801d7b8a1640e5ae8f8561c5cbd38e1bd19b42bb9f925646ec71d27255b9196b

Analysis

max time kernel
65s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MoonlightSetup-5.0.1.exe
Size

53.3MB
MD5

8066f6f66a7d8b62907dcc7d4c3c8c1f
SHA1

ba8f816439d8cfc2101c4629394c1ca9caf9eec5
SHA256

801d7b8a1640e5ae8f8561c5cbd38e1bd19b42bb9f925646ec71d27255b9196b
SHA512

c47b9dc4c3c4f1bab2424d9910709b9b8107d14014d4539f011d188973156245ecb1ced8b59c432f161e9a14aaa0adcab4288451174107e3fe777bbb0d3ef817
SSDEEP

1572864:Clwsgf4Y37O2JgdkIGVrhlCphLp2P+9Iid+dI:ClF6jO2JguIornCphLp2QR

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

MoonlightSetup.exeVC_redist.x64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{33FE6E7B-2B3E-4B59-9F47-1B6C1E9953A6} = "\"C:\\ProgramData\\Package Cache\\{33FE6E7B-2B3E-4B59-9F47-1B6C1E9953A6}\\MoonlightSetup.exe\" /burn.clean.room /burn.runonce"	MoonlightSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{8bdfe669-9705-4184-9368-db9ce581e0e7} = "\"C:\\ProgramData\\Package Cache\\{8bdfe669-9705-4184-9368-db9ce581e0e7}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exe

flow pid process

59 1068 msiexec.exe
61 1068 msiexec.exe
64 1068 msiexec.exe
Downloads MZ/PE file

flow	pid	process
59	1068	msiexec.exe
61	1068	msiexec.exe
64	1068	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MoonlightSetup-5.0.1.exeVC_redist.x64.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	MoonlightSetup-5.0.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe

Drops file in System32 directory 50 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files\Moonlight Game Streaming\QtQml\StateMachine\qtqmlstatemachine.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Dial.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Switch.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\ToolButton.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\Frame.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Templates.2\plugins.qmltypes	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\libssl-1_1-x64.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\FastBlur.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\ScrollIndicator.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\HorizontalHeaderView.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\TabBar.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Window.2\plugins.qmltypes	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\libGLESv2.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\imageformats\qico.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\ComboBox.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\CursorDelegate.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\SwipeDelegate.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\translations\qt_bg.qm	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\d3dcompiler_47.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\discord-rpc.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\imageformats\qgif.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQml\Models.2\modelsplugin.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick.2\qmldir	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\MenuSeparator.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\ToolBar.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\translations\qt_ar.qm	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQml\Models.2\qmldir	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\scenegraph\qsgd3d12backend.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\translations\qt_cs.qm	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\HorizontalHeaderView.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\ToolTip.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\Drawer.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\PageIndicator.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQml\RemoteObjects\qtqmlremoteobjects.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick.2\plugins.qmltypes	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\RoundButton.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\Qt5Core.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\ZoomBlur.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\SwipeView.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\RadioButton.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQml\qmldir	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\translations\qt_ko.qm	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\iconengines\qsvgicon.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\private\GaussianInnerShadow.qmlc	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQml\RemoteObjects\plugins.qmltypes	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\Label.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\plugins.qmltypes	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQml\RemoteObjects\qmldir	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\imageformats\qwebp.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\GammaAdjust.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Pane.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\CheckDelegate.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\MenuSeparator.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\BrightnessContrast.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\CheckIndicator.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\avutil-58.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\InnerShadow.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\PageIndicator.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\Glow.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Drawer.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\ToolTip.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\translations\qt_lv.qm	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick.2\qtquick2plugin.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\ApplicationWindow.qml	msiexec.exe

Drops file in Windows directory 24 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIEF86.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEFF5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF4E7.tmp	msiexec.exe
File created	C:\Windows\Installer\e57dad2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF28.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D5D19E2F-7189-42FE-8103-92CD1FA457C2}	msiexec.exe
File created	C:\Windows\Installer\e57dae8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED81.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57dac0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDD31.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6433A1CF-77CA-44EB-A159-3480EA977FAE}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF35.tmp	msiexec.exe
File created	C:\Windows\Installer\e57dad3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57dad3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE34D.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0025DD72-A959-45B5-A0A3-7EFEB15A8050}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE5BF.tmp	msiexec.exe
File created	C:\Windows\Installer\e57dac0.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e57daed.msi	msiexec.exe
File created	C:\Windows\Installer\e57dae9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57dae9.msi	msiexec.exe

Executes dropped EXE 6 IoCs

Processes:

MoonlightSetup-5.0.1.exeMoonlightSetup.exeVC_redist.x64.exeVC_redist.x64.exeVC_redist.x64.exeMoonlight.exe

pid process

3968 MoonlightSetup-5.0.1.exe
4608 MoonlightSetup.exe
4028 VC_redist.x64.exe
3584 VC_redist.x64.exe
4500 VC_redist.x64.exe
752 Moonlight.exe

Loads dropped DLL 53 IoCs

Processes:

MoonlightSetup-5.0.1.exeVC_redist.x64.exeVC_redist.x64.exeMsiExec.exeMsiExec.exeMoonlight.exe

pid	process
3968	MoonlightSetup-5.0.1.exe
3584	VC_redist.x64.exe
4088	VC_redist.x64.exe
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
4964	MsiExec.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exeMoonlight.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003d697fb93d0c6eb40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003d697fb90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003d697fb9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3d697fb9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003d697fb900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Moonlight.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Moonlight.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Moonlight.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Moonlight.exe

Modifies data under HKEY_USERS 14 IoCs

Processes:

msiexec.exeMsiExec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe

Modifies registry class 64 IoCs

Processes:

MoonlightSetup.exeVC_redist.x64.exemsiexec.exeVC_redist.x64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{6433A1CF-77CA-44EB-A159-3480EA977FAE}_v5.0.1.0\Dependents	MoonlightSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\Version = "14.36.32532.0"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{D5D19E2F-7189-42FE-8103-92CD1FA457C2}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{6433A1CF-77CA-44EB-A159-3480EA977FAE}_v5.0.1.0\ = "{6433A1CF-77CA-44EB-A159-3480EA977FAE}"	MoonlightSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FC1A3346AC77BE441A954308AE79F7EA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FC1A3346AC77BE441A954308AE79F7EA\ProductFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{0025DD72-A959-45B5-A0A3-7EFEB15A8050}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\ = "{8bdfe669-9705-4184-9368-db9ce581e0e7}"	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{8bdfe669-9705-4184-9368-db9ce581e0e7}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27DD5200959A5B540A3AE7EF1BA50805	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC1A3346AC77BE441A954308AE79F7EA\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\Dependents	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2E91D5D9817EF24183029DCF14A752C\VC_Runtime_Minimum	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27DD5200959A5B540A3AE7EF1BA50805\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\PackageCode = "1BE5B2DDE80EDC54D874D240756DB43A"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{33FE6E7B-2B3E-4B59-9F47-1B6C1E9953A6}\Dependents\{33FE6E7B-2B3E-4B59-9F47-1B6C1E9953A6}	MoonlightSetup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532"	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E49F90C5908FA6C4B9B795C7990F14EF\FC1A3346AC77BE441A954308AE79F7EA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC1A3346AC77BE441A954308AE79F7EA\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E49F90C5908FA6C4B9B795C7990F14EF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{33FE6E7B-2B3E-4B59-9F47-1B6C1E9953A6}\Version = "5.0.1.0"	MoonlightSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{D5D19E2F-7189-42FE-8103-92CD1FA457C2}v14.36.32532\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC1A3346AC77BE441A954308AE79F7EA\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2E91D5D9817EF24183029DCF14A752C\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\PackageCode = "73C8C8E4844B0BB4A8B86F043B32F917"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\Version = "237272852"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC1A3346AC77BE441A954308AE79F7EA\ProductName = "Moonlight Game Streaming Client"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC1A3346AC77BE441A954308AE79F7EA\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2E91D5D9817EF24183029DCF14A752C\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{6433A1CF-77CA-44EB-A159-3480EA977FAE}_v5.0.1.0	MoonlightSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{33FE6E7B-2B3E-4B59-9F47-1B6C1E9953A6}\Dependents	MoonlightSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC1A3346AC77BE441A954308AE79F7EA\Version = "83886081"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27DD5200959A5B540A3AE7EF1BA50805\VC_Runtime_Additional	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\27DD5200959A5B540A3AE7EF1BA50805	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Moonlight.exe

pid process

752 Moonlight.exe

pid	process
752	Moonlight.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msiexec.exe

pid	process
1068	msiexec.exe
1068	msiexec.exe
1068	msiexec.exe
1068	msiexec.exe
1068	msiexec.exe
1068	msiexec.exe
1068	msiexec.exe
1068	msiexec.exe
1068	msiexec.exe
1068	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exesrtasks.exeVC_redist.x64.exemsiexec.exe

description	pid	process
Token: SeBackupPrivilege	1600	vssvc.exe
Token: SeRestorePrivilege	1600	vssvc.exe
Token: SeAuditPrivilege	1600	vssvc.exe
Token: SeBackupPrivilege	2300	srtasks.exe
Token: SeRestorePrivilege	2300	srtasks.exe
Token: SeSecurityPrivilege	2300	srtasks.exe
Token: SeTakeOwnershipPrivilege	2300	srtasks.exe
Token: SeBackupPrivilege	2300	srtasks.exe
Token: SeRestorePrivilege	2300	srtasks.exe
Token: SeSecurityPrivilege	2300	srtasks.exe
Token: SeTakeOwnershipPrivilege	2300	srtasks.exe
Token: SeShutdownPrivilege	4500	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	4500	VC_redist.x64.exe
Token: SeSecurityPrivilege	1068	msiexec.exe
Token: SeCreateTokenPrivilege	4500	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	4500	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	4500	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	4500	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	4500	VC_redist.x64.exe
Token: SeTcbPrivilege	4500	VC_redist.x64.exe
Token: SeSecurityPrivilege	4500	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	4500	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	4500	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	4500	VC_redist.x64.exe
Token: SeSystemtimePrivilege	4500	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	4500	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	4500	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	4500	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	4500	VC_redist.x64.exe
Token: SeBackupPrivilege	4500	VC_redist.x64.exe
Token: SeRestorePrivilege	4500	VC_redist.x64.exe
Token: SeShutdownPrivilege	4500	VC_redist.x64.exe
Token: SeDebugPrivilege	4500	VC_redist.x64.exe
Token: SeAuditPrivilege	4500	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	4500	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	4500	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	4500	VC_redist.x64.exe
Token: SeUndockPrivilege	4500	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	4500	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	4500	VC_redist.x64.exe
Token: SeManageVolumePrivilege	4500	VC_redist.x64.exe
Token: SeImpersonatePrivilege	4500	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	4500	VC_redist.x64.exe
Token: SeRestorePrivilege	1068	msiexec.exe
Token: SeTakeOwnershipPrivilege	1068	msiexec.exe
Token: SeRestorePrivilege	1068	msiexec.exe
Token: SeTakeOwnershipPrivilege	1068	msiexec.exe
Token: SeRestorePrivilege	1068	msiexec.exe
Token: SeTakeOwnershipPrivilege	1068	msiexec.exe
Token: SeRestorePrivilege	1068	msiexec.exe
Token: SeTakeOwnershipPrivilege	1068	msiexec.exe
Token: SeRestorePrivilege	1068	msiexec.exe
Token: SeTakeOwnershipPrivilege	1068	msiexec.exe
Token: SeRestorePrivilege	1068	msiexec.exe
Token: SeTakeOwnershipPrivilege	1068	msiexec.exe
Token: SeRestorePrivilege	1068	msiexec.exe
Token: SeTakeOwnershipPrivilege	1068	msiexec.exe
Token: SeRestorePrivilege	1068	msiexec.exe
Token: SeTakeOwnershipPrivilege	1068	msiexec.exe
Token: SeRestorePrivilege	1068	msiexec.exe
Token: SeTakeOwnershipPrivilege	1068	msiexec.exe
Token: SeRestorePrivilege	1068	msiexec.exe
Token: SeTakeOwnershipPrivilege	1068	msiexec.exe
Token: SeRestorePrivilege	1068	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

MoonlightSetup-5.0.1.exe

pid process

3968 MoonlightSetup-5.0.1.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

Moonlight.exe

pid process

752 Moonlight.exe
752 Moonlight.exe
752 Moonlight.exe
752 Moonlight.exe
752 Moonlight.exe
752 Moonlight.exe
752 Moonlight.exe
752 Moonlight.exe

pid	process
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe
752	Moonlight.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

MoonlightSetup-5.0.1.exeMoonlightSetup-5.0.1.exeMoonlightSetup.exeVC_redist.x64.exeVC_redist.x64.exeVC_redist.x64.exeVC_redist.x64.exeVC_redist.x64.exemsiexec.exe

description	pid	process	target process
PID 3972 wrote to memory of 3968	3972	MoonlightSetup-5.0.1.exe	MoonlightSetup-5.0.1.exe
PID 3972 wrote to memory of 3968	3972	MoonlightSetup-5.0.1.exe	MoonlightSetup-5.0.1.exe
PID 3972 wrote to memory of 3968	3972	MoonlightSetup-5.0.1.exe	MoonlightSetup-5.0.1.exe
PID 3968 wrote to memory of 4608	3968	MoonlightSetup-5.0.1.exe	MoonlightSetup.exe
PID 3968 wrote to memory of 4608	3968	MoonlightSetup-5.0.1.exe	MoonlightSetup.exe
PID 3968 wrote to memory of 4608	3968	MoonlightSetup-5.0.1.exe	MoonlightSetup.exe
PID 4608 wrote to memory of 4028	4608	MoonlightSetup.exe	VC_redist.x64.exe
PID 4608 wrote to memory of 4028	4608	MoonlightSetup.exe	VC_redist.x64.exe
PID 4608 wrote to memory of 4028	4608	MoonlightSetup.exe	VC_redist.x64.exe
PID 4028 wrote to memory of 3584	4028	VC_redist.x64.exe	VC_redist.x64.exe
PID 4028 wrote to memory of 3584	4028	VC_redist.x64.exe	VC_redist.x64.exe
PID 4028 wrote to memory of 3584	4028	VC_redist.x64.exe	VC_redist.x64.exe
PID 3584 wrote to memory of 4500	3584	VC_redist.x64.exe	VC_redist.x64.exe
PID 3584 wrote to memory of 4500	3584	VC_redist.x64.exe	VC_redist.x64.exe
PID 3584 wrote to memory of 4500	3584	VC_redist.x64.exe	VC_redist.x64.exe
PID 4500 wrote to memory of 3600	4500	VC_redist.x64.exe	VC_redist.x64.exe
PID 4500 wrote to memory of 3600	4500	VC_redist.x64.exe	VC_redist.x64.exe
PID 4500 wrote to memory of 3600	4500	VC_redist.x64.exe	VC_redist.x64.exe
PID 3600 wrote to memory of 4088	3600	VC_redist.x64.exe	VC_redist.x64.exe
PID 3600 wrote to memory of 4088	3600	VC_redist.x64.exe	VC_redist.x64.exe
PID 3600 wrote to memory of 4088	3600	VC_redist.x64.exe	VC_redist.x64.exe
PID 4088 wrote to memory of 2312	4088	VC_redist.x64.exe	VC_redist.x64.exe
PID 4088 wrote to memory of 2312	4088	VC_redist.x64.exe	VC_redist.x64.exe
PID 4088 wrote to memory of 2312	4088	VC_redist.x64.exe	VC_redist.x64.exe
PID 1068 wrote to memory of 5032	1068	msiexec.exe	MsiExec.exe
PID 1068 wrote to memory of 5032	1068	msiexec.exe	MsiExec.exe
PID 1068 wrote to memory of 4964	1068	msiexec.exe	MsiExec.exe
PID 1068 wrote to memory of 4964	1068	msiexec.exe	MsiExec.exe
PID 3968 wrote to memory of 752	3968	MoonlightSetup-5.0.1.exe	Moonlight.exe
PID 3968 wrote to memory of 752	3968	MoonlightSetup-5.0.1.exe	Moonlight.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\MoonlightSetup-5.0.1.exe
"C:\Users\Admin\AppData\Local\Temp\MoonlightSetup-5.0.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\TEMP\{A94534F0-3DDD-4F32-8246-39E5A6DF58E8}\.cr\MoonlightSetup-5.0.1.exe
  "C:\Windows\TEMP\{A94534F0-3DDD-4F32-8246-39E5A6DF58E8}\.cr\MoonlightSetup-5.0.1.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\MoonlightSetup-5.0.1.exe" -burn.filehandle.attached=672 -burn.filehandle.self=656
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\TEMP\{11FB6A16-737A-4BF4-AC72-66093B449CB0}\.be\MoonlightSetup.exe
    "C:\Windows\TEMP\{11FB6A16-737A-4BF4-AC72-66093B449CB0}\.be\MoonlightSetup.exe" -q -burn.elevated BurnPipe.{B4073815-0054-404B-A87F-C9BA5034504C} {7CFF8CEC-4C85-4EF4-9C79-39BD8F26430D} 3968
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\ProgramData\Package Cache\70A888D5891EFD2A48D33C22F35E9178BD113032162DC5A170E7C56F2D592E3C\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\70A888D5891EFD2A48D33C22F35E9178BD113032162DC5A170E7C56F2D592E3C\VC_redist.x64.exe" /install /quiet /norestart
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4028
    - - C:\Windows\Temp\{98A0F79C-8604-4557-B421-7A33071CFB76}\.cr\VC_redist.x64.exe
        
        "C:\Windows\Temp\{98A0F79C-8604-4557-B421-7A33071CFB76}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\70A888D5891EFD2A48D33C22F35E9178BD113032162DC5A170E7C56F2D592E3C\VC_redist.x64.exe" -burn.filehandle.attached=648 -burn.filehandle.self=656 /install /quiet /norestart
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3584
      - C:\Windows\Temp\{0F6727BF-37FB-447C-8C21-CD1E09242FD4}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{0F6727BF-37FB-447C-8C21-CD1E09242FD4}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{6896946D-9579-4825-9200-9D21B5162D12} {0D5AD373-AD19-41CC-9D47-438BF36375B6} 3584
        6⤵
        Adds Run key to start application
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1084 -burn.embedded BurnPipe.{F8DB1ED2-C8BD-46CB-85B7-93DDF3092854} {1C837AED-188B-4B4A-BD95-19F00D870DE4} 4500
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3600
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1084 -burn.embedded BurnPipe.{F8DB1ED2-C8BD-46CB-85B7-93DDF3092854} {1C837AED-188B-4B4A-BD95-19F00D870DE4} 4500
        8⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{10D0B3F3-E1DD-4640-92AF-974A03FA0C92} {8F1CD3A9-B0AB-46EC-9696-4E9806FDC08B} 4088
        9⤵
        Modifies registry class
        
        PID:2312
- - C:\Program Files\Moonlight Game Streaming\Moonlight.exe
    "C:\Program Files\Moonlight Game Streaming\Moonlight.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks SCSI registry key(s)
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2300

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 37EFCDD89677C33D3060D43ECCFD219D
  2⤵
  - Loads dropped DLL
  PID:5032
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 4DBCFDAA06971570A4B031C46B58DAC3 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:4964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57dac5.rbs

Filesize
19KB

MD5
4f8629b47c307548255f4771c4ce6768

SHA1
53b2cd4115289d1d2ce47ef32c64f0f680437fc1

SHA256
46a4e7bba29ac53785195a4ebf4cbae3f6e5f7e5771e55bf484b6531fb580331

SHA512
e0640a58564f237933fec67ef2ba76e065714936d02b8e607ddbef0603ae8073825383f35ba32aeec636dc88934403c6e2a56c65781712012ce0b32315d6f7ce

Download Submit
C:\Config.Msi\e57dad1.rbs

Filesize
19KB

MD5
6e156cd9f7dfc9582f1ac2af4adf9b1d

SHA1
dd995a7d3e8d4dc17dddacacf790ea86f75f61ad

SHA256
cc96b957d6d6bb8567b1f0653cc384e043eb3fcc1187bfb3dcf7e3c2ca6cf7ba

SHA512
23720c02571e4cd04c3aacd2cf2fb505fca7547ef3789789cc7e2ac6c4ea0a254bd65cc559bcebda23aefb4a184abee67edf7d6b84cae4b95ce25d4433caf879

Download Submit
C:\Config.Msi\e57dad8.rbs

Filesize
21KB

MD5
6dce57a7e51ab3a31095e3d68492ea1a

SHA1
5d0bd22ff53ad41918a8d15f70c4fe4a4b809b89

SHA256
fdc77d6af007105f3754f393069820d34adf7407353f83b77cdc48816d6f56a4

SHA512
e86d7b65142be2fb576945922a53ff7673cf610c08b8b9b9ca863bdc1e922ab79c706c695f95e44dd83abbdbdb0e80c5d5fad3c19da839c57906a9d6858810fc

Download Submit
C:\Config.Msi\e57dae7.rbs

Filesize
21KB

MD5
1e937422cea6c525aea25fc4c09e37a6

SHA1
bf40dd80b4a78ff0633ea3c503c14ab00af81dc0

SHA256
8d3b4bcfd8e69bd94758f97f0edda187204f86f8e564d344e54b45439a772893

SHA512
0c826a4f458e02b3d833d2c093b6adec1e43690ad36e595daed0be6fc1e747eca664154fe9260ac8fb0fa9ffd54ba622a752dbd74adf65ef33d912b4e35545d5

Download Submit
C:\Config.Msi\e57daec.rbs

Filesize
243KB

MD5
f83e774380f72242f168f87efd31a3f4

SHA1
23569ac48191cecfd7c7ca2245583f4e4b3ead23

SHA256
216634dd3b8abdcbab20b8de2fa130e97c4bdaf5b6da6a353b81bc91e13961f4

SHA512
42441cf60b5b1800d2e945cd9ac6b8120d329380c0a78a6c1027880a097848e22467f3b4176ed383517d5d97d0ff7469143e6e18ba60d5a39985fadcdd1f0316

Download Submit
C:\Program Files\Moonlight Game Streaming\AntiHooking.dll

Filesize
56KB

MD5
a9b12a766ffbf476d3f16af1430776c7

SHA1
50d415c58cffa9772dae872907ae88057ffc70c6

SHA256
3c616edd09c2e977c5b5e9adf440f4ad3ce6dcb120921b918122fbb84a82cf64

SHA512
471e6d08e9d28db239d4b013e6a30b3626f226b288ffdd1e5300ec8635d75ec43db5becc37fd9eba0f243723ada9dc0d969d7a70f467065c200884ece9c60d4f

Download Submit
C:\Program Files\Moonlight Game Streaming\Moonlight.exe

Filesize
2.1MB

MD5
2253f8e07f098d207b39b14c6c7937a5

SHA1
0a7866832cab6876a1603694bae11eb23259e440

SHA256
359ad692ba8a740bec47e2f3f1c66fff6cec599d7ba8d7c389b5081c8d82b5c0

SHA512
359fc5a4e36533157a6fcde4e971ef47ca21823b0b7c628b2beec17da368dce6aba42aad3daa347750abf06d2e502378c36ac61a8ee3690c7556fb905d039e60

Download Submit
C:\Program Files\Moonlight Game Streaming\Qt5Core.dll

Filesize
5.7MB

MD5
dc7620e92132f96b26ace3ab9efb8ad2

SHA1
882dd6c3001bec19919cf2684a37dd9cffdb2333

SHA256
835747c5e64005cad998013796dfb921b865b47d406265468ca7c6942802ce12

SHA512
2c79cc7d7f0efa6ce4515d60539131f4433a2e2ee94a2f0a7612f9f23b5dcd7a081c4246126e700fae9ab5df00bca0dfbcd94a4901b908bb68dcc37a53944f2d

Download Submit
C:\Program Files\Moonlight Game Streaming\Qt5Gui.dll

Filesize
6.7MB

MD5
ade3f62a507aa05508f69290129aedba

SHA1
b3dea8740822d4db2f657376ae7503235948a30e

SHA256
13c4a2e76881f8388599eaa771910d944579a74c4b946caf78aa292e903b0aab

SHA512
cc73b3c6d3f72be9d12f8e39dc4164a22a6fb0931d94f1301a18a3ae2ecb00bcc88c40c1f237ba0aacb7822c9af1ec33aeb9b6adb4ce02bed0a019958d9ab2fe

Download Submit
C:\Program Files\Moonlight Game Streaming\Qt5Network.dll

Filesize
1.3MB

MD5
215575fec63a9dfb0813a23bbdb80af2

SHA1
d50c138dc00856d58f09a4b35950ef7da14cbc9a

SHA256
1c87018a5ecfb21f9b6bfcef7cd425747cad1eaf87d66ce2a87e83a3acbb2128

SHA512
6b3e6814bcdbc9ecf9e5f4da97c2e7f0760bdf777ac2b5d597ad3bb02b2a4db44c01143b1453b90f7343d6bbfa2d637991eb7ffb2d2673065c475248287b0fcd

Download Submit
C:\Program Files\Moonlight Game Streaming\Qt5Qml.dll

Filesize
3.4MB

MD5
cfe9a6c3ff090aa7f00166f09a522104

SHA1
ebeaa0c57b166e071f3ba107fb2a6c426b67344d

SHA256
242a8454f5041d1a38237778381221bc369d93e5305c0b5300127fee7c742fb0

SHA512
5957477ff9bedbb5e4415576e8232e39830c117c80822b2f4814d026805e88ccd33798a616bca2066382f0fccdd704a27d39b4e990384add1bbe33f7cec4a3cc

Download Submit
C:\Program Files\Moonlight Game Streaming\Qt5QuickControls2.dll

Filesize
173KB

MD5
d63d3570fbb55e96564385756f15b3bc

SHA1
2a93b9ee2c1ab23a2a62c787fee2726f93268173

SHA256
351f0c7f8c1707cd82e90d4b12257ef3d44b10718ab5039fe8eae0e71238e374

SHA512
36b7a583e9b71d4ad23cb76eca3e85f843b8b4a7ba152958884b191e187e323fe1f0eb767603c0fea1e12cbf2ee2e312488ae34489e9eea3663ebc135ed0734d

Download Submit
C:\Program Files\Moonlight Game Streaming\Qt5Svg.dll

Filesize
327KB

MD5
561ab391ded9b63d13192369397ef0ab

SHA1
2a9419f6675658c1ed9ec023b2615df464cc9681

SHA256
4a3f06641063b0850f2305e99170e3308f1142fe3cc27c36bc7efe98749ba2e8

SHA512
d2cc6bb2c2a5d4ef3abb3572c466961dfa8d6705d29225a8d90772eb87868cceaaf16d657a97abc336d63d9df5a4345e9bf3d5bd572d05b8fa526cd9e9913be1

Download Submit
C:\Program Files\Moonlight Game Streaming\SDL2.dll

Filesize
1.6MB

MD5
354b9409641cee26ecc5436b45859cbf

SHA1
56f91b5c137feef0877d50f4805098401eb21d03

SHA256
76eef0fd18f50a5cc71edacf7fd37e403ca349f09527c2bf8bf74942071a8ebf

SHA512
d76de8c74f3fa7ce57b393992f888a879e1b8310d989603a73354fe1b616b42644d66483eae1df5af05fc39e3c42b939e82d2a02ca2bff141060cb762b277cd1

Download Submit
C:\Program Files\Moonlight Game Streaming\SDL2_ttf.dll

Filesize
681KB

MD5
56a615276e80849761e6dcb821d9f84e

SHA1
d0986388b0c00f80740716357745bc928ede7ce2

SHA256
fc0c25b05fc71a81eba0a2d6c66219a616b5d14e61810b7ef69c4778febe01d0

SHA512
39216fdc6fba98dfa9d7d15fb05b9e0db1cec174c6a132aeec9b9e3e2a2e7410c5630f5056040ccbfaf9cebb244f234dc70c9a1f528eea92589afbb1932c2cdf

Download Submit
C:\Program Files\Moonlight Game Streaming\avcodec-60.dll

Filesize
4.5MB

MD5
feab99abab8b0037291f3519658c0206

SHA1
375026b4ccf4d6fad05a8762b3befb552eeee29d

SHA256
f72371898b82e200a53dba523d40867a4e19b6e0a2a098d595e3b786d8678890

SHA512
1ead4519a7eae77dcdb33ab2ca8e40c3a051caba86d1e3f16d6fb6ff4481172609f2df370940b61c5489c25e40a50f0bf5981e580bd72933ead6a9004de94bae

Download Submit
C:\Program Files\Moonlight Game Streaming\avutil-58.dll

Filesize
1.9MB

MD5
3eaa67b2e57496d607d5ac5fd15204d1

SHA1
acb7e8b994fcc7e560e3f06a30348cab837ebf17

SHA256
ee38d1cc6670fe4f6887d35c5a277e557117334a973603cb60a57c329c3ddd7d

SHA512
0903b95a5a754dbdc88a3210d72c4064065ea7dd68ec403786d2f109e978e8e53e0c3052613e56cd061a7ce2289aa93aa75d9b99709cb91c7c59425f5a61f75c

Download Submit
C:\Program Files\Moonlight Game Streaming\discord-rpc.dll

Filesize
71KB

MD5
0cb91de7a031c15fec7dffd19b1f8081

SHA1
d9c289eb41b11d50656e9793050f6d4f988b71c0

SHA256
cac054529d48ba0b36feba1fcc16c50231d7ce4d9b8773f97ae5df853f0ceee0

SHA512
e2f5db4bcc0a3d25ee6c9b6d0f135873aa4288899db3856c5f2cf76f37b0fcac2f450c734a17ccb055cd79121405771d6fa771ab6eb6cada213108824b6d9f1c

Download Submit
C:\Program Files\Moonlight Game Streaming\libcrypto-1_1-x64.dll

Filesize
3.3MB

MD5
32c95fa37d995eb750b4b49cf06adaa7

SHA1
5ac7382e45d0480699d23cbf1fa25662fe43761f

SHA256
6c5cebcd51b31d393291a31a3006cc2c7ecd315e38eb06254bf58bc87d30b098

SHA512
4c3a084772ae5a22da45806b61b7bf884943b3e090ecc564069d6b679a7eacf49c8796cf55030bbf751939b85ee18a93c17b9062398f0e7700507d3e4841353f

Download Submit
C:\Program Files\Moonlight Game Streaming\opus.dll

Filesize
416KB

MD5
de15a14ebc5c1018a41e4fa215cd6387

SHA1
70aa18e6e43c65bdeb60124a20479802079e7029

SHA256
9ec09716074e88a53fc232d51ad86f4fe0b0f6b5a8de4d9f4de2762861605fd0

SHA512
506dc0a9a754e486352eeaeceae62cdf108f9620fb27192b1b4b81351a9c3bda19f2b0755103d2a0dce1b7bc8408415dd957486793bf54299f162280beeed1b7

Download Submit
C:\ProgramData\Package Cache\{33FE6E7B-2B3E-4B59-9F47-1B6C1E9953A6}\state.rsm

Filesize
1KB

MD5
11cc0dddef58caffa81c707eaeec1e8f

SHA1
a238cb51c44e69a11cb40086cb2ea4f34e367484

SHA256
df6d6d3cd8a1ec0cc4167ecb6aed94b48928548b94ba88c0160a5fe8c6e19a54

SHA512
3d8ccaed02648e6c53cfe3fa7fe60e077818508979378853c4a620743949e0c2c06d4d65d21a9a6a915ec8c80a42211fb8b633c3d0636422759df32a7e62c59a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Moonlight_Game_Streaming_Client_20240521145716_001_Moonlight_x64.log

Filesize
1KB

MD5
39878f92ed2ef9f5589d05f4e338a552

SHA1
40d7133bb4939e005cb11186316095ec785a2c7e

SHA256
aa4dd15245890cefb3fca6dac07259a99fd77fb2bef36bfc4af06ffec64ef6c5

SHA512
2128b5a48fc249df760d7565b05fd44f3298fd79bac0050e68cf8a6ea558268d6912c8b724744db5cb722b1d79cd5f0db2869fb9c7a1b3ceb2eecec01bd10a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240521145754_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
7038aea6ec6664b21cd863a296febee2

SHA1
b5fa5ad35d21d6f0e4606fc9115210426dac8dca

SHA256
589663b83d8b8a44a6e46c6551d8ec012fc452c5ec3f474c3c76a7426857e565

SHA512
c8865939d3e2c3d191743391c7717f49b5398828027bc1ae1a069f41a53f59640b07811a05d43fd03617730d5b3c1e4feeb0d9bff26a0586d67f9ccfd08b04db

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240521145754_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
6f6d53c1f643258efa4d9050bd21a5a8

SHA1
209e424e625a7631e73c136a0bd9691268dc1282

SHA256
79bf1318159735e07b91f5542d7ac65c617923c728b1d1e3a20b2ca830d83f56

SHA512
f591a038e5313733292e80d39e9ec7b128b6f70e1770478446662c9fb64d2bc99cb481185b42446645bc07fedb7cfe471606fafbf1ccf51ce97d1e693880fd11

Download Submit
C:\Users\Admin\AppData\Local\Temp\{11FB6A16-737A-4BF4-AC72-66093B449CB0}\Moonlight_x64

Filesize
20.8MB

MD5
e716276b4ebc4a1bdcf9e62abd1149a0

SHA1
eca3dc9813d20f5d20a1b9c080bc7500cf1e8d8b

SHA256
100d98f189cb96111896874a6a19aea0b5e4d4ffe841489f07dff32879740e22

SHA512
e11f09014728bfd04340eb76ba7e599a2f6cede2b98db7fd70fa35ad179437edfb561d236a9239696e80e8d6eef7d87a5ac5b2519902e8313b1c54e3c2f5a9bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\{11FB6A16-737A-4BF4-AC72-66093B449CB0}\VC_redist.x64.exe

Filesize
24.2MB

MD5
077f0abdc2a3881d5c6c774af821f787

SHA1
c483f66c48ba83e99c764d957729789317b09c6b

SHA256
917c37d816488545b70affd77d6e486e4dd27e2ece63f6bbaaf486b178b2b888

SHA512
70a888d5891efd2a48d33c22f35e9178bd113032162dc5a170e7c56f2d592e3c59a08904b9f1b54450c80f8863bda746e431b396e4c1624b91ff15dd701bd939

Download Submit
C:\Windows\Installer\MSIED81.tmp

Filesize
389KB

MD5
3f7fcb7a8fbf5a585112fe0171c3186e

SHA1
988190388156c00b7347fc5f6f4a8285f3f576ff

SHA256
f67b9a0950b1214bec22ad914498ffcd3d859fff6f0a8add97ddb264d258892f

SHA512
eb426d42d143ebfdb7164cfd1eaa8195f40739364279ed216fc37b91ddaaf05cc31abec652c8d522ca9d48bee8c13d069a99d507ecf14d9d76f27bd297abd71b

Download Submit
C:\Windows\Installer\MSIEF86.tmp

Filesize
185KB

MD5
22920d61b80d4def142f90767e82e1bd

SHA1
8ae66d4e08161036c76660a2801a427950b8af0c

SHA256
570246423157b218057184712bb59f1fe4e0d61a144ccd53931d7986e4d5ab96

SHA512
4079b2fa6139a2d5e7f92c084aa3efded1ec7f41523c6ac52c59b0ca8252eff1d865029be0c032e3e7bae528c548b608ef35ed789c7f4a8bc09d0be0804cbd7a

Download Submit
C:\Windows\SYSTEM32\VCRUNTIME140_1.dll

Filesize
48KB

MD5
cf0a1c4776ffe23ada5e570fc36e39fe

SHA1
2050fadecc11550ad9bde0b542bcf87e19d37f1a

SHA256
6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47

SHA512
d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168

Download Submit
C:\Windows\System32\msvcp140.dll

Filesize
564KB

MD5
1ba6d1cf0508775096f9e121a24e5863

SHA1
df552810d779476610da3c8b956cc921ed6c91ae

SHA256
74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823

SHA512
9887d9f5838aa1555ea87968e014edfe2f7747f138f1b551d1f609bc1d5d8214a5fdab0d76fcac98864c1da5eb81405ca373b2a30cb12203c011d89ea6d069af

Download Submit
C:\Windows\Temp\{0F6727BF-37FB-447C-8C21-CD1E09242FD4}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{0F6727BF-37FB-447C-8C21-CD1E09242FD4}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{0F6727BF-37FB-447C-8C21-CD1E09242FD4}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.4MB

MD5
46efc5476e6d948067b9ba2e822fd300

SHA1
d17c2bf232f308e53544b2a773e646d4b35e3171

SHA256
2de285c0fc328d30501cad8aa66a0ca9556ad5e30d03b198ebdbc422347db138

SHA512
58c9b43b0f93da00166f53fda324fcf78fb1696411e3c453b66e72143e774f68d377a0368b586fb3f3133db7775eb9ab7e109f89bb3c5e21ddd0b13eaa7bd64c

Download Submit
C:\Windows\Temp\{0F6727BF-37FB-447C-8C21-CD1E09242FD4}\cab5046A8AB272BF37297BB7928664C9503

Filesize
935KB

MD5
c2df6cb9082ac285f6acfe56e3a4430a

SHA1
591e03bf436d448296798a4d80f6a39a00502595

SHA256
b8b4732a600b741e824ab749321e029a07390aa730ec59401964b38105d5fa11

SHA512
9f21b621fc871dd72de0c518174d1cbe41c8c93527269c3765b65edee870a8945ecc2700d49f5da8f6fab0aa3e4c2db422b505ffcbcb2c5a1ddf4b9cec0e8e13

Download Submit
C:\Windows\Temp\{0F6727BF-37FB-447C-8C21-CD1E09242FD4}\vcRuntimeAdditional_x64

Filesize
188KB

MD5
dd070483eda0af71a2e52b65867d7f5d

SHA1
2b182fc81d19ae8808e5b37d8e19c4dafeec8106

SHA256
1c450cacdbf38527c27eb2107a674cd9da30aaf93a36be3c5729293f6f586e07

SHA512
69e16ee172d923173e874b12037629201017698997e8ae7a6696aab1ad3222ae2359f90dea73a7487ca9ff6b7c01dc6c4c98b0153b6f1ada8b59d2cec029ec1a

Download Submit
C:\Windows\Temp\{0F6727BF-37FB-447C-8C21-CD1E09242FD4}\vcRuntimeMinimum_x64

Filesize
188KB

MD5
a4075b745d8e506c48581c4a99ec78aa

SHA1
389e8b1dbeebdff749834b63ae06644c30feac84

SHA256
ee130110a29393dcbc7be1f26106d68b629afd2544b91e6caf3a50069a979b93

SHA512
0b980f397972bfc55e30c06e6e98e07b474e963832b76cdb48717e6772d0348f99c79d91ea0b4944fe0181ad5d6701d9527e2ee62c14123f1f232c1da977cada

Download Submit
C:\Windows\Temp\{11FB6A16-737A-4BF4-AC72-66093B449CB0}\.ba\logo.png

Filesize
2KB

MD5
a41c1230755d607fcc956ca6cb876d83

SHA1
6030e4965a3740917baa60c375434d60d5e12491

SHA256
fe91d3d5afb5436439f17a491f9e5cc9e35c22980eb54e289c2715a0204710e8

SHA512
66cde08474ab21a20693f2aa74b0f7e036841d59403246e6cec4f2dfda0a51eb962dad393a3937304174b103d4047344dc20494c32bfcd0562d57cd37df59dc9

Download Submit
C:\Windows\Temp\{11FB6A16-737A-4BF4-AC72-66093B449CB0}\.ba\wixstdba.dll

Filesize
309KB

MD5
1ba06db63b5cc19acb86f1718c790fdd

SHA1
2d453dabc84d38e0603cbea5cd2fc93d6720c3c0

SHA256
e25adddb655cf648dccadda998c8f517d253639a079f0309ddbae11b519c44f1

SHA512
e4c0bf618e2e3cad7de3a3cc5e53870824b1ade35bcf62de46ff0566be4db7582df457c8873dc6627875802184cedf42403edf034eb9db7dedc638d59cb940f2

Download Submit
C:\Windows\Temp\{98A0F79C-8604-4557-B421-7A33071CFB76}\.cr\VC_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{A94534F0-3DDD-4F32-8246-39E5A6DF58E8}\.cr\MoonlightSetup-5.0.1.exe

Filesize
1.1MB

MD5
ca103f75e79cf7123f51cae3d1907c77

SHA1
1d94745d78e29ced0b8d4b8c1a86bae8c2ac3bcb

SHA256
75e0002f2f3f58d805d6df7d66204f09b85851a873f3eb312468179e8aa49a5e

SHA512
b075e26ed1cfcba5f27e998682fdab8168c5ab399a65099ecb53e12b9e98db1d11d6ce85af4234ce5167a364aac7b3ba165645ee3214e82506c4fdd5f53880d1

Download Submit
memory/752-685-0x0000029BFFAF0000-0x0000029BFFF30000-memory.dmp

Filesize
4.2MB

Download
memory/752-778-0x0000029B85510000-0x0000029B85511000-memory.dmp

Filesize
4KB

Download
memory/752-666-0x00007FF92E860000-0x00007FF92EDA1000-memory.dmp

Filesize
5.3MB

Download
memory/752-744-0x0000029B84B70000-0x0000029B84B71000-memory.dmp

Filesize
4KB

Download
memory/752-745-0x0000029B84B70000-0x0000029B84B71000-memory.dmp

Filesize
4KB

Download
memory/752-667-0x00007FF92EED0000-0x00007FF92F2C8000-memory.dmp

Filesize
4.0MB

Download
memory/752-746-0x0000029B84B70000-0x0000029B84B71000-memory.dmp

Filesize
4KB

Download
memory/752-687-0x0000029B81410000-0x0000029B81610000-memory.dmp

Filesize
2.0MB

Download
memory/752-747-0x0000029B84B70000-0x0000029B84B71000-memory.dmp

Filesize
4KB

Download
memory/752-736-0x0000029B84B60000-0x0000029B84B61000-memory.dmp

Filesize
4KB

Download
memory/752-735-0x0000029B84B60000-0x0000029B84B61000-memory.dmp

Filesize
4KB

Download
memory/752-739-0x0000029B84B60000-0x0000029B84B61000-memory.dmp

Filesize
4KB

Download
memory/752-743-0x0000029B84B70000-0x0000029B84B71000-memory.dmp

Filesize
4KB

Download
memory/752-741-0x0000029B84B60000-0x0000029B84B61000-memory.dmp

Filesize
4KB

Download
memory/752-740-0x0000029B84B60000-0x0000029B84B61000-memory.dmp

Filesize
4KB

Download
memory/752-738-0x0000029B84B60000-0x0000029B84B61000-memory.dmp

Filesize
4KB

Download
memory/752-737-0x0000029B84B60000-0x0000029B84B61000-memory.dmp

Filesize
4KB

Download
memory/752-764-0x0000029B85500000-0x0000029B85501000-memory.dmp

Filesize
4KB

Download
memory/752-768-0x0000029B85500000-0x0000029B85501000-memory.dmp

Filesize
4KB

Download
memory/752-787-0x0000029B85530000-0x0000029B85531000-memory.dmp

Filesize
4KB

Download
memory/752-786-0x0000029B85530000-0x0000029B85531000-memory.dmp

Filesize
4KB

Download
memory/752-784-0x0000029B85520000-0x0000029B85521000-memory.dmp

Filesize
4KB

Download
memory/752-783-0x0000029B85520000-0x0000029B85521000-memory.dmp

Filesize
4KB

Download
memory/752-782-0x0000029B85510000-0x0000029B85511000-memory.dmp

Filesize
4KB

Download
memory/752-781-0x0000029B85520000-0x0000029B85521000-memory.dmp

Filesize
4KB

Download
memory/752-780-0x0000029B85510000-0x0000029B85511000-memory.dmp

Filesize
4KB

Download
memory/752-779-0x0000029B85510000-0x0000029B85511000-memory.dmp

Filesize
4KB

Download
memory/752-668-0x00007FF90FE80000-0x00007FF90FE90000-memory.dmp

Filesize
64KB

Download
memory/752-777-0x0000029B85500000-0x0000029B85501000-memory.dmp

Filesize
4KB

Download
memory/752-776-0x0000029B85520000-0x0000029B85521000-memory.dmp

Filesize
4KB

Download
memory/752-774-0x0000029B85510000-0x0000029B85511000-memory.dmp

Filesize
4KB

Download
memory/752-773-0x0000029B85500000-0x0000029B85501000-memory.dmp

Filesize
4KB

Download
memory/752-772-0x0000029B85510000-0x0000029B85511000-memory.dmp

Filesize
4KB

Download
memory/752-771-0x0000029B85510000-0x0000029B85511000-memory.dmp

Filesize
4KB

Download
memory/752-769-0x0000029B85500000-0x0000029B85501000-memory.dmp

Filesize
4KB

Download
memory/752-767-0x0000029B85500000-0x0000029B85501000-memory.dmp

Filesize
4KB

Download
memory/752-766-0x0000029B85500000-0x0000029B85501000-memory.dmp

Filesize
4KB

Download
memory/752-765-0x0000029B85500000-0x0000029B85501000-memory.dmp

Filesize
4KB

Download
memory/752-763-0x0000029B85500000-0x0000029B85501000-memory.dmp

Filesize
4KB

Download
memory/752-762-0x0000029B854F0000-0x0000029B854F1000-memory.dmp

Filesize
4KB

Download
memory/752-761-0x0000029B854F0000-0x0000029B854F1000-memory.dmp

Filesize
4KB

Download
memory/752-760-0x0000029B854F0000-0x0000029B854F1000-memory.dmp

Filesize
4KB

Download
memory/752-759-0x0000029B85500000-0x0000029B85501000-memory.dmp

Filesize
4KB

Download
memory/752-757-0x0000029B854F0000-0x0000029B854F1000-memory.dmp

Filesize
4KB

Download
memory/752-756-0x0000029B854F0000-0x0000029B854F1000-memory.dmp

Filesize
4KB

Download
memory/752-755-0x0000029B854F0000-0x0000029B854F1000-memory.dmp

Filesize
4KB

Download
memory/752-754-0x0000029B854F0000-0x0000029B854F1000-memory.dmp

Filesize
4KB

Download
memory/752-753-0x0000029B854F0000-0x0000029B854F1000-memory.dmp

Filesize
4KB

Download
memory/752-752-0x0000029B854F0000-0x0000029B854F1000-memory.dmp

Filesize
4KB

Download
memory/752-750-0x0000029B84B70000-0x0000029B84B71000-memory.dmp

Filesize
4KB

Download
memory/752-749-0x0000029B84B70000-0x0000029B84B71000-memory.dmp

Filesize
4KB

Download
memory/752-748-0x0000029B84B60000-0x0000029B84B61000-memory.dmp

Filesize
4KB

Download
memory/2312-243-0x0000000000830000-0x00000000008A7000-memory.dmp

Filesize
476KB

Download
memory/3600-281-0x0000000000830000-0x00000000008A7000-memory.dmp

Filesize
476KB

Download
memory/4088-280-0x0000000000830000-0x00000000008A7000-memory.dmp

Filesize
476KB

Download
memory/4608-680-0x0000000000DA0000-0x0000000000E9D000-memory.dmp

Filesize
1012KB

Download