d8924e9c8ea62a75bfb95218703760.exe	30
PID 1752 wrote to memory of 2440	1752	77d8924e9c8ea62a75bfb95218703760.exe	30
PID 1752 wrote to memory of 1980	1752	77d8924e9c8ea62a75bfb95218703760.exe	31
PID 1752 wrote to memory of 1980	1752	77d8924e9c8ea62a75bfb95218703760.exe	31
PID 1752 wrote to memory of 1980	1752	77d8924e9c8ea62a75bfb95218703760.exe	31
PID 1752 wrote to memory of 1980	1752	77d8924e9c8ea62a75bfb95218703760.exe	31

C:\Users\Admin\AppData\Local\Temp\77d8924e9c8ea62a75bfb95218703760.exe
"C:\Users\Admin\AppData\Local\Temp\77d8924e9c8ea62a75bfb95218703760.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe
  "C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2444
- C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe
  "C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2724
- C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe
  "C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Sets file execution options in registry
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2440
- C:\Windows\lsass.exe
  "C:\Windows\lsass.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Sets file execution options in registry
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\OQD6L0Q.exe

Filesize
472KB

MD5
41e86dd021349376c18b6b98d7f7bdba

SHA1
3f5ace12682389ecafcd0048e96d7ed7759acf37

SHA256
5fee662c2f9be4073dc563fac88a6a11fd2c2c79fe8820f5e8144dce35d6fd98

SHA512
913a66143507a3c02b34587fb280b9ea4b9b5b7b790c52d21204553c1a225202f6f8ecc1d553abc05ead1e3824902fef1f05f3cada123f5f495b30be3c53c06c

Download Submit
C:\Windows\OQD6L0Q.exe

Filesize
472KB

MD5
f31577c5cb561d05c19e1d2c5d081484

SHA1
8e91e0687bd6def35e8748cedc373034e793be85

SHA256
b3c9a7ff8659c173b3f172d519abae7007c07ff728e7572434cc180b08d581d4

SHA512
b1932d615f3ec8a4ef4f5a3c1610670f7db82296fc7b23de57756824644ac0d722c40013dd606651337ba9e8e0fcc82bf3d64c6fcb122ef1adae709efe0e7fda

Download Submit
C:\Windows\OQD6L0Q.exe

Filesize
472KB

MD5
41e86dd021349376c18b6b98d7f7bdba

SHA1
3f5ace12682389ecafcd0048e96d7ed7759acf37

SHA256
5fee662c2f9be4073dc563fac88a6a11fd2c2c79fe8820f5e8144dce35d6fd98

SHA512
913a66143507a3c02b34587fb280b9ea4b9b5b7b790c52d21204553c1a225202f6f8ecc1d553abc05ead1e3824902fef1f05f3cada123f5f495b30be3c53c06c

Download Submit
C:\Windows\OQD6L0Q.exe

Filesize
472KB

MD5
dbe8e3ff7316beb14cfcba2206992200

SHA1
46d93def4e3c2ba2b24779127b9ce826eeae18d0

SHA256
6935fc8fdbee84073c547f92076e9909bd99e91bfaca5a5ad47518445bb16d2e

SHA512
bdfe80149d2301ad61255f4b60ba7308ae2000ee89f88724d36924b75cd055163a54733e699e0a81f881ee0c696f651d31818c4b22b75c5ad329eff85e37d6be

Download Submit
C:\Windows\SysWOW64\GFI7N5Y.exe

Filesize
472KB

MD5
210ffb0d30e1b80a588d92f7946cfbbf

SHA1
9659d941e34b0e2e52037ff7a653fe45fc49d606

SHA256
2ef65df4d45567e4bc22b95f91756730f0b8d5f3c31356e038a3b0fcb3b5d42b

SHA512
3ff436a88e645a212141f6355113c8d99dfa77dbefd8f23cd8c4c8b2c52b230afc818b5aaceb52962e200a8702ea4b416d47cbe8057c4ee0d61f1317482160b0

Download Submit
C:\Windows\SysWOW64\GFI7N5Y.exe

Filesize
472KB

MD5
b26170f223b43cf1417583d5ca023c84

SHA1
cc5a654ff3008f7fb39e9f3000faac27cd02eba3

SHA256
1a134e3d5f02225e7bcce5ff61070b2de81280a919548ae4d814485682828c25

SHA512
db4688f9f3e66433d904805bf859b1ec50aea391b715aa34821dd1cbbb51f9fbdaf696787e1230ae4d3736388e1cb397078b326e40ce51c503fce0e0be0b440b

Download Submit
C:\Windows\SysWOW64\GFI7N5Y.exe

Filesize
472KB

MD5
210ffb0d30e1b80a588d92f7946cfbbf

SHA1
9659d941e34b0e2e52037ff7a653fe45fc49d606

SHA256
2ef65df4d45567e4bc22b95f91756730f0b8d5f3c31356e038a3b0fcb3b5d42b

SHA512
3ff436a88e645a212141f6355113c8d99dfa77dbefd8f23cd8c4c8b2c52b230afc818b5aaceb52962e200a8702ea4b416d47cbe8057c4ee0d61f1317482160b0

Download Submit
C:\Windows\SysWOW64\GFI7N5Y.exe

Filesize
472KB

MD5
ec767c27f4a96a33e361284e28504174

SHA1
9b18273c35e371aa4d19f3a8640667fc519d98fb

SHA256
049f08fa5e780c416eabdbb5651f4358e4b22f70264b9e39d09230933fe08bc2

SHA512
073402e8b025141d6cd76af34a5b85d38d984971df54ffc2d6d770bf63fd04e859d8938e930ed4812705c0e0eb4c597f39296b7ea4fbdda8f20751a47b68c581

Download Submit
C:\Windows\SysWOW64\PHI7L8V\WRQ3X8S.cmd

Filesize
472KB

MD5
7a847c2ffd81503c4524f45c716bb650

SHA1
e58efdbb8ef93545ae863e1049763969bdcdc456

SHA256
bf160e9bb72ae0007ac5d44e7312366c64982f18422aafe40c1781aeb00663ae

SHA512
9b7a85827113676d2dbbd14690617d5ef347da1c0108d2b4ec2d5323a202716d4fce5ba6dd6174b80af30096001782dd43f712ebb9f5e8865eec1e3df45a0aec

Download Submit
C:\Windows\SysWOW64\PHI7L8V\WRQ3X8S.cmd

Filesize
472KB

MD5
f853bfff2255c738f3df1b8f6a8165c9

SHA1
642fa4aac09faee773e083338cbda8ae34450047

SHA256
5732ae43be7eb70593bd852c5bdf9f29ca6ac050ffb90f209b980f072f2a0f52

SHA512
15c7a8004ad19d32781c4829bc3c9950e23531befda753a1fd4059b9823d54d7f16d49616f6abd152af6b349d11bddfa30474fa6fa04127ba94e26eec8e9fc59

Download Submit
C:\Windows\SysWOW64\WRQ3X8STXJ1F1E.exe

Filesize
472KB

MD5
af0186a061e3df02da00dbdd9a98a698

SHA1
9336f0c4ba1a36a5594f9dd3a91a19cf65810dde

SHA256
e093123bf8090eef685a99f0a32d8c09ea397cb76b6cd9beb0f4c6a27bfd57c8

SHA512
6b94c20ef18d0fcb3d2cce2aedde37e6bdf898b4e4ddc3f26e9bb623957444de5db2e7167a3c8c7efccf2789c0fb43c982214186ea2635b8ea2d226f0bb6da99

Download Submit
C:\Windows\SysWOW64\WRQ3X8STXJ1F1E.exe

Filesize
472KB

MD5
95cb84ca05b3751ff73f73687c1574da

SHA1
0833bf0f3f7b24d7680880e59d394c5943d2c2b8

SHA256
9993ae8948d2462282d02ab67e27b265154572f109330d591d203917594436bc

SHA512
cffa6b294bc50c5b56119e5eb970133e0685c75702ed547f14a5331613cdf0c8b19ef48abcbeb622bac458642dcd8119902b4f18d8cfd28903cb5573f5ffd865

Download Submit
C:\Windows\SysWOW64\WRQ3X8STXJ1F1E.exe

Filesize
472KB

MD5
af0186a061e3df02da00dbdd9a98a698

SHA1
9336f0c4ba1a36a5594f9dd3a91a19cf65810dde

SHA256
e093123bf8090eef685a99f0a32d8c09ea397cb76b6cd9beb0f4c6a27bfd57c8

SHA512
6b94c20ef18d0fcb3d2cce2aedde37e6bdf898b4e4ddc3f26e9bb623957444de5db2e7167a3c8c7efccf2789c0fb43c982214186ea2635b8ea2d226f0bb6da99

Download Submit
C:\Windows\SysWOW64\WRQ3X8STXJ1F1E.exe

Filesize
472KB

MD5
f853bfff2255c738f3df1b8f6a8165c9

SHA1
642fa4aac09faee773e083338cbda8ae34450047

SHA256
5732ae43be7eb70593bd852c5bdf9f29ca6ac050ffb90f209b980f072f2a0f52

SHA512
15c7a8004ad19d32781c4829bc3c9950e23531befda753a1fd4059b9823d54d7f16d49616f6abd152af6b349d11bddfa30474fa6fa04127ba94e26eec8e9fc59

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
4345f90a5ea80030efb2ff1f2de33f75

SHA1
dbfd4a24f47987b1e58164941755323e80f7d41e

SHA256
e05a4bf71b05a3a67e4598020574d12d2de8eabc95a64030d1315a3d60899a46

SHA512
c04211bbc85834713b68eeb8ddd1d166df911608710958e44f4f4fd8fc9ec8c2f7a722b801529ebb4264f0d01bae27c61eb8347663f4f81761f2eca0abcfba52

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
4345f90a5ea80030efb2ff1f2de33f75

SHA1
dbfd4a24f47987b1e58164941755323e80f7d41e

SHA256
e05a4bf71b05a3a67e4598020574d12d2de8eabc95a64030d1315a3d60899a46

SHA512
c04211bbc85834713b68eeb8ddd1d166df911608710958e44f4f4fd8fc9ec8c2f7a722b801529ebb4264f0d01bae27c61eb8347663f4f81761f2eca0abcfba52

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
4345f90a5ea80030efb2ff1f2de33f75

SHA1
dbfd4a24f47987b1e58164941755323e80f7d41e

SHA256
e05a4bf71b05a3a67e4598020574d12d2de8eabc95a64030d1315a3d60899a46

SHA512
c04211bbc85834713b68eeb8ddd1d166df911608710958e44f4f4fd8fc9ec8c2f7a722b801529ebb4264f0d01bae27c61eb8347663f4f81761f2eca0abcfba52

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
4345f90a5ea80030efb2ff1f2de33f75

SHA1
dbfd4a24f47987b1e58164941755323e80f7d41e

SHA256
e05a4bf71b05a3a67e4598020574d12d2de8eabc95a64030d1315a3d60899a46

SHA512
c04211bbc85834713b68eeb8ddd1d166df911608710958e44f4f4fd8fc9ec8c2f7a722b801529ebb4264f0d01bae27c61eb8347663f4f81761f2eca0abcfba52

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
4345f90a5ea80030efb2ff1f2de33f75

SHA1
dbfd4a24f47987b1e58164941755323e80f7d41e

SHA256
e05a4bf71b05a3a67e4598020574d12d2de8eabc95a64030d1315a3d60899a46

SHA512
c04211bbc85834713b68eeb8ddd1d166df911608710958e44f4f4fd8fc9ec8c2f7a722b801529ebb4264f0d01bae27c61eb8347663f4f81761f2eca0abcfba52

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
127B

MD5
244de2e3c6e1d320a93cfd654930280f

SHA1
44bfdfd794a517ba150ee1bf0e7ba6b0bf0f7880

SHA256
f58c00d269558da8df3c034f8ddb4c848f76353c8265ed0c1ca0a680ce8a709e

SHA512
31093b0d7e075f0d3eb70f0af726134eefc959db2b9d991241b9a06970270b45b8e886bfedc9bfedc33300183e8b6428ec69e15d35d92afeb10b3666ec0c2efe

Download Submit
C:\Windows\TXJ1F1E.exe

Filesize
472KB

MD5
09ee6bd0b48926b6acc22117aa3a5331

SHA1
c24a8a8002e2a1d3685a1cb30c4859a2cdacfa71

SHA256
94ee0cb1b06ebf6b0593a9347358d924eb3d694444fe9180dbae72fcf73d0d7c

SHA512
7f40b0ba76847bf464dd235ed134497d99ca1d45a339f80b037494696c1f864a00a2773255f06c4ff4d51add8dbf973f908e9d71712a9b8db8598b915c59eb3e

Download Submit
C:\Windows\TXJ1F1E.exe

Filesize
472KB

MD5
86ca19e990e3142849743e0777e24a58

SHA1
0137c25d4496aa58c721a702a159bfea4b5b7262

SHA256
376f7b1750f0a863cecfaeb4054e1fc36091d92a653fcf2a6dc698c823eb85a9

SHA512
b0cbb692f5f841e5a2ec3c3ac5b45f945060f128ccc6446ef55d3d42903e143d67e890c7fbc987ce344dc910c869c22901642bc694a1045ac73a39c901b007e0

Download Submit
C:\Windows\TXJ1F1E.exe

Filesize
472KB

MD5
09ee6bd0b48926b6acc22117aa3a5331

SHA1
c24a8a8002e2a1d3685a1cb30c4859a2cdacfa71

SHA256
94ee0cb1b06ebf6b0593a9347358d924eb3d694444fe9180dbae72fcf73d0d7c

SHA512
7f40b0ba76847bf464dd235ed134497d99ca1d45a339f80b037494696c1f864a00a2773255f06c4ff4d51add8dbf973f908e9d71712a9b8db8598b915c59eb3e

Download Submit
C:\Windows\TXJ1F1E.exe

Filesize
472KB

MD5
d8d78fccde1ec55d7d48502dbb20c259

SHA1
ce846829284c1d39561a417a058d0df9f14889c1

SHA256
6e5a9465c342065bfe1a3bb2ba1d2f9a42cb9f8e0ca5b7a626923ebfc44c0c41

SHA512
480412b4b7acd8f1fc487c8ef498b200a097071005973883e0c136547b03d56a307b50d6cb8d89249a0dbf91e450d6298cf92b2e13fb2ac9ed0fe2ec0e4f4ea8

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\KOK7O5H.com

Filesize
472KB

MD5
d8d78fccde1ec55d7d48502dbb20c259

SHA1
ce846829284c1d39561a417a058d0df9f14889c1

SHA256
6e5a9465c342065bfe1a3bb2ba1d2f9a42cb9f8e0ca5b7a626923ebfc44c0c41

SHA512
480412b4b7acd8f1fc487c8ef498b200a097071005973883e0c136547b03d56a307b50d6cb8d89249a0dbf91e450d6298cf92b2e13fb2ac9ed0fe2ec0e4f4ea8

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\KOK7O5H.com

Filesize
472KB

MD5
d8d78fccde1ec55d7d48502dbb20c259

SHA1
ce846829284c1d39561a417a058d0df9f14889c1

SHA256
6e5a9465c342065bfe1a3bb2ba1d2f9a42cb9f8e0ca5b7a626923ebfc44c0c41

SHA512
480412b4b7acd8f1fc487c8ef498b200a097071005973883e0c136547b03d56a307b50d6cb8d89249a0dbf91e450d6298cf92b2e13fb2ac9ed0fe2ec0e4f4ea8

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\KOK7O5H.com

Filesize
472KB

MD5
ac749dee4b293ec02f32d30bfa607422

SHA1
a1edbd81458c2ee3324c40830f6b224ae12ebb5d

SHA256
ff263790244e3d28d02160788035b7563f65b541442fbf57b562c382eb1b1301

SHA512
1805427ccc4ae712fa15b16a78491a4b95ce405d40e2be62aa5e060c2ffa663e86020ea7b73278195c71a5794aabc983d4eb60fe17c05a4c53caa4257b0247c9

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\KOK7O5H.com

Filesize
472KB

MD5
d8d78fccde1ec55d7d48502dbb20c259

SHA1
ce846829284c1d39561a417a058d0df9f14889c1

SHA256
6e5a9465c342065bfe1a3bb2ba1d2f9a42cb9f8e0ca5b7a626923ebfc44c0c41

SHA512
480412b4b7acd8f1fc487c8ef498b200a097071005973883e0c136547b03d56a307b50d6cb8d89249a0dbf91e450d6298cf92b2e13fb2ac9ed0fe2ec0e4f4ea8

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\KOK7O5H.com

Filesize
472KB

MD5
7a6adbd83ee310b2eb606dc87b1a9067

SHA1
ebf80542ed6d2b12a4162fbea56d746e08439735

SHA256
c72b16aa68a6b87bc9137473810bf22635ae802fdf07a4d64f26ebb5edf5bf6b

SHA512
ba89cd49552c35d0e100dfdb0df672642f379235e00d731813b8b7d8a8cfe87699737537dea81cb0fafeb86e6d62abfa6d0460afd021600219893aeeea4b4eac

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\UNT6G3M.exe

Filesize
472KB

MD5
ec767c27f4a96a33e361284e28504174

SHA1
9b18273c35e371aa4d19f3a8640667fc519d98fb

SHA256
049f08fa5e780c416eabdbb5651f4358e4b22f70264b9e39d09230933fe08bc2

SHA512
073402e8b025141d6cd76af34a5b85d38d984971df54ffc2d6d770bf63fd04e859d8938e930ed4812705c0e0eb4c597f39296b7ea4fbdda8f20751a47b68c581

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\UNT6G3M.exe

Filesize
472KB

MD5
7a847c2ffd81503c4524f45c716bb650

SHA1
e58efdbb8ef93545ae863e1049763969bdcdc456

SHA256
bf160e9bb72ae0007ac5d44e7312366c64982f18422aafe40c1781aeb00663ae

SHA512
9b7a85827113676d2dbbd14690617d5ef347da1c0108d2b4ec2d5323a202716d4fce5ba6dd6174b80af30096001782dd43f712ebb9f5e8865eec1e3df45a0aec

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd

Filesize
472KB

MD5
f99286c0a5a2882878e19f641331ab3e

SHA1
224fda998d81cf5856f27bd62a121c9dec7564ee

SHA256
276b0c2a3e30c427524d0ceeb07ee5c86abbad5a626e98cc574a5e657fe318ad

SHA512
d2025d4e711b8f55563dd9e5555d48423f8d74a26a653bdd8861891f69d5405c939bce5fb918e8990f2ff33e0b6d8523025db73f985b3728901521430d658b16

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd

Filesize
472KB

MD5
af0186a061e3df02da00dbdd9a98a698

SHA1
9336f0c4ba1a36a5594f9dd3a91a19cf65810dde

SHA256
e093123bf8090eef685a99f0a32d8c09ea397cb76b6cd9beb0f4c6a27bfd57c8

SHA512
6b94c20ef18d0fcb3d2cce2aedde37e6bdf898b4e4ddc3f26e9bb623957444de5db2e7167a3c8c7efccf2789c0fb43c982214186ea2635b8ea2d226f0bb6da99

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe

Filesize
472KB

MD5
b26170f223b43cf1417583d5ca023c84

SHA1
cc5a654ff3008f7fb39e9f3000faac27cd02eba3

SHA256
1a134e3d5f02225e7bcce5ff61070b2de81280a919548ae4d814485682828c25

SHA512
db4688f9f3e66433d904805bf859b1ec50aea391b715aa34821dd1cbbb51f9fbdaf696787e1230ae4d3736388e1cb397078b326e40ce51c503fce0e0be0b440b

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe

Filesize
472KB

MD5
b26170f223b43cf1417583d5ca023c84

SHA1
cc5a654ff3008f7fb39e9f3000faac27cd02eba3

SHA256
1a134e3d5f02225e7bcce5ff61070b2de81280a919548ae4d814485682828c25

SHA512
db4688f9f3e66433d904805bf859b1ec50aea391b715aa34821dd1cbbb51f9fbdaf696787e1230ae4d3736388e1cb397078b326e40ce51c503fce0e0be0b440b

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe

Filesize
472KB

MD5
b26170f223b43cf1417583d5ca023c84

SHA1
cc5a654ff3008f7fb39e9f3000faac27cd02eba3

SHA256
1a134e3d5f02225e7bcce5ff61070b2de81280a919548ae4d814485682828c25

SHA512
db4688f9f3e66433d904805bf859b1ec50aea391b715aa34821dd1cbbb51f9fbdaf696787e1230ae4d3736388e1cb397078b326e40ce51c503fce0e0be0b440b

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe

Filesize
472KB

MD5
7a847c2ffd81503c4524f45c716bb650

SHA1
e58efdbb8ef93545ae863e1049763969bdcdc456

SHA256
bf160e9bb72ae0007ac5d44e7312366c64982f18422aafe40c1781aeb00663ae

SHA512
9b7a85827113676d2dbbd14690617d5ef347da1c0108d2b4ec2d5323a202716d4fce5ba6dd6174b80af30096001782dd43f712ebb9f5e8865eec1e3df45a0aec

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe

Filesize
472KB

MD5
7a847c2ffd81503c4524f45c716bb650

SHA1
e58efdbb8ef93545ae863e1049763969bdcdc456

SHA256
bf160e9bb72ae0007ac5d44e7312366c64982f18422aafe40c1781aeb00663ae

SHA512
9b7a85827113676d2dbbd14690617d5ef347da1c0108d2b4ec2d5323a202716d4fce5ba6dd6174b80af30096001782dd43f712ebb9f5e8865eec1e3df45a0aec

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe

Filesize
472KB

MD5
7a847c2ffd81503c4524f45c716bb650

SHA1
e58efdbb8ef93545ae863e1049763969bdcdc456

SHA256
bf160e9bb72ae0007ac5d44e7312366c64982f18422aafe40c1781aeb00663ae

SHA512
9b7a85827113676d2dbbd14690617d5ef347da1c0108d2b4ec2d5323a202716d4fce5ba6dd6174b80af30096001782dd43f712ebb9f5e8865eec1e3df45a0aec

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe

Filesize
472KB

MD5
46fc115797f212f66cdf93bbdcdc2856

SHA1
43aedcc4ee30f55cce72ad1af3384ce41b23ec75

SHA256
4b6103aeb88b8cdb1e2c34b3998c5750027c42ee311c82c02b8d32d64f9f5884

SHA512
7ea8e374df6a8df818a68881bc41a2e8dea84a81a9a5ffa0294e87891c709c8e1f11b008e90970e7b021b09c9f1a2748d03450b11475e1aae822d3bcf244b09f

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe

Filesize
472KB

MD5
46fc115797f212f66cdf93bbdcdc2856

SHA1
43aedcc4ee30f55cce72ad1af3384ce41b23ec75

SHA256
4b6103aeb88b8cdb1e2c34b3998c5750027c42ee311c82c02b8d32d64f9f5884

SHA512
7ea8e374df6a8df818a68881bc41a2e8dea84a81a9a5ffa0294e87891c709c8e1f11b008e90970e7b021b09c9f1a2748d03450b11475e1aae822d3bcf244b09f

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe

Filesize
472KB

MD5
a818c03795e93b662056f377fd26cd26

SHA1
9c5f2a3eae3fed7eaf2ccf25047fc505ce15a202

SHA256
c2842dd230a2fa6b723ece1bdd537ae32825de905e77482ce0c2ffac06f8bf00

SHA512
a27f42b5d5463ba87429760f1c0f2fdd0fdced14d30dcb7262cd4bbf9930b95990e98c7a2553e6293a2e93ef68ef1b0753430647eb71f8bc074e760756af27e5

Download Submit
C:\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe

Filesize
472KB

MD5
b26170f223b43cf1417583d5ca023c84

SHA1
cc5a654ff3008f7fb39e9f3000faac27cd02eba3

SHA256
1a134e3d5f02225e7bcce5ff61070b2de81280a919548ae4d814485682828c25

SHA512
db4688f9f3e66433d904805bf859b1ec50aea391b715aa34821dd1cbbb51f9fbdaf696787e1230ae4d3736388e1cb397078b326e40ce51c503fce0e0be0b440b

Download Submit
C:\Windows\cypreg.dll

Filesize
417KB

MD5
65a3ed6f11ee1ee326e040a1348e49c1

SHA1
fc5a7b62fca85ea1b59089ddd42c61c9a4174556

SHA256
45c87ad35ff04e777d59cf81520d85bbef33f124c029e0f66c099d9ca001b8e1

SHA512
34cf8335336f998b3f7ea37ecb90a8e0ba0e49549be9970d2a0601aa59431759bdfc12ab8210549e6b4e8b6a311f494372a63a8bab23dd8685e9166e185b870a

Download Submit
C:\Windows\cypreg.dll

Filesize
417KB

MD5
e4cd776a3893852a84281da60556b092

SHA1
fe4c71fef4b796c5f96d761f84a022d5880814f1

SHA256
b2a834dcb46ca10ab9fde3dde159083a44181c7a241a684e265b1c5c4fec6049

SHA512
a729b58607ce5d4b1757359ac9d142fb9b5c7a640059afc8d2fc5f805151583b5578c052a220ef967ad6a13b720fb454172b779acb02b26e2383f95a0b427aad

Download Submit
C:\Windows\lsass.exe

Filesize
472KB

MD5
29d0abb6834aead55d4b782abfe4b8ce

SHA1
c7a5b3ba60301f060f079827d2d2efa691afbf5f

SHA256
86795027e9a33381b02b6f5349806ee5c5989f45a75affa6836473c9e88fead3

SHA512
a2e1737763c91bc4ce16fb3e4677fcd2e710ac9c75cb4d98c301d70bc4b328ba8f5d1ffad87245019975941c18041e687fa3bb08e8d0047cbc3b45fa25e325a2

Download Submit
C:\Windows\lsass.exe

Filesize
472KB

MD5
af0186a061e3df02da00dbdd9a98a698

SHA1
9336f0c4ba1a36a5594f9dd3a91a19cf65810dde

SHA256
e093123bf8090eef685a99f0a32d8c09ea397cb76b6cd9beb0f4c6a27bfd57c8

SHA512
6b94c20ef18d0fcb3d2cce2aedde37e6bdf898b4e4ddc3f26e9bb623957444de5db2e7167a3c8c7efccf2789c0fb43c982214186ea2635b8ea2d226f0bb6da99

Download Submit
C:\Windows\lsass.exe

Filesize
472KB

MD5
af0186a061e3df02da00dbdd9a98a698

SHA1
9336f0c4ba1a36a5594f9dd3a91a19cf65810dde

SHA256
e093123bf8090eef685a99f0a32d8c09ea397cb76b6cd9beb0f4c6a27bfd57c8

SHA512
6b94c20ef18d0fcb3d2cce2aedde37e6bdf898b4e4ddc3f26e9bb623957444de5db2e7167a3c8c7efccf2789c0fb43c982214186ea2635b8ea2d226f0bb6da99

Download Submit
C:\Windows\lsass.exe

Filesize
472KB

MD5
af0186a061e3df02da00dbdd9a98a698

SHA1
9336f0c4ba1a36a5594f9dd3a91a19cf65810dde

SHA256
e093123bf8090eef685a99f0a32d8c09ea397cb76b6cd9beb0f4c6a27bfd57c8

SHA512
6b94c20ef18d0fcb3d2cce2aedde37e6bdf898b4e4ddc3f26e9bb623957444de5db2e7167a3c8c7efccf2789c0fb43c982214186ea2635b8ea2d226f0bb6da99

Download Submit
C:\Windows\lsass.exe

Filesize
472KB

MD5
af0186a061e3df02da00dbdd9a98a698

SHA1
9336f0c4ba1a36a5594f9dd3a91a19cf65810dde

SHA256
e093123bf8090eef685a99f0a32d8c09ea397cb76b6cd9beb0f4c6a27bfd57c8

SHA512
6b94c20ef18d0fcb3d2cce2aedde37e6bdf898b4e4ddc3f26e9bb623957444de5db2e7167a3c8c7efccf2789c0fb43c982214186ea2635b8ea2d226f0bb6da99

Download Submit
C:\Windows\lsass.exe

Filesize
472KB

MD5
a818c03795e93b662056f377fd26cd26

SHA1
9c5f2a3eae3fed7eaf2ccf25047fc505ce15a202

SHA256
c2842dd230a2fa6b723ece1bdd537ae32825de905e77482ce0c2ffac06f8bf00

SHA512
a27f42b5d5463ba87429760f1c0f2fdd0fdced14d30dcb7262cd4bbf9930b95990e98c7a2553e6293a2e93ef68ef1b0753430647eb71f8bc074e760756af27e5

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.3MB

MD5
381ee69841c54efd9f93ebe332337865

SHA1
3327c2f495d3dedd4c07bd258e7026e0de1c1d7c

SHA256
24be6f1a5642f8bf311bcb1c85142178be6d682ced4f5ef8fdeeddeb39df16be

SHA512
69cb19699ba5c83883ef6d24ffed4345448e2ead12ba1d41378e6a6ca5ed7d788c637dab05996969b4c9837545490e63aa6b52ef7168d646c27442acca2ae3ad

Download Submit
\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe

Filesize
472KB

MD5
b26170f223b43cf1417583d5ca023c84

SHA1
cc5a654ff3008f7fb39e9f3000faac27cd02eba3

SHA256
1a134e3d5f02225e7bcce5ff61070b2de81280a919548ae4d814485682828c25

SHA512
db4688f9f3e66433d904805bf859b1ec50aea391b715aa34821dd1cbbb51f9fbdaf696787e1230ae4d3736388e1cb397078b326e40ce51c503fce0e0be0b440b

Download Submit
\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe

Filesize
472KB

MD5
b26170f223b43cf1417583d5ca023c84

SHA1
cc5a654ff3008f7fb39e9f3000faac27cd02eba3

SHA256
1a134e3d5f02225e7bcce5ff61070b2de81280a919548ae4d814485682828c25

SHA512
db4688f9f3e66433d904805bf859b1ec50aea391b715aa34821dd1cbbb51f9fbdaf696787e1230ae4d3736388e1cb397078b326e40ce51c503fce0e0be0b440b

Download Submit
\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe

Filesize
472KB

MD5
7a847c2ffd81503c4524f45c716bb650

SHA1
e58efdbb8ef93545ae863e1049763969bdcdc456

SHA256
bf160e9bb72ae0007ac5d44e7312366c64982f18422aafe40c1781aeb00663ae

SHA512
9b7a85827113676d2dbbd14690617d5ef347da1c0108d2b4ec2d5323a202716d4fce5ba6dd6174b80af30096001782dd43f712ebb9f5e8865eec1e3df45a0aec

Download Submit
\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe

Filesize
472KB

MD5
7a847c2ffd81503c4524f45c716bb650

SHA1
e58efdbb8ef93545ae863e1049763969bdcdc456

SHA256
bf160e9bb72ae0007ac5d44e7312366c64982f18422aafe40c1781aeb00663ae

SHA512
9b7a85827113676d2dbbd14690617d5ef347da1c0108d2b4ec2d5323a202716d4fce5ba6dd6174b80af30096001782dd43f712ebb9f5e8865eec1e3df45a0aec

Download Submit
\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe

Filesize
472KB

MD5
46fc115797f212f66cdf93bbdcdc2856

SHA1
43aedcc4ee30f55cce72ad1af3384ce41b23ec75

SHA256
4b6103aeb88b8cdb1e2c34b3998c5750027c42ee311c82c02b8d32d64f9f5884

SHA512
7ea8e374df6a8df818a68881bc41a2e8dea84a81a9a5ffa0294e87891c709c8e1f11b008e90970e7b021b09c9f1a2748d03450b11475e1aae822d3bcf244b09f

Download Submit
\Windows\WFL7M1X.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe

Filesize
472KB

MD5
46fc115797f212f66cdf93bbdcdc2856

SHA1
43aedcc4ee30f55cce72ad1af3384ce41b23ec75

SHA256
4b6103aeb88b8cdb1e2c34b3998c5750027c42ee311c82c02b8d32d64f9f5884

SHA512
7ea8e374df6a8df818a68881bc41a2e8dea84a81a9a5ffa0294e87891c709c8e1f11b008e90970e7b021b09c9f1a2748d03450b11475e1aae822d3bcf244b09f

Download Submit
memory/1752-177-0x0000000003830000-0x00000000038AA000-memory.dmp

Filesize
488KB

Download
memory/1752-56-0x0000000003160000-0x00000000031DA000-memory.dmp

Filesize
488KB

Download
memory/1752-47-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download
memory/1752-141-0x0000000003160000-0x00000000031DA000-memory.dmp

Filesize
488KB

Download
memory/1752-181-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1752-74-0x0000000003160000-0x00000000031DA000-memory.dmp

Filesize
488KB

Download
memory/1752-182-0x0000000003160000-0x00000000031BD000-memory.dmp

Filesize
372KB

Download
memory/1752-50-0x0000000003160000-0x00000000031DA000-memory.dmp

Filesize
488KB

Download
memory/1752-0-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1980-179-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1980-229-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2440-143-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2440-219-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/2440-228-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2440-230-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/2444-212-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2444-59-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2724-69-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2724-227-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads