801d7b8a1640e5ae8f8561c5cbd38e1bd19b42bb9f925646ec71d27255b9196b

Analysis

max time kernel
69s
max time network
60s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
21-05-2024 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MoonlightSetup-5.0.1.exe
Size

53.3MB
MD5

8066f6f66a7d8b62907dcc7d4c3c8c1f
SHA1

ba8f816439d8cfc2101c4629394c1ca9caf9eec5
SHA256

801d7b8a1640e5ae8f8561c5cbd38e1bd19b42bb9f925646ec71d27255b9196b
SHA512

c47b9dc4c3c4f1bab2424d9910709b9b8107d14014d4539f011d188973156245ecb1ced8b59c432f161e9a14aaa0adcab4288451174107e3fe777bbb0d3ef817
SSDEEP

1572864:Clwsgf4Y37O2JgdkIGVrhlCphLp2P+9Iid+dI:ClF6jO2JguIornCphLp2QR

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

MoonlightSetup.exeVC_redist.x64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{33FE6E7B-2B3E-4B59-9F47-1B6C1E9953A6} = "\"C:\\ProgramData\\Package Cache\\{33FE6E7B-2B3E-4B59-9F47-1B6C1E9953A6}\\MoonlightSetup.exe\" /burn.clean.room /burn.runonce"	MoonlightSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{8bdfe669-9705-4184-9368-db9ce581e0e7} = "\"C:\\ProgramData\\Package Cache\\{8bdfe669-9705-4184-9368-db9ce581e0e7}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exe

flow pid process

6 4144 msiexec.exe
7 4144 msiexec.exe
8 4144 msiexec.exe

flow	pid	process
6	4144	msiexec.exe
7	4144	msiexec.exe
8	4144	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Drops file in System32 directory 50 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\ComboBox.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\ScrollBar.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\CheckBox.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\ToolButton.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\avcodec-60.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\imageformats\qgif.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQml\plugins.qmltypes	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\qmldir	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\DelayButton.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\translations\qt_ar.qm	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\opus.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\InnerShadow.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\Button.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\RectangularGlow.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\TextArea.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\d3dcompiler_47.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\private\qtgraphicaleffectsprivate.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\MenuBar.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\ApplicationWindow.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\CheckIndicator.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\translations\qt_cs.qm	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\translations\qt_en.qm	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\plugins.qmltypes	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQml\RemoteObjects\qtqmlremoteobjects.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\TabButton.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\Menu.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\RoundButton.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\Qt5QmlWorkerScript.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\DropShadow.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\MaskedBlur.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\private\GaussianMaskedBlur.qmlc	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Menu.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\TabButton.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\Qt5Svg.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQml\qmldir	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick.2\plugins.qmltypes	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\DialogButtonBox.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\Moonlight.exe	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Drawer.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\MenuItem.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\plugins.qmltypes	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\Qt5Core.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\private\FastGlow.qmlc	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\ItemDelegate.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\translations\qt_zh_TW.qm	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\Qt5QuickControls2.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\private\GaussianGlow.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\AbstractButton.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\GroupBox.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\ScrollBar.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\GaussianBlur.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\OpacityMask.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\RadialGradient.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\private\FastInnerShadow.qmlc	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Layouts\qquicklayoutsplugin.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\translations\qt_lv.qm	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\bearer\qgenericbearer.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\private\GaussianGlow.qmlc	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\private\GaussianInnerShadow.qmlc	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\HorizontalHeaderView.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQuick\Controls.2\Material\Switch.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\libcrypto-1_1-x64.dll	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtGraphicalEffects\private\FastMaskedBlur.qml	msiexec.exe
File created	C:\Program Files\Moonlight Game Streaming\QtQml\WorkerScript.2\workerscriptplugin.dll	msiexec.exe

Drops file in Windows directory 36 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSID593.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF39.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0025DD72-A959-45B5-A0A3-7EFEB15A8050}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC9C6BDAA47CF705A.TMP	msiexec.exe
File created	C:\Windows\Installer\e57d0bb.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF84D1564BBA31DD6B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF34BE837D17BE7A9F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF56A733E2DC29383F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D5D19E2F-7189-42FE-8103-92CD1FA457C2}	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d0a1.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFAAA459E35924025.TMP	msiexec.exe
File created	C:\Windows\Installer\e57d0b6.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3F18F5821F67F490.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6433A1CF-77CA-44EB-A159-3480EA977FAE}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e57d0a1.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE2CAB6A5D190AB0C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d0b7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID1E6.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDD83.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d08e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF75A0D261538778AC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDFF6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE110.tmp	msiexec.exe
File created	C:\Windows\Installer\e57d08e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF245B4CFDED450537.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB53056BA4A3B58AE.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID498.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA87.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAAD3912D6BD75322.TMP	msiexec.exe
File created	C:\Windows\Installer\e57d0a0.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF17E5761322E3785E.TMP	msiexec.exe
File created	C:\Windows\Installer\e57d0b7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID2A3.tmp	msiexec.exe

Executes dropped EXE 6 IoCs

Processes:

MoonlightSetup-5.0.1.exeMoonlightSetup.exeVC_redist.x64.exeVC_redist.x64.exeVC_redist.x64.exeMoonlight.exe

pid process

3408 MoonlightSetup-5.0.1.exe
3352 MoonlightSetup.exe
812 VC_redist.x64.exe
3820 VC_redist.x64.exe
2476 VC_redist.x64.exe
1588 Moonlight.exe

Loads dropped DLL 53 IoCs

Processes:

MoonlightSetup-5.0.1.exeVC_redist.x64.exeVC_redist.x64.exeMsiExec.exeMsiExec.exeMoonlight.exe

pid	process
3408	MoonlightSetup-5.0.1.exe
3820	VC_redist.x64.exe
5064	VC_redist.x64.exe
1760	MsiExec.exe
1760	MsiExec.exe
1760	MsiExec.exe
4692	MsiExec.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exeMoonlight.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001b4a55745f2b98f90000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001b4a55740000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001b4a5574000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1b4a5574000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001b4a557400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Moonlight.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Moonlight.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Moonlight.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Moonlight.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 14 IoCs

Processes:

msiexec.exeMsiExec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeVC_redist.x64.exeMoonlightSetup.exeVC_redist.x64.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC1A3346AC77BE441A954308AE79F7EA\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC1A3346AC77BE441A954308AE79F7EA\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532"	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{33FE6E7B-2B3E-4B59-9F47-1B6C1E9953A6}\ = "{33FE6E7B-2B3E-4B59-9F47-1B6C1E9953A6}"	MoonlightSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E49F90C5908FA6C4B9B795C7990F14EF\FC1A3346AC77BE441A954308AE79F7EA	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27DD5200959A5B540A3AE7EF1BA50805\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC1A3346AC77BE441A954308AE79F7EA\ProductName = "Moonlight Game Streaming Client"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\Language = "1033"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2E91D5D9817EF24183029DCF14A752C\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{6433A1CF-77CA-44EB-A159-3480EA977FAE}_v5.0.1.0\DisplayName = "Moonlight Game Streaming Client"	MoonlightSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC1A3346AC77BE441A954308AE79F7EA	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{6433A1CF-77CA-44EB-A159-3480EA977FAE}_v5.0.1.0\Dependents	MoonlightSetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC1A3346AC77BE441A954308AE79F7EA\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\ = "{8bdfe669-9705-4184-9368-db9ce581e0e7}"	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\Version = "237272852"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.36.32532"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\Version = "14.36.32532.0"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\PackageCode = "73C8C8E4844B0BB4A8B86F043B32F917"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FC1A3346AC77BE441A954308AE79F7EA	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{33FE6E7B-2B3E-4B59-9F47-1B6C1E9953A6}\Dependents\{33FE6E7B-2B3E-4B59-9F47-1B6C1E9953A6}	MoonlightSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\27DD5200959A5B540A3AE7EF1BA50805	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC1A3346AC77BE441A954308AE79F7EA\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{33FE6E7B-2B3E-4B59-9F47-1B6C1E9953A6}\DisplayName = "Moonlight Game Streaming Client"	MoonlightSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{33FE6E7B-2B3E-4B59-9F47-1B6C1E9953A6}\Dependents	MoonlightSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\Dependents\{8bdfe669-9705-4184-9368-db9ce581e0e7}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{0025DD72-A959-45B5-A0A3-7EFEB15A8050}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC1A3346AC77BE441A954308AE79F7EA\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{D5D19E2F-7189-42FE-8103-92CD1FA457C2}v14.36.32532\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\Version = "237272852"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{33FE6E7B-2B3E-4B59-9F47-1B6C1E9953A6}	MoonlightSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2E91D5D9817EF24183029DCF14A752C\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2E91D5D9817EF24183029DCF14A752C\VC_Runtime_Minimum	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\PackageCode = "1BE5B2DDE80EDC54D874D240756DB43A"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\AuthorizedLUAApp = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{6433A1CF-77CA-44EB-A159-3480EA977FAE}_v5.0.1.0	MoonlightSetup.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Moonlight.exe

pid process

1588 Moonlight.exe

pid	process
1588	Moonlight.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msiexec.exe

pid	process
4144	msiexec.exe
4144	msiexec.exe
4144	msiexec.exe
4144	msiexec.exe
4144	msiexec.exe
4144	msiexec.exe
4144	msiexec.exe
4144	msiexec.exe
4144	msiexec.exe
4144	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exesrtasks.exeVC_redist.x64.exemsiexec.exe

description	pid	process
Token: SeBackupPrivilege	4916	vssvc.exe
Token: SeRestorePrivilege	4916	vssvc.exe
Token: SeAuditPrivilege	4916	vssvc.exe
Token: SeBackupPrivilege	2452	srtasks.exe
Token: SeRestorePrivilege	2452	srtasks.exe
Token: SeSecurityPrivilege	2452	srtasks.exe
Token: SeTakeOwnershipPrivilege	2452	srtasks.exe
Token: SeBackupPrivilege	2452	srtasks.exe
Token: SeRestorePrivilege	2452	srtasks.exe
Token: SeSecurityPrivilege	2452	srtasks.exe
Token: SeTakeOwnershipPrivilege	2452	srtasks.exe
Token: SeShutdownPrivilege	2476	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2476	VC_redist.x64.exe
Token: SeSecurityPrivilege	4144	msiexec.exe
Token: SeCreateTokenPrivilege	2476	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	2476	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	2476	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2476	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	2476	VC_redist.x64.exe
Token: SeTcbPrivilege	2476	VC_redist.x64.exe
Token: SeSecurityPrivilege	2476	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	2476	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	2476	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	2476	VC_redist.x64.exe
Token: SeSystemtimePrivilege	2476	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	2476	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	2476	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	2476	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	2476	VC_redist.x64.exe
Token: SeBackupPrivilege	2476	VC_redist.x64.exe
Token: SeRestorePrivilege	2476	VC_redist.x64.exe
Token: SeShutdownPrivilege	2476	VC_redist.x64.exe
Token: SeDebugPrivilege	2476	VC_redist.x64.exe
Token: SeAuditPrivilege	2476	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	2476	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	2476	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	2476	VC_redist.x64.exe
Token: SeUndockPrivilege	2476	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	2476	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	2476	VC_redist.x64.exe
Token: SeManageVolumePrivilege	2476	VC_redist.x64.exe
Token: SeImpersonatePrivilege	2476	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	2476	VC_redist.x64.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeTakeOwnershipPrivilege	4144	msiexec.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeTakeOwnershipPrivilege	4144	msiexec.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeTakeOwnershipPrivilege	4144	msiexec.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeTakeOwnershipPrivilege	4144	msiexec.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeTakeOwnershipPrivilege	4144	msiexec.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeTakeOwnershipPrivilege	4144	msiexec.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeTakeOwnershipPrivilege	4144	msiexec.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeTakeOwnershipPrivilege	4144	msiexec.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeTakeOwnershipPrivilege	4144	msiexec.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeTakeOwnershipPrivilege	4144	msiexec.exe
Token: SeRestorePrivilege	4144	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

MoonlightSetup-5.0.1.exe

pid process

3408 MoonlightSetup-5.0.1.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

MiniSearchHost.exeMoonlight.exe

pid	process
2148	MiniSearchHost.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe
1588	Moonlight.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

MoonlightSetup-5.0.1.exeMoonlightSetup-5.0.1.exeMoonlightSetup.exeVC_redist.x64.exeVC_redist.x64.exeVC_redist.x64.exeVC_redist.x64.exeVC_redist.x64.exemsiexec.exe

description	pid	process	target process
PID 2356 wrote to memory of 3408	2356	MoonlightSetup-5.0.1.exe	MoonlightSetup-5.0.1.exe
PID 2356 wrote to memory of 3408	2356	MoonlightSetup-5.0.1.exe	MoonlightSetup-5.0.1.exe
PID 2356 wrote to memory of 3408	2356	MoonlightSetup-5.0.1.exe	MoonlightSetup-5.0.1.exe
PID 3408 wrote to memory of 3352	3408	MoonlightSetup-5.0.1.exe	MoonlightSetup.exe
PID 3408 wrote to memory of 3352	3408	MoonlightSetup-5.0.1.exe	MoonlightSetup.exe
PID 3408 wrote to memory of 3352	3408	MoonlightSetup-5.0.1.exe	MoonlightSetup.exe
PID 3352 wrote to memory of 812	3352	MoonlightSetup.exe	VC_redist.x64.exe
PID 3352 wrote to memory of 812	3352	MoonlightSetup.exe	VC_redist.x64.exe
PID 3352 wrote to memory of 812	3352	MoonlightSetup.exe	VC_redist.x64.exe
PID 812 wrote to memory of 3820	812	VC_redist.x64.exe	VC_redist.x64.exe
PID 812 wrote to memory of 3820	812	VC_redist.x64.exe	VC_redist.x64.exe
PID 812 wrote to memory of 3820	812	VC_redist.x64.exe	VC_redist.x64.exe
PID 3820 wrote to memory of 2476	3820	VC_redist.x64.exe	VC_redist.x64.exe
PID 3820 wrote to memory of 2476	3820	VC_redist.x64.exe	VC_redist.x64.exe
PID 3820 wrote to memory of 2476	3820	VC_redist.x64.exe	VC_redist.x64.exe
PID 2476 wrote to memory of 5056	2476	VC_redist.x64.exe	VC_redist.x64.exe
PID 2476 wrote to memory of 5056	2476	VC_redist.x64.exe	VC_redist.x64.exe
PID 2476 wrote to memory of 5056	2476	VC_redist.x64.exe	VC_redist.x64.exe
PID 5056 wrote to memory of 5064	5056	VC_redist.x64.exe	VC_redist.x64.exe
PID 5056 wrote to memory of 5064	5056	VC_redist.x64.exe	VC_redist.x64.exe
PID 5056 wrote to memory of 5064	5056	VC_redist.x64.exe	VC_redist.x64.exe
PID 5064 wrote to memory of 4352	5064	VC_redist.x64.exe	VC_redist.x64.exe
PID 5064 wrote to memory of 4352	5064	VC_redist.x64.exe	VC_redist.x64.exe
PID 5064 wrote to memory of 4352	5064	VC_redist.x64.exe	VC_redist.x64.exe
PID 4144 wrote to memory of 1760	4144	msiexec.exe	MsiExec.exe
PID 4144 wrote to memory of 1760	4144	msiexec.exe	MsiExec.exe
PID 4144 wrote to memory of 4692	4144	msiexec.exe	MsiExec.exe
PID 4144 wrote to memory of 4692	4144	msiexec.exe	MsiExec.exe
PID 3408 wrote to memory of 1588	3408	MoonlightSetup-5.0.1.exe	Moonlight.exe
PID 3408 wrote to memory of 1588	3408	MoonlightSetup-5.0.1.exe	Moonlight.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\MoonlightSetup-5.0.1.exe
"C:\Users\Admin\AppData\Local\Temp\MoonlightSetup-5.0.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\TEMP\{0F7CFFF2-DE1B-4799-843B-DED90386DB1E}\.cr\MoonlightSetup-5.0.1.exe
  "C:\Windows\TEMP\{0F7CFFF2-DE1B-4799-843B-DED90386DB1E}\.cr\MoonlightSetup-5.0.1.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\MoonlightSetup-5.0.1.exe" -burn.filehandle.attached=684 -burn.filehandle.self=680
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\TEMP\{559702A5-2264-474D-A996-36D082514F39}\.be\MoonlightSetup.exe
    "C:\Windows\TEMP\{559702A5-2264-474D-A996-36D082514F39}\.be\MoonlightSetup.exe" -q -burn.elevated BurnPipe.{E19126F4-A830-4FDA-9615-7ADAEC3ADA54} {A6E969FF-420C-41B7-AD96-017A354DC40D} 3408
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\ProgramData\Package Cache\70A888D5891EFD2A48D33C22F35E9178BD113032162DC5A170E7C56F2D592E3C\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\70A888D5891EFD2A48D33C22F35E9178BD113032162DC5A170E7C56F2D592E3C\VC_redist.x64.exe" /install /quiet /norestart
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:812
    - - C:\Windows\Temp\{EBA46D0F-FED3-4D3D-AF5B-30DC04FF2D0F}\.cr\VC_redist.x64.exe
        
        "C:\Windows\Temp\{EBA46D0F-FED3-4D3D-AF5B-30DC04FF2D0F}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\70A888D5891EFD2A48D33C22F35E9178BD113032162DC5A170E7C56F2D592E3C\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=572 /install /quiet /norestart
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3820
      - C:\Windows\Temp\{D0E42B4E-67E2-48D5-9171-B3465714998F}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{D0E42B4E-67E2-48D5-9171-B3465714998F}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{9D93DE24-5AE2-40A3-941E-E13C599ED21E} {0E07EB4D-D0EF-428F-8213-4F875B9A06F0} 3820
        6⤵
        Adds Run key to start application
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=988 -burn.embedded BurnPipe.{E22B16B2-4FA4-48CF-A381-ADF6D62C4550} {5E5D5C92-866E-4FD3-9476-C981078B471D} 2476
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=988 -burn.embedded BurnPipe.{E22B16B2-4FA4-48CF-A381-ADF6D62C4550} {5E5D5C92-866E-4FD3-9476-C981078B471D} 2476
        8⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{457E2926-93E7-42DF-9C6B-2163204B7A4E} {B600DEE1-FAC4-476B-BDEB-FFE3538339EF} 5064
        9⤵
        Modifies registry class
        
        PID:4352
- - C:\Program Files\Moonlight Game Streaming\Moonlight.exe
    "C:\Program Files\Moonlight Game Streaming\Moonlight.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks SCSI registry key(s)
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:1588

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2452

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2148

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C200009E2374A9FC58EAFABC1F7FD3DF
  2⤵
  - Loads dropped DLL
  PID:1760
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding EB2838988BD68C47A87F0C18CA7F3A1D E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:4692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57d093.rbs

Filesize
19KB

MD5
681bcfe260a96d730d607e09cb9487e9

SHA1
c8a77d9c63571cccfe44b5095f191949182d8efe

SHA256
586010605efddc2afbea0bff46b1b9d9cdc898fbe8866a5b9fb1517c34f1387d

SHA512
eefbf3f9425402155caa040c8ebffdf4d5b9476d685bc34f8ecf95bec7f98dce2af90ea2531120870d0d0667da81fbd557a8955af44db422274dd4b348139778

Download Submit
C:\Config.Msi\e57d09f.rbs

Filesize
19KB

MD5
a0b88c39a2ff354ee025ea926f4e8f84

SHA1
2f2d958de7d120bad8cf35e4e7780b2bb135f9c6

SHA256
7ab7a0e7f12fd5dd1b6e6bec1e34239a1df32e73de772e5ff8cc1354d25381c9

SHA512
37b2134df1689136f0332f06a924e852ffc506d0038e412936db50e391e9e9a0a10c55222a4baf686d3aa3ed62955b934f014f253df02a54bf7deace02420590

Download Submit
C:\Config.Msi\e57d0a6.rbs

Filesize
21KB

MD5
25e44ed3ebddc12908c2476e5751da66

SHA1
b8aa24d822f4588746a9bcd3fb35f234cbcba4da

SHA256
47d7832d706eb1758a5edc160863bc87f1f9c2a562b2fc555419fd411af93e16

SHA512
6133fc027bdd7ad13b62e18acb415027d6a213d25f74161da64cab103dc0294095618abff19e90e463b71ad2fb13a43478fd48fcddbeba83a75ef1aafcc9be14

Download Submit
C:\Config.Msi\e57d0b5.rbs

Filesize
21KB

MD5
31050fee095675e5618940df7ffdfe10

SHA1
c1d2defaddb302b4cc93f946f9b27a98e437a7ae

SHA256
be137a5382b9754706c114fa2f786ca9d8e70a7fd30c8b5904d80fbe52545bfd

SHA512
31842b4de7e23c023670bfd7ce495fd8aa075aaa0065d7ca000b0dddfdcb7f400c30106ec9c4acf8cb96add9a607fdabdb5a27ae584218e0147d09f29f71b11c

Download Submit
C:\Config.Msi\e57d0ba.rbs

Filesize
243KB

MD5
bab7cdd215481e092b0acb21e59847bb

SHA1
3d4ea4a4d02c41c59baa9dac080db74a45673e08

SHA256
5c8ddf6312cddd44cd44f0e8e2807987e43464d2ec900a7e468e42bcee5f7897

SHA512
2d0bcd24de10cf86420c0080418b1a6a794a6611d4b6298a9d523ce8fb44c937654c235f966ea6dbeadeabb986d2223e253f1f97cb0888334d2e2bcb3366bebf

Download Submit
C:\Program Files\Moonlight Game Streaming\AntiHooking.dll

Filesize
56KB

MD5
a9b12a766ffbf476d3f16af1430776c7

SHA1
50d415c58cffa9772dae872907ae88057ffc70c6

SHA256
3c616edd09c2e977c5b5e9adf440f4ad3ce6dcb120921b918122fbb84a82cf64

SHA512
471e6d08e9d28db239d4b013e6a30b3626f226b288ffdd1e5300ec8635d75ec43db5becc37fd9eba0f243723ada9dc0d969d7a70f467065c200884ece9c60d4f

Download Submit
C:\Program Files\Moonlight Game Streaming\Moonlight.exe

Filesize
2.1MB

MD5
2253f8e07f098d207b39b14c6c7937a5

SHA1
0a7866832cab6876a1603694bae11eb23259e440

SHA256
359ad692ba8a740bec47e2f3f1c66fff6cec599d7ba8d7c389b5081c8d82b5c0

SHA512
359fc5a4e36533157a6fcde4e971ef47ca21823b0b7c628b2beec17da368dce6aba42aad3daa347750abf06d2e502378c36ac61a8ee3690c7556fb905d039e60

Download Submit
C:\Program Files\Moonlight Game Streaming\Qt5Core.dll

Filesize
5.7MB

MD5
dc7620e92132f96b26ace3ab9efb8ad2

SHA1
882dd6c3001bec19919cf2684a37dd9cffdb2333

SHA256
835747c5e64005cad998013796dfb921b865b47d406265468ca7c6942802ce12

SHA512
2c79cc7d7f0efa6ce4515d60539131f4433a2e2ee94a2f0a7612f9f23b5dcd7a081c4246126e700fae9ab5df00bca0dfbcd94a4901b908bb68dcc37a53944f2d

Download Submit
C:\Program Files\Moonlight Game Streaming\Qt5Gui.dll

Filesize
6.7MB

MD5
ade3f62a507aa05508f69290129aedba

SHA1
b3dea8740822d4db2f657376ae7503235948a30e

SHA256
13c4a2e76881f8388599eaa771910d944579a74c4b946caf78aa292e903b0aab

SHA512
cc73b3c6d3f72be9d12f8e39dc4164a22a6fb0931d94f1301a18a3ae2ecb00bcc88c40c1f237ba0aacb7822c9af1ec33aeb9b6adb4ce02bed0a019958d9ab2fe

Download Submit
C:\Program Files\Moonlight Game Streaming\Qt5Network.dll

Filesize
1.3MB

MD5
215575fec63a9dfb0813a23bbdb80af2

SHA1
d50c138dc00856d58f09a4b35950ef7da14cbc9a

SHA256
1c87018a5ecfb21f9b6bfcef7cd425747cad1eaf87d66ce2a87e83a3acbb2128

SHA512
6b3e6814bcdbc9ecf9e5f4da97c2e7f0760bdf777ac2b5d597ad3bb02b2a4db44c01143b1453b90f7343d6bbfa2d637991eb7ffb2d2673065c475248287b0fcd

Download Submit
C:\Program Files\Moonlight Game Streaming\Qt5Qml.dll

Filesize
3.4MB

MD5
cfe9a6c3ff090aa7f00166f09a522104

SHA1
ebeaa0c57b166e071f3ba107fb2a6c426b67344d

SHA256
242a8454f5041d1a38237778381221bc369d93e5305c0b5300127fee7c742fb0

SHA512
5957477ff9bedbb5e4415576e8232e39830c117c80822b2f4814d026805e88ccd33798a616bca2066382f0fccdd704a27d39b4e990384add1bbe33f7cec4a3cc

Download Submit
C:\Program Files\Moonlight Game Streaming\Qt5QuickControls2.dll

Filesize
173KB

MD5
d63d3570fbb55e96564385756f15b3bc

SHA1
2a93b9ee2c1ab23a2a62c787fee2726f93268173

SHA256
351f0c7f8c1707cd82e90d4b12257ef3d44b10718ab5039fe8eae0e71238e374

SHA512
36b7a583e9b71d4ad23cb76eca3e85f843b8b4a7ba152958884b191e187e323fe1f0eb767603c0fea1e12cbf2ee2e312488ae34489e9eea3663ebc135ed0734d

Download Submit
C:\Program Files\Moonlight Game Streaming\Qt5Svg.dll

Filesize
327KB

MD5
561ab391ded9b63d13192369397ef0ab

SHA1
2a9419f6675658c1ed9ec023b2615df464cc9681

SHA256
4a3f06641063b0850f2305e99170e3308f1142fe3cc27c36bc7efe98749ba2e8

SHA512
d2cc6bb2c2a5d4ef3abb3572c466961dfa8d6705d29225a8d90772eb87868cceaaf16d657a97abc336d63d9df5a4345e9bf3d5bd572d05b8fa526cd9e9913be1

Download Submit
C:\Program Files\Moonlight Game Streaming\SDL2.dll

Filesize
1.6MB

MD5
354b9409641cee26ecc5436b45859cbf

SHA1
56f91b5c137feef0877d50f4805098401eb21d03

SHA256
76eef0fd18f50a5cc71edacf7fd37e403ca349f09527c2bf8bf74942071a8ebf

SHA512
d76de8c74f3fa7ce57b393992f888a879e1b8310d989603a73354fe1b616b42644d66483eae1df5af05fc39e3c42b939e82d2a02ca2bff141060cb762b277cd1

Download Submit
C:\Program Files\Moonlight Game Streaming\SDL2_ttf.dll

Filesize
681KB

MD5
56a615276e80849761e6dcb821d9f84e

SHA1
d0986388b0c00f80740716357745bc928ede7ce2

SHA256
fc0c25b05fc71a81eba0a2d6c66219a616b5d14e61810b7ef69c4778febe01d0

SHA512
39216fdc6fba98dfa9d7d15fb05b9e0db1cec174c6a132aeec9b9e3e2a2e7410c5630f5056040ccbfaf9cebb244f234dc70c9a1f528eea92589afbb1932c2cdf

Download Submit
C:\Program Files\Moonlight Game Streaming\avcodec-60.dll

Filesize
4.5MB

MD5
feab99abab8b0037291f3519658c0206

SHA1
375026b4ccf4d6fad05a8762b3befb552eeee29d

SHA256
f72371898b82e200a53dba523d40867a4e19b6e0a2a098d595e3b786d8678890

SHA512
1ead4519a7eae77dcdb33ab2ca8e40c3a051caba86d1e3f16d6fb6ff4481172609f2df370940b61c5489c25e40a50f0bf5981e580bd72933ead6a9004de94bae

Download Submit
C:\Program Files\Moonlight Game Streaming\avutil-58.dll

Filesize
1.9MB

MD5
3eaa67b2e57496d607d5ac5fd15204d1

SHA1
acb7e8b994fcc7e560e3f06a30348cab837ebf17

SHA256
ee38d1cc6670fe4f6887d35c5a277e557117334a973603cb60a57c329c3ddd7d

SHA512
0903b95a5a754dbdc88a3210d72c4064065ea7dd68ec403786d2f109e978e8e53e0c3052613e56cd061a7ce2289aa93aa75d9b99709cb91c7c59425f5a61f75c

Download Submit
C:\Program Files\Moonlight Game Streaming\discord-rpc.dll

Filesize
71KB

MD5
0cb91de7a031c15fec7dffd19b1f8081

SHA1
d9c289eb41b11d50656e9793050f6d4f988b71c0

SHA256
cac054529d48ba0b36feba1fcc16c50231d7ce4d9b8773f97ae5df853f0ceee0

SHA512
e2f5db4bcc0a3d25ee6c9b6d0f135873aa4288899db3856c5f2cf76f37b0fcac2f450c734a17ccb055cd79121405771d6fa771ab6eb6cada213108824b6d9f1c

Download Submit
C:\Program Files\Moonlight Game Streaming\libcrypto-1_1-x64.dll

Filesize
3.3MB

MD5
32c95fa37d995eb750b4b49cf06adaa7

SHA1
5ac7382e45d0480699d23cbf1fa25662fe43761f

SHA256
6c5cebcd51b31d393291a31a3006cc2c7ecd315e38eb06254bf58bc87d30b098

SHA512
4c3a084772ae5a22da45806b61b7bf884943b3e090ecc564069d6b679a7eacf49c8796cf55030bbf751939b85ee18a93c17b9062398f0e7700507d3e4841353f

Download Submit
C:\Program Files\Moonlight Game Streaming\opus.dll

Filesize
416KB

MD5
de15a14ebc5c1018a41e4fa215cd6387

SHA1
70aa18e6e43c65bdeb60124a20479802079e7029

SHA256
9ec09716074e88a53fc232d51ad86f4fe0b0f6b5a8de4d9f4de2762861605fd0

SHA512
506dc0a9a754e486352eeaeceae62cdf108f9620fb27192b1b4b81351a9c3bda19f2b0755103d2a0dce1b7bc8408415dd957486793bf54299f162280beeed1b7

Download Submit
C:\ProgramData\Package Cache\{33FE6E7B-2B3E-4B59-9F47-1B6C1E9953A6}\state.rsm

Filesize
1KB

MD5
11cc0dddef58caffa81c707eaeec1e8f

SHA1
a238cb51c44e69a11cb40086cb2ea4f34e367484

SHA256
df6d6d3cd8a1ec0cc4167ecb6aed94b48928548b94ba88c0160a5fe8c6e19a54

SHA512
3d8ccaed02648e6c53cfe3fa7fe60e077818508979378853c4a620743949e0c2c06d4d65d21a9a6a915ec8c80a42211fb8b633c3d0636422759df32a7e62c59a

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
2cb9e3f89741961748d38d15dfecc8fb

SHA1
11f89dfac73dfacb194fa01bf6e7fddb38c1f6d7

SHA256
e76dcf1390543fde2ae6fd8263e90df10923df9dfe78a5fb588a50654577fd13

SHA512
20557311d13320d2f7c8bfb99e49c8af30dbcbace0faaa5101f9ea893a017a55100bf2b3c466c9d9cfe4fa8a8affcef9223a870abbcf571492fa90abd0e748f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Moonlight_Game_Streaming_Client_20240521145714_001_Moonlight_x64.log

Filesize
1KB

MD5
8ab4c255feea600749dfedbf1b8752d8

SHA1
a4f3d472116d0e2eee673e12dd90ffadfd18e18d

SHA256
b60377a502d2943d6084ee0c8f6d4c9a0b4b075d1475ad2a842563577caa8b74

SHA512
04bc1df000e1472f4dd8b84fb9b9773ea0dab48e249580d7d6cf1dfe81a7229a16cb9809e0341cc535f4f65b3c09de766a11c720122238c8d3be3287124f152e

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240521145745_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
50c21590a473e91d3024926e78efa0ab

SHA1
ab04886e8cb48b969373d1c56b796d4c67e20aaf

SHA256
fab85ad0c069cbfb6ea62c6a835c0440ef99051a8f87a244efe515cf6ec52557

SHA512
0c02e0561b81852115969d00edae56f2b743fd1b1cdc0be0b1ea8fce04ce32ec8b6ae5e1b78214e04e2b4e967fc8f38b4e5473b9ae0fcec3d5d8f11ff4407fc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240521145745_001_vcRuntimeAdditional_x64.log

Filesize
3KB

MD5
8f36db9dca35ccdd8a0935c71bcd7b64

SHA1
6c2d91e3f63c252d34208080ce8a3a98687ea63a

SHA256
36d56b20297e3da1356798c5c74089351d84bc59bc7a0d59200916d700695ec7

SHA512
38fa466c48416916efb985558d0817ad51915f1e2e0bf724bd7fbca33624ca320f628970d3141b3f970b3c3f24d31afd49f289c6951da99b633512f18dfd8b1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{559702A5-2264-474D-A996-36D082514F39}\Moonlight_x64

Filesize
20.8MB

MD5
e716276b4ebc4a1bdcf9e62abd1149a0

SHA1
eca3dc9813d20f5d20a1b9c080bc7500cf1e8d8b

SHA256
100d98f189cb96111896874a6a19aea0b5e4d4ffe841489f07dff32879740e22

SHA512
e11f09014728bfd04340eb76ba7e599a2f6cede2b98db7fd70fa35ad179437edfb561d236a9239696e80e8d6eef7d87a5ac5b2519902e8313b1c54e3c2f5a9bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\{559702A5-2264-474D-A996-36D082514F39}\VC_redist.x64.exe

Filesize
24.2MB

MD5
077f0abdc2a3881d5c6c774af821f787

SHA1
c483f66c48ba83e99c764d957729789317b09c6b

SHA256
917c37d816488545b70affd77d6e486e4dd27e2ece63f6bbaaf486b178b2b888

SHA512
70a888d5891efd2a48d33c22f35e9178bd113032162dc5a170e7c56f2d592e3c59a08904b9f1b54450c80f8863bda746e431b396e4c1624b91ff15dd701bd939

Download Submit
C:\Windows\Installer\MSIDD83.tmp

Filesize
389KB

MD5
3f7fcb7a8fbf5a585112fe0171c3186e

SHA1
988190388156c00b7347fc5f6f4a8285f3f576ff

SHA256
f67b9a0950b1214bec22ad914498ffcd3d859fff6f0a8add97ddb264d258892f

SHA512
eb426d42d143ebfdb7164cfd1eaa8195f40739364279ed216fc37b91ddaaf05cc31abec652c8d522ca9d48bee8c13d069a99d507ecf14d9d76f27bd297abd71b

Download Submit
C:\Windows\Installer\MSIDFF6.tmp

Filesize
185KB

MD5
22920d61b80d4def142f90767e82e1bd

SHA1
8ae66d4e08161036c76660a2801a427950b8af0c

SHA256
570246423157b218057184712bb59f1fe4e0d61a144ccd53931d7986e4d5ab96

SHA512
4079b2fa6139a2d5e7f92c084aa3efded1ec7f41523c6ac52c59b0ca8252eff1d865029be0c032e3e7bae528c548b608ef35ed789c7f4a8bc09d0be0804cbd7a

Download Submit
C:\Windows\System32\msvcp140.dll

Filesize
564KB

MD5
1ba6d1cf0508775096f9e121a24e5863

SHA1
df552810d779476610da3c8b956cc921ed6c91ae

SHA256
74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823

SHA512
9887d9f5838aa1555ea87968e014edfe2f7747f138f1b551d1f609bc1d5d8214a5fdab0d76fcac98864c1da5eb81405ca373b2a30cb12203c011d89ea6d069af

Download Submit
C:\Windows\Temp\{0F7CFFF2-DE1B-4799-843B-DED90386DB1E}\.cr\MoonlightSetup-5.0.1.exe

Filesize
1.1MB

MD5
ca103f75e79cf7123f51cae3d1907c77

SHA1
1d94745d78e29ced0b8d4b8c1a86bae8c2ac3bcb

SHA256
75e0002f2f3f58d805d6df7d66204f09b85851a873f3eb312468179e8aa49a5e

SHA512
b075e26ed1cfcba5f27e998682fdab8168c5ab399a65099ecb53e12b9e98db1d11d6ce85af4234ce5167a364aac7b3ba165645ee3214e82506c4fdd5f53880d1

Download Submit
C:\Windows\Temp\{559702A5-2264-474D-A996-36D082514F39}\.ba\logo.png

Filesize
2KB

MD5
a41c1230755d607fcc956ca6cb876d83

SHA1
6030e4965a3740917baa60c375434d60d5e12491

SHA256
fe91d3d5afb5436439f17a491f9e5cc9e35c22980eb54e289c2715a0204710e8

SHA512
66cde08474ab21a20693f2aa74b0f7e036841d59403246e6cec4f2dfda0a51eb962dad393a3937304174b103d4047344dc20494c32bfcd0562d57cd37df59dc9

Download Submit
C:\Windows\Temp\{559702A5-2264-474D-A996-36D082514F39}\.ba\wixstdba.dll

Filesize
309KB

MD5
1ba06db63b5cc19acb86f1718c790fdd

SHA1
2d453dabc84d38e0603cbea5cd2fc93d6720c3c0

SHA256
e25adddb655cf648dccadda998c8f517d253639a079f0309ddbae11b519c44f1

SHA512
e4c0bf618e2e3cad7de3a3cc5e53870824b1ade35bcf62de46ff0566be4db7582df457c8873dc6627875802184cedf42403edf034eb9db7dedc638d59cb940f2

Download Submit
C:\Windows\Temp\{D0E42B4E-67E2-48D5-9171-B3465714998F}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{D0E42B4E-67E2-48D5-9171-B3465714998F}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{D0E42B4E-67E2-48D5-9171-B3465714998F}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.4MB

MD5
46efc5476e6d948067b9ba2e822fd300

SHA1
d17c2bf232f308e53544b2a773e646d4b35e3171

SHA256
2de285c0fc328d30501cad8aa66a0ca9556ad5e30d03b198ebdbc422347db138

SHA512
58c9b43b0f93da00166f53fda324fcf78fb1696411e3c453b66e72143e774f68d377a0368b586fb3f3133db7775eb9ab7e109f89bb3c5e21ddd0b13eaa7bd64c

Download Submit
C:\Windows\Temp\{D0E42B4E-67E2-48D5-9171-B3465714998F}\cab5046A8AB272BF37297BB7928664C9503

Filesize
935KB

MD5
c2df6cb9082ac285f6acfe56e3a4430a

SHA1
591e03bf436d448296798a4d80f6a39a00502595

SHA256
b8b4732a600b741e824ab749321e029a07390aa730ec59401964b38105d5fa11

SHA512
9f21b621fc871dd72de0c518174d1cbe41c8c93527269c3765b65edee870a8945ecc2700d49f5da8f6fab0aa3e4c2db422b505ffcbcb2c5a1ddf4b9cec0e8e13

Download Submit
C:\Windows\Temp\{D0E42B4E-67E2-48D5-9171-B3465714998F}\vcRuntimeAdditional_x64

Filesize
188KB

MD5
dd070483eda0af71a2e52b65867d7f5d

SHA1
2b182fc81d19ae8808e5b37d8e19c4dafeec8106

SHA256
1c450cacdbf38527c27eb2107a674cd9da30aaf93a36be3c5729293f6f586e07

SHA512
69e16ee172d923173e874b12037629201017698997e8ae7a6696aab1ad3222ae2359f90dea73a7487ca9ff6b7c01dc6c4c98b0153b6f1ada8b59d2cec029ec1a

Download Submit
C:\Windows\Temp\{D0E42B4E-67E2-48D5-9171-B3465714998F}\vcRuntimeMinimum_x64

Filesize
188KB

MD5
a4075b745d8e506c48581c4a99ec78aa

SHA1
389e8b1dbeebdff749834b63ae06644c30feac84

SHA256
ee130110a29393dcbc7be1f26106d68b629afd2544b91e6caf3a50069a979b93

SHA512
0b980f397972bfc55e30c06e6e98e07b474e963832b76cdb48717e6772d0348f99c79d91ea0b4944fe0181ad5d6701d9527e2ee62c14123f1f232c1da977cada

Download Submit
C:\Windows\Temp\{EBA46D0F-FED3-4D3D-AF5B-30DC04FF2D0F}\.cr\VC_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
memory/1588-784-0x000001D3696B0000-0x000001D3696B1000-memory.dmp

Filesize
4KB

Download
memory/1588-762-0x000001D368D10000-0x000001D368D11000-memory.dmp

Filesize
4KB

Download
memory/1588-791-0x000001D3696B0000-0x000001D3696B1000-memory.dmp

Filesize
4KB

Download
memory/1588-790-0x000001D3696B0000-0x000001D3696B1000-memory.dmp

Filesize
4KB

Download
memory/1588-789-0x000001D3696A0000-0x000001D3696A1000-memory.dmp

Filesize
4KB

Download
memory/1588-788-0x000001D3696C0000-0x000001D3696C1000-memory.dmp

Filesize
4KB

Download
memory/1588-786-0x000001D3696B0000-0x000001D3696B1000-memory.dmp

Filesize
4KB

Download
memory/1588-785-0x000001D3696A0000-0x000001D3696A1000-memory.dmp

Filesize
4KB

Download
memory/1588-793-0x000001D3696C0000-0x000001D3696C1000-memory.dmp

Filesize
4KB

Download
memory/1588-783-0x000001D3696B0000-0x000001D3696B1000-memory.dmp

Filesize
4KB

Download
memory/1588-781-0x000001D3696A0000-0x000001D3696A1000-memory.dmp

Filesize
4KB

Download
memory/1588-780-0x000001D3696A0000-0x000001D3696A1000-memory.dmp

Filesize
4KB

Download
memory/1588-779-0x000001D3696A0000-0x000001D3696A1000-memory.dmp

Filesize
4KB

Download
memory/1588-778-0x000001D3696A0000-0x000001D3696A1000-memory.dmp

Filesize
4KB

Download
memory/1588-777-0x000001D3696A0000-0x000001D3696A1000-memory.dmp

Filesize
4KB

Download
memory/1588-776-0x000001D3696A0000-0x000001D3696A1000-memory.dmp

Filesize
4KB

Download
memory/1588-775-0x000001D3696A0000-0x000001D3696A1000-memory.dmp

Filesize
4KB

Download
memory/1588-774-0x000001D369690000-0x000001D369691000-memory.dmp

Filesize
4KB

Download
memory/1588-773-0x000001D369690000-0x000001D369691000-memory.dmp

Filesize
4KB

Download
memory/1588-772-0x000001D369690000-0x000001D369691000-memory.dmp

Filesize
4KB

Download
memory/1588-771-0x000001D3696A0000-0x000001D3696A1000-memory.dmp

Filesize
4KB

Download
memory/1588-769-0x000001D369690000-0x000001D369691000-memory.dmp

Filesize
4KB

Download
memory/1588-768-0x000001D369690000-0x000001D369691000-memory.dmp

Filesize
4KB

Download
memory/1588-767-0x000001D369690000-0x000001D369691000-memory.dmp

Filesize
4KB

Download
memory/1588-766-0x000001D369690000-0x000001D369691000-memory.dmp

Filesize
4KB

Download
memory/1588-765-0x000001D369690000-0x000001D369691000-memory.dmp

Filesize
4KB

Download
memory/1588-764-0x000001D369690000-0x000001D369691000-memory.dmp

Filesize
4KB

Download
memory/1588-792-0x000001D3696B0000-0x000001D3696B1000-memory.dmp

Filesize
4KB

Download
memory/1588-761-0x000001D368D10000-0x000001D368D11000-memory.dmp

Filesize
4KB

Download
memory/1588-760-0x000001D368D00000-0x000001D368D01000-memory.dmp

Filesize
4KB

Download
memory/1588-759-0x000001D368D10000-0x000001D368D11000-memory.dmp

Filesize
4KB

Download
memory/1588-758-0x000001D368D10000-0x000001D368D11000-memory.dmp

Filesize
4KB

Download
memory/1588-757-0x000001D368D10000-0x000001D368D11000-memory.dmp

Filesize
4KB

Download
memory/1588-756-0x000001D368D10000-0x000001D368D11000-memory.dmp

Filesize
4KB

Download
memory/1588-755-0x000001D368D10000-0x000001D368D11000-memory.dmp

Filesize
4KB

Download
memory/1588-753-0x000001D368D00000-0x000001D368D01000-memory.dmp

Filesize
4KB

Download
memory/1588-752-0x000001D368D00000-0x000001D368D01000-memory.dmp

Filesize
4KB

Download
memory/1588-751-0x000001D368D00000-0x000001D368D01000-memory.dmp

Filesize
4KB

Download
memory/1588-750-0x000001D368D00000-0x000001D368D01000-memory.dmp

Filesize
4KB

Download
memory/1588-749-0x000001D368D00000-0x000001D368D01000-memory.dmp

Filesize
4KB

Download
memory/1588-747-0x000001D368D00000-0x000001D368D01000-memory.dmp

Filesize
4KB

Download
memory/1588-794-0x000001D3696B0000-0x000001D3696B1000-memory.dmp

Filesize
4KB

Download
memory/1588-795-0x000001D3696C0000-0x000001D3696C1000-memory.dmp

Filesize
4KB

Download
memory/1588-796-0x000001D3696C0000-0x000001D3696C1000-memory.dmp

Filesize
4KB

Download
memory/1588-798-0x000001D3696D0000-0x000001D3696D1000-memory.dmp

Filesize
4KB

Download
memory/1588-799-0x000001D3696D0000-0x000001D3696D1000-memory.dmp

Filesize
4KB

Download
memory/1588-748-0x000001D368D00000-0x000001D368D01000-memory.dmp

Filesize
4KB

Download
memory/1588-690-0x00007FFB7F9F0000-0x00007FFB7FF31000-memory.dmp

Filesize
5.3MB

Download
memory/1588-697-0x000001D365150000-0x000001D365590000-memory.dmp

Filesize
4.2MB

Download
memory/1588-699-0x000001D365590000-0x000001D365790000-memory.dmp

Filesize
2.0MB

Download
memory/1588-692-0x00007FFB63C80000-0x00007FFB63C90000-memory.dmp

Filesize
64KB

Download
memory/1588-689-0x00007FFB80060000-0x00007FFB80458000-memory.dmp

Filesize
4.0MB

Download
memory/3352-691-0x00000000009A0000-0x0000000000A9D000-memory.dmp

Filesize
1012KB

Download
memory/4352-255-0x00000000004A0000-0x0000000000517000-memory.dmp

Filesize
476KB

Download
memory/5056-293-0x00000000004A0000-0x0000000000517000-memory.dmp

Filesize
476KB

Download
memory/5064-292-0x00000000004A0000-0x0000000000517000-memory.dmp

Filesize
476KB

Download