Malware Analysis Report

2025-03-14 22:10

Sample ID 240407-2zq3wahb4t
Target 8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536
SHA256 8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536
Tags
upx evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536

Threat Level: Known bad

The file 8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536 was found to be: Known bad.

Malicious Activity Summary

upx evasion persistence

Modifies visibility of file extensions in Explorer

Modifies WinLogon for persistence

Modifies visiblity of hidden/system files in Explorer

Disables use of System Restore points

Sets file execution options in registry

Loads dropped DLL

Checks computer location settings

Modifies system executable filetype association

UPX packed file

Executes dropped EXE

Enumerates connected drives

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Program crash

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 23:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 23:01

Reported

2024-04-07 23:04

Platform

win7-20240221-en

Max time kernel

20s

Max time network

131s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\PVE5F8Q\smss.exe N/A
N/A N/A C:\Windows\PVE5F8Q\service.exe N/A
N/A N/A C:\Windows\PVE5F8Q\system.exe N/A
N/A N/A C:\Windows\PVE5F8Q\winlogon.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\DVU4E0WXEN3J3I.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\SysWOW64\KIM8R7F.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\SysWOW64\systear.dll C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\SysWOW64\TKM0P1C C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\SysWOW64\regedit.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\SysWOW64\TKM0P1C\DVU4E0W.cmd C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\RUH8O1U.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\PVE5F8Q\ORO8S6L.com C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\PVE5F8Q\YQX7J5Q.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\onceinabluemoon.mid C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\system\msvbvm60.dll C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\lsass.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\PVE5F8Q C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\cypreg.dll C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\XEN3J3I.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\PVE5F8Q\service.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\PVE5F8Q\system.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\PVE5F8Q\smss.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\moonlight.dll C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\PVE5F8Q\winlogon.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\PVE5F8Q\regedit.cmd C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2472 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\service.exe
PID 2472 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\service.exe
PID 2472 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\service.exe
PID 2472 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\service.exe
PID 2472 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\smss.exe
PID 2472 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\smss.exe
PID 2472 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\smss.exe
PID 2472 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\smss.exe
PID 2472 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\system.exe
PID 2472 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\system.exe
PID 2472 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\system.exe
PID 2472 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\system.exe
PID 2472 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\winlogon.exe
PID 2472 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\winlogon.exe
PID 2472 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\winlogon.exe
PID 2472 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\winlogon.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe

"C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe"

C:\Windows\PVE5F8Q\service.exe

"C:\Windows\PVE5F8Q\service.exe"

C:\Windows\PVE5F8Q\smss.exe

"C:\Windows\PVE5F8Q\smss.exe"

C:\Windows\PVE5F8Q\system.exe

"C:\Windows\PVE5F8Q\system.exe"

C:\Windows\PVE5F8Q\winlogon.exe

"C:\Windows\PVE5F8Q\winlogon.exe"

C:\Windows\lsass.exe

"C:\Windows\lsass.exe"

Network

N/A

Files

memory/2472-0-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Windows\SysWOW64\systear.dll

MD5 e0d24ba551554102c1f8a135a6bcd9ca
SHA1 138cba5ec356e79dcd6a0de5e0f279e258c24844
SHA256 e2e4f1d2f1d8167a4b83b7a434c63dba4efd12e21325e9126e2874b2b523f593
SHA512 db3ed07aca3799f506974991492e6fd97975ab0d0c2e3369c7f8279b09fb995325d4b25a312c77dee374adb3dd84e3e015babf15e828dd06cbdce623100970ed

C:\Windows\PVE5F8Q\service.exe

MD5 32ec8f226e1405c52c995d286e35eff3
SHA1 2f46efc624e2c3fc413fe71a8d5c3a9fc245dbd4
SHA256 e72f63b4801ba76c824fa1ecbc050cd80e04e1f3492c50614bb90d7dc96901f5
SHA512 14c427d097129645d24be841cdf0270430865ed167fe4ff24f00146f03ecdd6ac1660ce58940afdc5eae492f730c795db456ca679ff615c31c791f2015c8934f

C:\Windows\PVE5F8Q\smss.exe

MD5 2ccdeb08d69dbc87a04afffd19abb2dc
SHA1 8260828f86ede25937b6360b61715a5d1c4d61d8
SHA256 8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536
SHA512 44e585768acb76bb76bc581c68c9bfd1c6dc0b6a85a9a3416549e368bcd93aed549996aead0121920d10aae07b96ed60b5aa26b636c29840f357b750b5c7f6ca

C:\Windows\PVE5F8Q\system.exe

MD5 2235b63ba9681cdd6a46701f8c3f65e6
SHA1 a45e8b2ea8bb00fcebfa5898a607afde321e440a
SHA256 30ac6d53e665dfec44c63a2dcd3fd0068e092a6b4d97c0f4ec76074ef6e3fa51
SHA512 f255c3e08ebaa1310912cb98e1967c34f4f9a297529c3da4d54ec3b1d4c8dcd3b09155a1adaa960d07ad6edf7280684823248187b7482a87b7db5d50ef58ca01

memory/2472-66-0x0000000003060000-0x00000000030B2000-memory.dmp

memory/2472-79-0x0000000003060000-0x00000000030B2000-memory.dmp

memory/2548-89-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2608-86-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2948-92-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2364-91-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Windows\PVE5F8Q\winlogon.exe

MD5 3f4072ee255e78850d04738fa6ba60b9
SHA1 143cc27f25c87d460f88a4311be49a0bbc010fc0
SHA256 5ddcf82602a64bb17a7f7a52b1e4b34c9f63030166fb8ab7743c7e8ba16a943f
SHA512 53b59f86b1c48cc969fd36bf57408bd613ab507f1f44d43ed9ccb04501f3fcf15895bd08b13c90e27f9d76a5e3b04a60493850510c78a3d45aaadc5ef7a8ee55

memory/2472-49-0x0000000001D30000-0x0000000001D40000-memory.dmp

C:\Windows\system\msvbvm60.dll

MD5 daba2ad22aebdd9f7f721ca811dea5b1
SHA1 9a96557e3ba32d05e3f01424f096b78c5be08dc5
SHA256 5bd1d9790c84306c6e16aba066e89927076c7b20b373d567327fdf02a1572f69
SHA512 f070910d170deb1880c066fea74801a281bfda735719bd1355e893522a2a019d80c76ae7d700890037888c0c4a89354c04edefbe1680188dbf0fa6aabe2a8efb

C:\Windows\lsass.exe

MD5 8a15e41e6155e5ea9170f21aa48cff17
SHA1 9d112e37857c2e918913256c63ccc3456e8f3a6f
SHA256 28050d5b8e73c064265d22a0c531272cb97c91595a224cfc5d836a83a6965fb6
SHA512 5a44546b9b5c386df754c974f4c0162e115eeca9e8f5fa71295c6fb1abf4782a65cfdae3f77bcc82ff4dbd48b86607c3b8a0c3f7a5a3b546715456fee5f3f9e6

C:\Windows\PVE5F8Q\YQX7J5Q.exe

MD5 d0051ebb1e6e8941649cf9237e1fb170
SHA1 06999a7e8f9a169322b2c431e83e5650df57220f
SHA256 905a0b23d2ec748185a1e4e76d9f3260aa21da8573fb83db85d1807661cecfac
SHA512 df5de957660c752614beb0e86ba23cba5d6bb507d809581dc84404ca5fc4fde0119df1bd6ad786d4ddb8e38da2e241d24dcddccbd3c3a69930d7b94eb516e5e0

C:\Windows\onceinabluemoon.mid

MD5 0e528d000aad58b255c1cf8fd0bb1089
SHA1 2445d2cc0921aea9ae53b8920d048d6537940ec6
SHA256 c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae
SHA512 89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

C:\Windows\SysWOW64\KIM8R7F.exe

MD5 a1da1c556a5ad5ce7a47a8683881b2e9
SHA1 03c176bb12453ed4dca6cee77874aa430ab265f9
SHA256 df588f55678d6e45a1ffa28979e95909d04d916bcf5bc482093ea676b2f8936c
SHA512 9057d9a216914c2d93d8c9c26c9db0046c612c961e79db134cc11c1e94c14643c4879829c67b86a2c40b4f8a72c0a93ddff614a365c5be4543af521c55cd285f

C:\Windows\SysWOW64\DVU4E0WXEN3J3I.exe

MD5 beaa7641f44cd3b3d067d73ce88d76f4
SHA1 5f44e5db0cd914075f679137cf81091eb1bd3fcc
SHA256 85cc51a76b8535b509c396d921762df3346bbf6fd08894dd9aaee2329abf0580
SHA512 8f71c090617f468302e77f7300183a337e58511b6fc9594bdc5650d9787635cb7775e12dd6bea2ce6bcf881af1c15cc26e8b815b70bb38b67f4a38bc0c601492

C:\Windows\PVE5F8Q\ORO8S6L.com

MD5 a02a38227ff20987dbcb49ac5f9cc36f
SHA1 1575c023a560180c4815636d8d4a9332677258e1
SHA256 b397857a346100da998805afb0b80e4ecac48deae0c1b305207db8943a064f2a
SHA512 ab5041da5ca1c07a83af917ced19f8301c1f3ecbcd372842ef07a50acb0f68c78985948b71966730567894d0913333beb8faa432d2cd58bb31213103fc15455d

C:\Windows\RUH8O1U.exe

MD5 fb8e656237a7fe9ba4789ed69147c839
SHA1 b9eb622b21ff5b4cbeb13b2ed3ddaced247f7544
SHA256 eab45c0f91411efeb07a16ffa28d06ae62baf33af03916d3b4ebb800eec3be46
SHA512 deaee15f1e481e134e679bef1fc98825033b1438a84c2dcebad30311c7164dde8c0465588041a4b973ec519fa16de883208196a625a52447889fd22c207c4ffe

C:\Windows\lsass.exe

MD5 111afcce24816292885e221c8a118b62
SHA1 164f4ffd9148087abcbb1fd5a542ed3a1b88e95a
SHA256 cc7c0c15baa686ad482875b811f2d3e58920cb0b8b7b107cec66dbc407e8ce37
SHA512 e94e3c98532003427a2507545f5b506ca3267bca45a284efea0c18e3971fb664507ce302780aa711cecff0cbdea875f929ba12dea73e9ba2ef12b0614c30840d

C:\Windows\SysWOW64\systear.dll

MD5 e4e980ececd5bc5780a8eb71f0ad4ac7
SHA1 f6a9fa4209b1d1bc9cf74def58e604a14df18189
SHA256 e3c0da0dfbf52e539c17734130126f2a2994303cfb497b6b326e124db458cde6
SHA512 5fe7957ed51b094adea632df56ffd5a4acf354d3e6eb5d0fa7e3252de5dba8c75b9e128127a465df6757d353a7f62f2d9dd3350e122947ac081f650f27ae2a70

C:\Windows\moonlight.dll

MD5 8e6e31f8df128a746ff9a3a38f8f78c0
SHA1 e4da9aa336eb7e254592e585b29d8b4e23f3e4bd
SHA256 dc33796b634ea14ed80a492257f698d103a57e1a041ccab92945efa8201a65f7
SHA512 eddacadcb86d8ead42185af5ce779f35dcbf262b2e12dc1cb816c3c5e35563201a839b861eb4a2cda472a5a27b2dfb76a0310d6eb94b49e9d5b58af869ef22c6

C:\Windows\SysWOW64\KIM8R7F.exe

MD5 f9c8297efaf6291d1504456ebc665d51
SHA1 6dd39d1c0b930a3aab17f5b73da44031443ba19c
SHA256 ab07d1c1efb69447454bd845778674c3fef348dec2cbf94640055894d28629aa
SHA512 4af979ebb863b38bd896371b8aa473d48923f4206c0ea75a02b04ea5923d4631f67c4585d45f3972558952ec0ce08019fc861a3987d97bc444d4f34e590195ca

C:\Windows\SysWOW64\DVU4E0WXEN3J3I.exe

MD5 12e50de967bdf096690543fc697bc58d
SHA1 61b280994df0578943533b3ce2700f1947f7844e
SHA256 be97fff4050a20061f037c6da41e72c4778f916b14c6ae466d8a3003db0b31ab
SHA512 b0e4f6ee1d111107c1401da30843fb072d817b9c4973f337e9e1f0d5c3a45b5a4920404b935038fc58d163726379531d3572e0dfa8dca94d53a7637251b51e46

C:\Windows\PVE5F8Q\ORO8S6L.com

MD5 1f5998216fecf8fc0d5b003ee48c3cff
SHA1 a39027b98d40071ee7fb27784a28f8f159d324a3
SHA256 6d750c9d77563f0ffbb9a625b35cfd99cb050c057a42247fff2a7aa7d9170157
SHA512 02f11f807a176fb372612f9d741189ce011eb1a377d77ea8264370df9a005ec0c8690a1f074357e17a62356c644ec1d9b679e9ce96f82378fbb71672a4ee1443

C:\Windows\cypreg.dll

MD5 8bfe4d858a6597fbace8649427ab5b6f
SHA1 4f25915fe315a6f2795aec001dad837bbf3d7728
SHA256 add9dc562e49fec32fa34819b5d8add52e3ea5172825323af0cefd940fd28300
SHA512 624d140e2f7a0cc068dc5fa3b9c4067432ce0d8bdac821752bcda65bcaebf58009cb89cadd8db6de7ebb141aafd9f7c422109b4254c49a97842f03d1b1a14b73

memory/2472-167-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Windows\system\msvbvm60.dll

MD5 b821822bb2c66bee3975a0678ed0cfd2
SHA1 d5248d3579ec1e78e9701e286b9ec533e143e268
SHA256 fee1434388d771b4d9beb74200de6ae488ae80f1a7f2b22333dd921c60281192
SHA512 0c182bb8aac22553339c0641ecfeb1f2b43ec2e6c5c30800834afe3bfb33c37bab99657279ba82a388be824b47110b651d9872b96c9ca5797522b964b58570d0

C:\Windows\cypreg.dll

MD5 3e4aa52683adf2ae9b4ab3f64a02d1a2
SHA1 b7e309eb33f95a409401effd72f919c720030edb
SHA256 15c9ad0863df8f1db620e11044020a237fc27af295404ae62bc4bbd2608c5538
SHA512 2fb67a139fe992317e77c0acc291da363481a949f359b8472ceb0131c20a17d17d14d25682ab9b215290734532e564d72d75e8c1cc88d43dcd3fbba618732385

C:\Windows\SysWOW64\KIM8R7F.exe

MD5 7195c8a993b19299daf8dc95f3c5c6ab
SHA1 174ca6a1664fc69e3f66a688669d903076203bf6
SHA256 f25cc04ee2d6bfe52b8af52b65d07f66ec629e5b8dacd4d67c305bb3750b4848
SHA512 b3706d33dec856ed69dfc57c3b6e06636f9e0660910e67b982b8df12ae7d5bffcd16f66432f66975af9573fb931d03ed6c2ca8e303f400b2e71b03065e955e7e

C:\Windows\SysWOW64\DVU4E0WXEN3J3I.exe

MD5 587389eef86c0abafc8dbd1376eabc3b
SHA1 03aed37afe80adae0467de6464646ead1c35dccb
SHA256 d7287c741d934d8609b2b9d0abcbfd9b85b7be804ccac3a35a50563b1b753cdf
SHA512 4719d84ce37486325c97438f82781c2496fb77b0194adaf1b55e14bfdeb1da896aed57faa4ed36e3a974709813265854413626d8fdff1789fdb310a2a305e60e

C:\Windows\SysWOW64\DVU4E0WXEN3J3I.exe

MD5 f40ae46ce1b057ff9ff29a504a3417f0
SHA1 33cde886719ca407e6b034d4c9008e8597aa1e06
SHA256 2507dd912809cc4f5421116a2efcb6b12c3bd3a4e5ba53b681dd62c16618d68e
SHA512 9c822137f6ac87cc3ea0bde5d7fe36d01d9cd1fc02530f92bdcd6ca25935743a91fc3ca8b87975d579ad6036b351d8f0e9249ab9aee5ead955eb931ed23ea4dd

C:\Windows\RUH8O1U.exe

MD5 ac6e0cbd27767691d886d2c023edaf85
SHA1 48f48da4ace4261b98a7788527ad03bc46042f2e
SHA256 6853bdadf72dd67297c04c330d6f058d89d6bebca61155dedbc53f290970514d
SHA512 5486f8a6cc39b05938c82ab925b4990bc3318f8f14febda3df69123678750db66c3582e499b59116f0e2559c259820211aae3fa4188d5de88aebc8849bc1331f

C:\Windows\SysWOW64\TKM0P1C\DVU4E0W.cmd

MD5 4296fa565bab429893deaca533a4ca4d
SHA1 cb01bcc6a71a5a49738493d06f57b989437d41b7
SHA256 74b09cc464a809af819bbce527d61e6d5df1d2d90d7a8ea8d99f2f07f0da81fc
SHA512 aa8c798be21462471ad4c88d7ca74f8b347c3776294c1d39458b21c508f9f0cb97f292b717781aa44f3549942422eb43e929bb59df0834112cbbb4bce9e2ed2f

C:\Windows\PVE5F8Q\regedit.cmd

MD5 3920d4e57809d8e91b70311609c7538f
SHA1 627ca4efbb916ee7a8a3a72937a45991692bde7c
SHA256 8efa9c784a52f65cfee0ec8a887a09aa331e020dc18ff0a91f3408edef195db0
SHA512 b59e213b49d13661df98924b0d7647a592d445e1dd773beedde98fd3dcde13b4b5a6ee10e7af6e0020e6be7cb147528762df0d838da1441ee9df7e87df5b0605

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 23:01

Reported

2024-04-07 23:04

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PVE5F8Q\\CRX7K5Q.exe\"" C:\Windows\PVE5F8Q\system.exe N/A

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\PVE5F8Q\system.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\PVE5F8Q\system.exe N/A

Disables use of System Restore points

evasion

Sets file execution options in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\PVE5F8Q\\regedit.cmd" C:\Windows\PVE5F8Q\system.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe C:\Windows\PVE5F8Q\system.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe" C:\Windows\PVE5F8Q\system.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe C:\Windows\PVE5F8Q\system.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" C:\Windows\PVE5F8Q\system.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe C:\Windows\PVE5F8Q\system.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\PVE5F8Q\service.exe N/A
N/A N/A C:\Windows\PVE5F8Q\smss.exe N/A
N/A N/A C:\Windows\PVE5F8Q\system.exe N/A
N/A N/A C:\Windows\PVE5F8Q\winlogon.exe N/A
N/A N/A C:\Windows\lsass.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\PVE5F8Q\system.exe N/A
N/A N/A C:\Windows\PVE5F8Q\system.exe N/A
N/A N/A C:\Windows\PVE5F8Q\system.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" C:\Windows\PVE5F8Q\system.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sVE8P1U0 = "C:\\Windows\\system32\\EVU4E0WXFO3J3I.exe" C:\Windows\PVE5F8Q\system.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0K5QFO = "C:\\Windows\\SUH8P1U.exe" C:\Windows\PVE5F8Q\system.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\J: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\K: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\L: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\Q: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\H: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\M: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\U: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\W: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\Z: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\G: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\N: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\P: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\R: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\S: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\T: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\Y: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\I: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\O: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\V: C:\Windows\PVE5F8Q\service.exe N/A
File opened (read-only) \??\X: C:\Windows\PVE5F8Q\service.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\regedit.exe C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\SysWOW64\TLM0P1C C:\Windows\lsass.exe N/A
File opened for modification C:\Windows\SysWOW64\TLM0P1C\EVU4E0W.cmd C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\SysWOW64\EVU4E0WXFO3J3I.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\SysWOW64\KJM8S7F.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\SysWOW64\systear.dll C:\Windows\PVE5F8Q\service.exe N/A
File opened for modification C:\Windows\SysWOW64\EVU4E0WXFO3J3I.exe C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\SysWOW64\systear.dll C:\Windows\PVE5F8Q\smss.exe N/A
File opened for modification C:\Windows\SysWOW64\regedit.exe C:\Windows\lsass.exe N/A
File opened for modification C:\Windows\SysWOW64\EVU4E0WXFO3J3I.exe C:\Windows\PVE5F8Q\service.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\SysWOW64\KJM8S7F.exe C:\Windows\PVE5F8Q\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\TLM0P1C\EVU4E0W.cmd C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\SysWOW64\systear.dll C:\Windows\lsass.exe N/A
File opened for modification C:\Windows\SysWOW64\systear.dll C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\PVE5F8Q\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\TLM0P1C\EVU4E0W.cmd C:\Windows\PVE5F8Q\smss.exe N/A
File opened for modification C:\Windows\SysWOW64\KJM8S7F.exe C:\Windows\lsass.exe N/A
File opened for modification C:\Windows\SysWOW64\regedit.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\SysWOW64\regedit.exe C:\Windows\PVE5F8Q\smss.exe N/A
File opened for modification C:\Windows\SysWOW64\TLM0P1C\EVU4E0W.cmd C:\Windows\PVE5F8Q\service.exe N/A
File opened for modification C:\Windows\SysWOW64\TLM0P1C\EVU4E0W.cmd C:\Windows\PVE5F8Q\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\KJM8S7F.exe C:\Windows\PVE5F8Q\service.exe N/A
File opened for modification C:\Windows\SysWOW64\TLM0P1C\EVU4E0W.cmd C:\Windows\lsass.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\SysWOW64\TLM0P1C C:\Windows\PVE5F8Q\smss.exe N/A
File opened for modification C:\Windows\SysWOW64\regedit.exe C:\Windows\PVE5F8Q\service.exe N/A
File opened for modification C:\Windows\SysWOW64\systear.dll C:\Windows\PVE5F8Q\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\KJM8S7F.exe C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\SysWOW64\KJM8S7F.exe C:\Windows\PVE5F8Q\smss.exe N/A
File opened for modification C:\Windows\SysWOW64\systear.dll C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\SysWOW64\EVU4E0WXFO3J3I.exe C:\Windows\lsass.exe N/A
File opened for modification C:\Windows\SysWOW64\TLM0P1C C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\SysWOW64\TLM0P1C C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\SysWOW64\TLM0P1C C:\Windows\PVE5F8Q\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\PVE5F8Q\service.exe N/A
File opened for modification C:\Windows\SysWOW64\EVU4E0WXFO3J3I.exe C:\Windows\PVE5F8Q\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\lsass.exe N/A
File opened for modification C:\Windows\SysWOW64\TLM0P1C C:\Windows\PVE5F8Q\service.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\PVE5F8Q\smss.exe N/A
File opened for modification C:\Windows\SysWOW64\EVU4E0WXFO3J3I.exe C:\Windows\PVE5F8Q\smss.exe N/A
File opened for modification C:\Windows\SysWOW64\regedit.exe C:\Windows\PVE5F8Q\winlogon.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\PVE5F8Q\winlogon.exe C:\Windows\PVE5F8Q\winlogon.exe N/A
File opened for modification C:\Windows\system\msvbvm60.dll C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\PVE5F8Q\winlogon.exe C:\Windows\PVE5F8Q\system.exe N/A
File created C:\Windows\MooNlight.txt C:\Windows\PVE5F8Q\smss.exe N/A
File opened for modification C:\Windows\system\msvbvm60.dll C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\PVE5F8Q\winlogon.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\moonlight.dll C:\Windows\PVE5F8Q\smss.exe N/A
File opened for modification C:\Windows\PVE5F8Q C:\Windows\PVE5F8Q\winlogon.exe N/A
File opened for modification C:\Windows\moonlight.dll C:\Windows\lsass.exe N/A
File opened for modification C:\Windows\PVE5F8Q\smss.exe C:\Windows\lsass.exe N/A
File opened for modification C:\Windows\64enc.en C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\lsass.exe C:\Windows\PVE5F8Q\winlogon.exe N/A
File opened for modification C:\Windows\PVE5F8Q\smss.exe C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\PVE5F8Q C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\PVE5F8Q\regedit.cmd C:\Windows\PVE5F8Q\service.exe N/A
File opened for modification C:\Windows\XFO3J3I.exe C:\Windows\PVE5F8Q\smss.exe N/A
File opened for modification C:\Windows\PVE5F8Q\PSO8S6M.com C:\Windows\PVE5F8Q\service.exe N/A
File opened for modification C:\Windows\cypreg.dll C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\PVE5F8Q\service.exe C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\PVE5F8Q\regedit.cmd C:\Windows\PVE5F8Q\smss.exe N/A
File opened for modification C:\Windows\PVE5F8Q\CRX7K5Q.exe C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\PVE5F8Q\system.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\PVE5F8Q\CRX7K5Q.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\onceinabluemoon.mid C:\Windows\PVE5F8Q\smss.exe N/A
File opened for modification C:\Windows\PVE5F8Q\smss.exe C:\Windows\PVE5F8Q\winlogon.exe N/A
File opened for modification C:\Windows\system\msvbvm60.dll C:\Windows\PVE5F8Q\service.exe N/A
File opened for modification C:\Windows\system\msvbvm60.dll C:\Windows\PVE5F8Q\smss.exe N/A
File opened for modification C:\Windows\SUH8P1U.exe C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\PVE5F8Q\PSO8S6M.com C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\cypreg.dll C:\Windows\PVE5F8Q\smss.exe N/A
File opened for modification C:\Windows\PVE5F8Q\CRX7K5Q.exe C:\Windows\PVE5F8Q\winlogon.exe N/A
File opened for modification C:\Windows\XFO3J3I.exe C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\PVE5F8Q\service.exe C:\Windows\lsass.exe N/A
File opened for modification C:\Windows\PVE5F8Q C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\lsass.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\PVE5F8Q C:\Windows\PVE5F8Q\smss.exe N/A
File opened for modification C:\Windows\PVE5F8Q\system.exe C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\cypreg.dll C:\Windows\lsass.exe N/A
File opened for modification C:\Windows\PVE5F8Q\winlogon.exe C:\Windows\lsass.exe N/A
File opened for modification C:\Windows\PVE5F8Q\regedit.cmd C:\Windows\lsass.exe N/A
File opened for modification C:\Windows\XFO3J3I.exe C:\Windows\PVE5F8Q\service.exe N/A
File opened for modification C:\Windows\PVE5F8Q\PSO8S6M.com C:\Windows\PVE5F8Q\winlogon.exe N/A
File opened for modification C:\Windows\PVE5F8Q\CRX7K5Q.exe C:\Windows\PVE5F8Q\smss.exe N/A
File opened for modification C:\Windows\system\msvbvm60.dll C:\Windows\lsass.exe N/A
File opened for modification C:\Windows\moonlight.dll C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\PVE5F8Q\PSO8S6M.com C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\PVE5F8Q C:\Windows\PVE5F8Q\service.exe N/A
File opened for modification C:\Windows\lsass.exe C:\Windows\PVE5F8Q\service.exe N/A
File opened for modification C:\Windows\PVE5F8Q\PSO8S6M.com C:\Windows\lsass.exe N/A
File opened for modification C:\Windows\PVE5F8Q\CRX7K5Q.exe C:\Windows\lsass.exe N/A
File opened for modification C:\Windows\SUH8P1U.exe C:\Windows\PVE5F8Q\smss.exe N/A
File opened for modification C:\Windows\onceinabluemoon.mid C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\moonlight.dll C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\PVE5F8Q\service.exe C:\Windows\PVE5F8Q\service.exe N/A
File opened for modification C:\Windows\PVE5F8Q\winlogon.exe C:\Windows\PVE5F8Q\service.exe N/A
File opened for modification C:\Windows\PVE5F8Q\MYpIC.zip C:\Windows\PVE5F8Q\system.exe N/A
File opened for modification C:\Windows\PVE5F8Q\service.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\PVE5F8Q\regedit.cmd C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\XFO3J3I.exe C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
File opened for modification C:\Windows\XFO3J3I.exe C:\Windows\PVE5F8Q\winlogon.exe N/A
File opened for modification C:\Windows\moonlight.dll C:\Windows\PVE5F8Q\winlogon.exe N/A
File opened for modification C:\Windows\PVE5F8Q\PSO8S6M.com C:\Windows\PVE5F8Q\smss.exe N/A
File opened for modification C:\Windows\SUH8P1U.exe C:\Windows\PVE5F8Q\winlogon.exe N/A
File opened for modification C:\Windows\PVE5F8Q\system.exe C:\Windows\PVE5F8Q\smss.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile C:\Windows\PVE5F8Q\system.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" C:\Windows\PVE5F8Q\system.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile C:\Windows\PVE5F8Q\system.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" C:\Windows\PVE5F8Q\system.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1628 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\service.exe
PID 1628 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\service.exe
PID 1628 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\service.exe
PID 1628 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\smss.exe
PID 1628 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\smss.exe
PID 1628 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\smss.exe
PID 1628 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\system.exe
PID 1628 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\system.exe
PID 1628 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\system.exe
PID 1628 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\winlogon.exe
PID 1628 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\winlogon.exe
PID 1628 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\PVE5F8Q\winlogon.exe
PID 1628 wrote to memory of 4276 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\lsass.exe
PID 1628 wrote to memory of 4276 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\lsass.exe
PID 1628 wrote to memory of 4276 N/A C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe C:\Windows\lsass.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe

"C:\Users\Admin\AppData\Local\Temp\8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536.exe"

C:\Windows\PVE5F8Q\service.exe

"C:\Windows\PVE5F8Q\service.exe"

C:\Windows\PVE5F8Q\smss.exe

"C:\Windows\PVE5F8Q\smss.exe"

C:\Windows\PVE5F8Q\system.exe

"C:\Windows\PVE5F8Q\system.exe"

C:\Windows\PVE5F8Q\winlogon.exe

"C:\Windows\PVE5F8Q\winlogon.exe"

C:\Windows\lsass.exe

"C:\Windows\lsass.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4508 -ip 4508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1172

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4508 -ip 4508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4508 -ip 4508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1404

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
DE 172.217.16.196:80 www.google.com tcp
US 8.8.8.8:53 196.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 smtp.cs.sta udp
US 8.8.8.8:53 mail.cs.sta udp
US 8.8.8.8:53 ns1.cs.sta udp
US 8.8.8.8:53 mx1.cs.sta udp
US 8.8.8.8:53 mail1.cs.sta udp
US 8.8.8.8:53 mx.cs.sta udp
US 8.8.8.8:53 mxs.cs.sta udp
US 8.8.8.8:53 relay.cs.sta udp
US 8.8.8.8:53 gate.cs.sta udp
US 8.8.8.8:53 smtp.burtleburtle.net udp
US 65.254.250.102:25 smtp.burtleburtle.net tcp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 mail.burtleburtle.net udp
US 65.254.250.102:25 mail.burtleburtle.net tcp
US 8.8.8.8:53 ns1.burtleburtle.net udp
US 65.254.250.102:25 ns1.burtleburtle.net tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 mx1.burtleburtle.net udp
US 65.254.250.102:25 mx1.burtleburtle.net tcp
US 8.8.8.8:53 98.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 mail1.burtleburtle.net udp
US 65.254.250.102:25 mail1.burtleburtle.net tcp
US 8.8.8.8:53 mx.burtleburtle.net udp
US 65.254.254.50:25 mx.burtleburtle.net tcp
US 65.254.250.102:25 mail1.burtleburtle.net tcp

Files

memory/1628-0-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Windows\PVE5F8Q\service.exe

MD5 4296fa565bab429893deaca533a4ca4d
SHA1 cb01bcc6a71a5a49738493d06f57b989437d41b7
SHA256 74b09cc464a809af819bbce527d61e6d5df1d2d90d7a8ea8d99f2f07f0da81fc
SHA512 aa8c798be21462471ad4c88d7ca74f8b347c3776294c1d39458b21c508f9f0cb97f292b717781aa44f3549942422eb43e929bb59df0834112cbbb4bce9e2ed2f

C:\Windows\PVE5F8Q\smss.exe

MD5 57eae52c2647f9f77d785d99c397e366
SHA1 e64f1fb8ef5717e0675158173f9ac23f1ba238c4
SHA256 fb52d48f0c2a41b02b15a3a470ea9bb8b2e23b71a5aed9696c790a47b41aaeb1
SHA512 4ebfb83ef7d4069ea660bb572742baa66831fc1a8d7db5fd26350fa68af3b86e11473df6673923c3c4ee1ad4323fc6231c6f0b2897684c70a6be2f42a2f2e832

memory/4508-86-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Windows\PVE5F8Q\winlogon.exe

MD5 f40ae46ce1b057ff9ff29a504a3417f0
SHA1 33cde886719ca407e6b034d4c9008e8597aa1e06
SHA256 2507dd912809cc4f5421116a2efcb6b12c3bd3a4e5ba53b681dd62c16618d68e
SHA512 9c822137f6ac87cc3ea0bde5d7fe36d01d9cd1fc02530f92bdcd6ca25935743a91fc3ca8b87975d579ad6036b351d8f0e9249ab9aee5ead955eb931ed23ea4dd

C:\Windows\PVE5F8Q\system.exe

MD5 fb8e656237a7fe9ba4789ed69147c839
SHA1 b9eb622b21ff5b4cbeb13b2ed3ddaced247f7544
SHA256 eab45c0f91411efeb07a16ffa28d06ae62baf33af03916d3b4ebb800eec3be46
SHA512 deaee15f1e481e134e679bef1fc98825033b1438a84c2dcebad30311c7164dde8c0465588041a4b973ec519fa16de883208196a625a52447889fd22c207c4ffe

memory/1808-71-0x0000000000400000-0x0000000000452000-memory.dmp

memory/1208-92-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Windows\lsass.exe

MD5 111afcce24816292885e221c8a118b62
SHA1 164f4ffd9148087abcbb1fd5a542ed3a1b88e95a
SHA256 cc7c0c15baa686ad482875b811f2d3e58920cb0b8b7b107cec66dbc407e8ce37
SHA512 e94e3c98532003427a2507545f5b506ca3267bca45a284efea0c18e3971fb664507ce302780aa711cecff0cbdea875f929ba12dea73e9ba2ef12b0614c30840d

memory/4712-145-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Windows\onceinabluemoon.mid

MD5 0e528d000aad58b255c1cf8fd0bb1089
SHA1 2445d2cc0921aea9ae53b8920d048d6537940ec6
SHA256 c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae
SHA512 89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

C:\Windows\system\msvbvm60.dll

MD5 220cd5b36a14cfc83715839698aeaaa8
SHA1 e2957eb14abffa17ad61b7555221803444f92288
SHA256 eb319cc5c5e432b3f111b185fa12e1410b43d90b81b4bd8d7f007c860256b4b1
SHA512 65f4473e6f2f6af2c9197fb25955b58f1f2504b3cf364e6e6f41b9e1ba9fb6a80613797a0b4b24b41ce88b1f2afbb52cc3efcc5a362c4f54f2beb745028a9441

C:\Windows\system\msvbvm60.dll

MD5 3437e10753a2babaf912e7f35933cc46
SHA1 ba859ede6f76ea2fa04af875ad50b53b8c5e269a
SHA256 121a3871efbfe54e2914cb90453ba26af3df816b936c7136d23c1799789b43eb
SHA512 b3c85402b16951ad87d7379929be8b303953ea420f3537128304b8f882db353274caab8996c52a4ba994a99ede2ca87b704bf7ea286dae46b8d7fda775d6f510

C:\Windows\SysWOW64\TLM0P1C\EVU4E0W.cmd

MD5 f9c8297efaf6291d1504456ebc665d51
SHA1 6dd39d1c0b930a3aab17f5b73da44031443ba19c
SHA256 ab07d1c1efb69447454bd845778674c3fef348dec2cbf94640055894d28629aa
SHA512 4af979ebb863b38bd896371b8aa473d48923f4206c0ea75a02b04ea5923d4631f67c4585d45f3972558952ec0ce08019fc861a3987d97bc444d4f34e590195ca

C:\Windows\cypreg.dll

MD5 b8ebc4cf5cfc35dbd116076639c6ea4a
SHA1 8ccb2941483c70095ecc1f77b5d34465c1b3fc07
SHA256 2e5fcf58ca00004e2ab8793fb8ab64121119d4f737f6eb5baa7f52f8d3059d10
SHA512 6ba8d358e216965ee4b1c16afa21c8a773d8c903a6d37ae15ded25f0f13bf3424480a6e50c7d90c755c545b2c45ed1c0086993b427c2c37b492e775faec4f8ea

C:\Windows\lsass.exe

MD5 12e50de967bdf096690543fc697bc58d
SHA1 61b280994df0578943533b3ce2700f1947f7844e
SHA256 be97fff4050a20061f037c6da41e72c4778f916b14c6ae466d8a3003db0b31ab
SHA512 b0e4f6ee1d111107c1401da30843fb072d817b9c4973f337e9e1f0d5c3a45b5a4920404b935038fc58d163726379531d3572e0dfa8dca94d53a7637251b51e46

C:\Windows\SysWOW64\systear.dll

MD5 8f0794e1e6314e9ad6162d46c4437e51
SHA1 7ace85d84734cc7715dbf885a0dca27fc731081e
SHA256 9038e197ad507b25a98de9a155d6fce2c85af18f78cf68012a64579215f0618c
SHA512 c6cb7925d353530422407620843d369861e9acb4c95ed5125fe55f47a32639664ea99bf95120ce8503f889daadb9650814089456c59e7b214c83e596dae92a35

memory/4276-284-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Windows\PVE5F8Q\regedit.cmd

MD5 aa6931694e830acff7e756a967f4cf07
SHA1 d90772c816d81302f15db224a4e5e9ecb7d53874
SHA256 de48c431a18258e4fe8ffd9b8a10324d94d3407b3c9210a686702ae06f90e5f1
SHA512 cd7582ec458e91e2b84b44a67c8ac37eb5254e0d1c576dfd39646aad036ece4601b37c37b91aa978863a141792bd05d813f83f68fe54b80097b4ce0a274e63d9

memory/1628-286-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Users\Admin\Pictures\My Pictures.exe

MD5 3920d4e57809d8e91b70311609c7538f
SHA1 627ca4efbb916ee7a8a3a72937a45991692bde7c
SHA256 8efa9c784a52f65cfee0ec8a887a09aa331e020dc18ff0a91f3408edef195db0
SHA512 b59e213b49d13661df98924b0d7647a592d445e1dd773beedde98fd3dcde13b4b5a6ee10e7af6e0020e6be7cb147528762df0d838da1441ee9df7e87df5b0605

C:\Users\Admin\Music\My Music.exe

MD5 d0051ebb1e6e8941649cf9237e1fb170
SHA1 06999a7e8f9a169322b2c431e83e5650df57220f
SHA256 905a0b23d2ec748185a1e4e76d9f3260aa21da8573fb83db85d1807661cecfac
SHA512 df5de957660c752614beb0e86ba23cba5d6bb507d809581dc84404ca5fc4fde0119df1bd6ad786d4ddb8e38da2e241d24dcddccbd3c3a69930d7b94eb516e5e0

C:\Windows\SysWOW64\EVU4E0WXFO3J3I.exe

MD5 3f4072ee255e78850d04738fa6ba60b9
SHA1 143cc27f25c87d460f88a4311be49a0bbc010fc0
SHA256 5ddcf82602a64bb17a7f7a52b1e4b34c9f63030166fb8ab7743c7e8ba16a943f
SHA512 53b59f86b1c48cc969fd36bf57408bd613ab507f1f44d43ed9ccb04501f3fcf15895bd08b13c90e27f9d76a5e3b04a60493850510c78a3d45aaadc5ef7a8ee55

C:\Windows\PVE5F8Q\PSO8S6M.com

MD5 a1da1c556a5ad5ce7a47a8683881b2e9
SHA1 03c176bb12453ed4dca6cee77874aa430ab265f9
SHA256 df588f55678d6e45a1ffa28979e95909d04d916bcf5bc482093ea676b2f8936c
SHA512 9057d9a216914c2d93d8c9c26c9db0046c612c961e79db134cc11c1e94c14643c4879829c67b86a2c40b4f8a72c0a93ddff614a365c5be4543af521c55cd285f

C:\Windows\XFO3J3I.exe

MD5 adee3cb8139fe9fd5488880b31b66a92
SHA1 67289462c6a164159c6e5a29fdbd867d3628d84e
SHA256 cf624a5017ec530cb59d14f1cb0b6eae99eb28f5b453245677e4500cea58b4c5
SHA512 8a1908bdebfd1dee54d9a9b5e296f81983d90c24b67b72974098a0965504dd811fc88db38ad18697a3325f9faeedcd9ed808142e2ba1adff156b91f349d7874b

C:\Windows\PVE5F8Q\CRX7K5Q.exe

MD5 8874ce8fdb7b34f17de9f2747b314b8b
SHA1 42920688b73f4b9e657858091677b48985740f1c
SHA256 06ca5a2cb470171386657c2485d880d383f47a581eff41ee9456f1b5689e7fdd
SHA512 179d4593d24bf75397271a44a8c0544fee3c7ceeb4a3c64f6a2ac47258b541f07f56d7833b0a65691ef0346d54d30029eb8d3c9a12f05871fcb798ab8eb8e6a0

C:\Windows\SysWOW64\KJM8S7F.exe

MD5 a02a38227ff20987dbcb49ac5f9cc36f
SHA1 1575c023a560180c4815636d8d4a9332677258e1
SHA256 b397857a346100da998805afb0b80e4ecac48deae0c1b305207db8943a064f2a
SHA512 ab5041da5ca1c07a83af917ced19f8301c1f3ecbcd372842ef07a50acb0f68c78985948b71966730567894d0913333beb8faa432d2cd58bb31213103fc15455d

C:\Windows\SUH8P1U.exe

MD5 5f37e6ba28787558f1759df5e491200e
SHA1 f9fc6a1cad0c1d980e7f52b1423d4116ce415ed3
SHA256 6b2ed3c0e3fb50c05a261657074d6b61b8bfe2b8c51235d46ae67ce46b861be0
SHA512 69d52e153c98dce1dd98583e8a736464e50c916c86b409603e3e8a294c78018259542d02d1a6b57c8beab778f182c98aa618ad16e62bc43093c41b441d4440fe

C:\Windows\PVE5F8Q\regedit.cmd

MD5 8a15e41e6155e5ea9170f21aa48cff17
SHA1 9d112e37857c2e918913256c63ccc3456e8f3a6f
SHA256 28050d5b8e73c064265d22a0c531272cb97c91595a224cfc5d836a83a6965fb6
SHA512 5a44546b9b5c386df754c974f4c0162e115eeca9e8f5fa71295c6fb1abf4782a65cfdae3f77bcc82ff4dbd48b86607c3b8a0c3f7a5a3b546715456fee5f3f9e6

C:\Windows\cypreg.dll

MD5 e311ef4df4009a9926e9d774568ad810
SHA1 8b546b1b626a28a4b117359065e43d5217cb9cfe
SHA256 dba59c4d0417da694c70255a4741b94c92bd6206b932870b4d1b8eefe7fbd9b8
SHA512 597399a7c5cb4b34de5ce070ccd2c2684bb601dded6456eb0bbd7a0cd13d0d4cefbbdc3a9a445840f033a49ec2554c46764535e115897623476ab6be64a89452

C:\Windows\system\msvbvm60.dll

MD5 faccb368f1c32d9466d95f537be6983d
SHA1 4d34d1bf813a86bf952a6aab00cd79853bf6f109
SHA256 c91e9718a7ddf97a0a3006751af147415b1cc97e037d908d9d883b3942187a1a
SHA512 8f4a76f4ca840f833774b1cd7dfd7b96e992d7ac33c9f5750656ffaa9f74b6c3cfe876d09d2c2bb7fb4c04b47e9dde8d3fff9fdb3aea8e948d52d3f7a2b00b37

C:\Windows\lsass.exe

MD5 587389eef86c0abafc8dbd1376eabc3b
SHA1 03aed37afe80adae0467de6464646ead1c35dccb
SHA256 d7287c741d934d8609b2b9d0abcbfd9b85b7be804ccac3a35a50563b1b753cdf
SHA512 4719d84ce37486325c97438f82781c2496fb77b0194adaf1b55e14bfdeb1da896aed57faa4ed36e3a974709813265854413626d8fdff1789fdb310a2a305e60e

C:\Windows\SUH8P1U.exe

MD5 2ccdeb08d69dbc87a04afffd19abb2dc
SHA1 8260828f86ede25937b6360b61715a5d1c4d61d8
SHA256 8798bcb0610ba017b2406bfc3d013540158cd76f4352d7e772c6e5dfbf665536
SHA512 44e585768acb76bb76bc581c68c9bfd1c6dc0b6a85a9a3416549e368bcd93aed549996aead0121920d10aae07b96ed60b5aa26b636c29840f357b750b5c7f6ca

C:\Windows\cypreg.dll

MD5 bb3c024a20350fd9f1f31ae8dce3ec0e
SHA1 29e02419ed33c771c3bfe255d41007af9795ab25
SHA256 3d6dc948c793598e28de3bbe9345e9f891c1a6371c2a0e0444475a56b05c0439
SHA512 85cc23c8f2b31c284f17e6a3faf91e5d50dea9a9495f7a04623de06d3b218c3f2f2d623911987f4d2a4755762b317ee55e5aede5362b308b7fc4ed68d17f6fdb

C:\Windows\moonlight.dll

MD5 8e6e31f8df128a746ff9a3a38f8f78c0
SHA1 e4da9aa336eb7e254592e585b29d8b4e23f3e4bd
SHA256 dc33796b634ea14ed80a492257f698d103a57e1a041ccab92945efa8201a65f7
SHA512 eddacadcb86d8ead42185af5ce779f35dcbf262b2e12dc1cb816c3c5e35563201a839b861eb4a2cda472a5a27b2dfb76a0310d6eb94b49e9d5b58af869ef22c6

C:\Windows\SysWOW64\systear.dll

MD5 4a7ba74c72ee9129ab26d45cf4a028bf
SHA1 c40046b9ea138df83a57a0f16507c9775d00b27b
SHA256 3b454d09b19a0db5a27a2331ebbee5c8c60e2781dbfc70e00291ffe09657064e
SHA512 58771e1185e5e4a5e6c267e7729e7b29d5922b1761eb3f18dec38d0124ed9904d93caf1e9cb95f3472098d2ee6710dc6671c6b546d7cf43616a25d6d265b7a7c

memory/4508-307-0x0000000010000000-0x0000000010075000-memory.dmp

memory/4508-309-0x0000000000400000-0x0000000000452000-memory.dmp

memory/1808-308-0x0000000000400000-0x0000000000452000-memory.dmp

memory/1208-315-0x0000000000400000-0x0000000000452000-memory.dmp

memory/4712-316-0x0000000000400000-0x0000000000452000-memory.dmp

memory/4276-317-0x0000000000400000-0x0000000000452000-memory.dmp