da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
Size

130KB
MD5

a002046e6a08f24b959b5167e71e4e97
SHA1

c7b918c40d32e054cb6e304c7cbdd1b4394380fb
SHA256

da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182
SHA512

6170dcace6538d3cd00bc2f8bb98d68a3f2ac021c1e38c8cf3b8af07d0995a6c890ae63b7e4260827b20c879c010156e0df60b9b595138280cd1f58cfb22ff65
SSDEEP

3072:EGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r07:X1b/UJO0m7Ko5fvfo3Y

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

system.exelsass.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\\XPV7I4O.exe\""	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\\XPV7I4O.exe\""	lsass.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

system.exelsass.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

system.exelsass.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe

Detects executables built or packed with MPress PE compressor 50 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1976-0-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	INDICATOR_EXE_Packed_MPress
C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	INDICATOR_EXE_Packed_MPress
C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1800-88-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3376-121-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
C:\Windows\lsass.exe	INDICATOR_EXE_Packed_MPress
C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4172-87-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3056-63-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	INDICATOR_EXE_Packed_MPress
C:\Windows\lsass.exe	INDICATOR_EXE_Packed_MPress
C:\Windows\SysWOW64\IHL8Q6D.exe	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1976-286-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
C:\Windows\SysWOW64\IHL8Q6D.exe	INDICATOR_EXE_Packed_MPress
C:\Windows\lsass.exe	INDICATOR_EXE_Packed_MPress
C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\XPV7I4O.exe	INDICATOR_EXE_Packed_MPress
C:\Windows\SysWOW64\CUS4C0UVDM2I2G.exe	INDICATOR_EXE_Packed_MPress
C:\Windows\SysWOW64\RJK8O0X\CUS4C0U.cmd	INDICATOR_EXE_Packed_MPress
C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1028-311-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	INDICATOR_EXE_Packed_MPress
C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\XPV7I4O.exe	INDICATOR_EXE_Packed_MPress
C:\Windows\SysWOW64\CUS4C0UVDM2I2G.exe	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3056-313-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4172-314-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3376-316-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1800-315-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
C:\update.exe	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1800-335-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3376-340-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3376-341-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1028-342-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3376-347-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1800-351-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1028-354-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3376-353-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3376-359-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1028-360-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1800-363-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3376-365-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1028-368-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3376-373-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1800-377-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1028-380-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3376-379-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3376-385-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1028-386-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1800-389-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3376-391-0x0000000000400000-0x0000000000477000-memory.dmp	INDICATOR_EXE_Packed_MPress

UPX dump on OEP (original entry point) 28 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1800-88-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/1976-286-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/1028-311-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/3056-313-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/4172-314-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/3376-316-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/1800-315-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/1800-335-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/3376-340-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/3376-341-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/1028-342-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/3376-347-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/1800-351-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/1028-354-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/3376-353-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/3376-359-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/1028-360-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/1800-363-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/3376-365-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/1028-368-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/3376-373-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/1800-377-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/1028-380-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/3376-379-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/3376-385-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/1028-386-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/1800-389-0x0000000000400000-0x0000000000477000-memory.dmp	UPX
behavioral2/memory/3376-391-0x0000000000400000-0x0000000000477000-memory.dmp	UPX

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Sets file execution options in registry 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

system.exelsass.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\\regedit.cmd"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\\regedit.cmd"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	lsass.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Windows\moonlight.dll	acprotect

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exelsass.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	lsass.exe

Executes dropped EXE 5 IoCs

Processes:

service.exesmss.exesystem.exewinlogon.exelsass.exe

pid process

3056 service.exe
4172 smss.exe
1800 system.exe
3376 winlogon.exe
1028 lsass.exe
Loads dropped DLL 1 IoCs

Processes:

system.exe

pid process

1800 system.exe

pid	process
3056	service.exe
4172	smss.exe
1800	system.exe
3376	winlogon.exe
1028	lsass.exe

pid	process
1800	system.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

system.exelsass.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\moonlight.dll	upx
behavioral2/memory/1800-329-0x0000000010000000-0x0000000010075000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

lsass.exesystem.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0I4ODM = "C:\\Windows\\QSF7N1T.exe"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sTC7N1T0 = "C:\\Windows\\system32\\CUS4C0UVDM2I2G.exe"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0I4ODM = "C:\\Windows\\QSF7N1T.exe"	system.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sTC7N1T0 = "C:\\Windows\\system32\\CUS4C0UVDM2I2G.exe"	lsass.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

service.exe

description	ioc	process
File opened (read-only)	\??\Z:	service.exe
File opened (read-only)	\??\N:	service.exe
File opened (read-only)	\??\Q:	service.exe
File opened (read-only)	\??\W:	service.exe
File opened (read-only)	\??\V:	service.exe
File opened (read-only)	\??\X:	service.exe
File opened (read-only)	\??\J:	service.exe
File opened (read-only)	\??\O:	service.exe
File opened (read-only)	\??\P:	service.exe
File opened (read-only)	\??\K:	service.exe
File opened (read-only)	\??\R:	service.exe
File opened (read-only)	\??\Y:	service.exe
File opened (read-only)	\??\E:	service.exe
File opened (read-only)	\??\H:	service.exe
File opened (read-only)	\??\I:	service.exe
File opened (read-only)	\??\S:	service.exe
File opened (read-only)	\??\T:	service.exe
File opened (read-only)	\??\U:	service.exe
File opened (read-only)	\??\G:	service.exe
File opened (read-only)	\??\L:	service.exe
File opened (read-only)	\??\M:	service.exe

Drops file in System32 directory 42 IoCs

Processes:

da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exesystem.exelsass.exewinlogon.exeservice.exesmss.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\RJK8O0X\CUS4C0U.cmd	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\CUS4C0UVDM2I2G.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\IHL8Q6D.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\RJK8O0X\CUS4C0U.cmd	lsass.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
File opened for modification	C:\Windows\SysWOW64\RJK8O0X\CUS4C0U.cmd	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\RJK8O0X\CUS4C0U.cmd	service.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
File opened for modification	C:\Windows\SysWOW64\RJK8O0X	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\RJK8O0X\CUS4C0U.cmd	system.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\CUS4C0UVDM2I2G.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\IHL8Q6D.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\IHL8Q6D.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\RJK8O0X	lsass.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\RJK8O0X	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
File opened for modification	C:\Windows\SysWOW64\RJK8O0X	service.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\CUS4C0UVDM2I2G.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\IHL8Q6D.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
File opened for modification	C:\Windows\SysWOW64\CUS4C0UVDM2I2G.exe	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
File opened for modification	C:\Windows\SysWOW64\RJK8O0X	smss.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\IHL8Q6D.exe	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
File opened for modification	C:\Windows\SysWOW64\RJK8O0X	system.exe
File opened for modification	C:\Windows\SysWOW64\IHL8Q6D.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\RJK8O0X\CUS4C0U.cmd	smss.exe
File opened for modification	C:\Windows\SysWOW64\CUS4C0UVDM2I2G.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\CUS4C0UVDM2I2G.exe	lsass.exe

Drops file in Windows directory 64 IoCs

Processes:

da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exewinlogon.exesmss.exeservice.exelsass.exesystem.exe

description	ioc	process
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\XPV7I4O.exe	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	winlogon.exe
File opened for modification	C:\Windows\lsass.exe	smss.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\NQN8R6K.com	smss.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	smss.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	service.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\XPV7I4O.exe	service.exe
File opened for modification	C:\Windows\moonlight.dll	lsass.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}	smss.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	service.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}	system.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	system.exe
File opened for modification	C:\Windows\QSF7N1T.exe	lsass.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	smss.exe
File opened for modification	C:\Windows\moonlight.dll	system.exe
File opened for modification	C:\Windows\lsass.exe	winlogon.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	winlogon.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	smss.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	service.exe
File created	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\MYpIC.zip	system.exe
File opened for modification	C:\Windows\cypreg.dll	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
File opened for modification	C:\Windows\VDM2I2G.exe	service.exe
File opened for modification	C:\Windows\VDM2I2G.exe	system.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	lsass.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	lsass.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	lsass.exe
File opened for modification	C:\Windows\VDM2I2G.exe	winlogon.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
File opened for modification	C:\Windows\QSF7N1T.exe	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	service.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}	service.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	smss.exe
File opened for modification	C:\Windows\QSF7N1T.exe	winlogon.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\MYpIC.zip	system.exe
File opened for modification	C:\Windows\64enc.en	system.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	smss.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	winlogon.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	service.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	service.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	lsass.exe
File created	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\zia01908	system.exe
File opened for modification	C:\Windows\cypreg.dll	service.exe
File opened for modification	C:\Windows\cypreg.dll	system.exe
File opened for modification	C:\Windows\moonlight.dll	smss.exe
File opened for modification	C:\Windows\moonlight.dll	winlogon.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}	winlogon.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	winlogon.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	winlogon.exe
File opened for modification	C:\Windows\VDM2I2G.exe	smss.exe
File opened for modification	C:\Windows\lsass.exe	lsass.exe
File opened for modification	C:\Windows\cypreg.dll	lsass.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\NQN8R6K.com	service.exe
File opened for modification	C:\Windows\VDM2I2G.exe	lsass.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\XPV7I4O.exe	smss.exe
File created	C:\Windows\MooNlight.R.txt	smss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	system.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\NQN8R6K.com	system.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
File opened for modification	C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\NQN8R6K.com	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 10 IoCs

Processes:

system.exelsass.exeda0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	lsass.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

system.exe

description pid process

Token: SeBackupPrivilege 1800 system.exe

description	pid	process
Token: SeBackupPrivilege	1800	system.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exeservice.exewinlogon.exesmss.exesystem.exelsass.exe

pid	process
1976	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
3056	service.exe
3376	winlogon.exe
4172	smss.exe
1800	system.exe
1028	lsass.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe

description	pid	process	target process
PID 1976 wrote to memory of 3056	1976	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe	service.exe
PID 1976 wrote to memory of 3056	1976	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe	service.exe
PID 1976 wrote to memory of 3056	1976	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe	service.exe
PID 1976 wrote to memory of 4172	1976	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe	smss.exe
PID 1976 wrote to memory of 4172	1976	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe	smss.exe
PID 1976 wrote to memory of 4172	1976	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe	smss.exe
PID 1976 wrote to memory of 1800	1976	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe	system.exe
PID 1976 wrote to memory of 1800	1976	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe	system.exe
PID 1976 wrote to memory of 1800	1976	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe	system.exe
PID 1976 wrote to memory of 3376	1976	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe	winlogon.exe
PID 1976 wrote to memory of 3376	1976	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe	winlogon.exe
PID 1976 wrote to memory of 3376	1976	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe	winlogon.exe
PID 1976 wrote to memory of 1028	1976	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe	lsass.exe
PID 1976 wrote to memory of 1028	1976	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe	lsass.exe
PID 1976 wrote to memory of 1028	1976	da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe	lsass.exe

C:\Users\Admin\AppData\Local\Temp\da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe
"C:\Users\Admin\AppData\Local\Temp\da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe
"C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe"
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3056

C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe
"C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4172

C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe
"C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe"
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1800

C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe
"C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3376

C:\Windows\lsass.exe
"C:\Windows\lsass.exe"
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Sets file execution options in registry
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1028

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\XPV7I4O.exe
Filesize
130KB

MD5
bd8d4ef0d3abf865dc269de83ae8a150

SHA1
9600afe6e888f8f04fa52a09486eab103467741e

SHA256
3cc530907497633be3941a3c5344770b5e5983b296e2f2ed5cb75d9ad0652f7f

SHA512
02b56bd89cbc6a8a2fa5aa1d0ee0d9f96fb12c6b86c31df808fd3a718b76584fc4f4102c670dac9b741cfddd143ad223c1d710bf5195577a8b001ca18d489b45

Download Submit
C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\XPV7I4O.exe
Filesize
130KB

MD5
4d7799cdc2c5d7c4fb2566523207f6da

SHA1
7b6b57a31859d3e142b50774bc00cd2e190194ed

SHA256
2295fdff3d2fc296107212529471d371168738e6f21f0e6f3504116648d123e3

SHA512
71c41179fe59b13afe5b9c02791257ac06f505221ac97fa80cc19e9a421ade9ea5df09117520b30e17e1769083f5416baf730176f6e7b76c618e2ed7aa83a134

Download Submit
C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd
Filesize
130KB

MD5
deacedeb84ee1c1df9cf7702ad95a904

SHA1
c450cb35011903224ad4b0a431f9c0524203b725

SHA256
49f7295c0c1eb900c9af8a549cc411f8a2c1bcc0ce876e64e012f9522785fa88

SHA512
dd3f660615ba3416dde22b6d0b3623f51d0d95409a1b2d417c863054d29daa60c37c6a00d5c61e5faa09853bf3d0c5a49c7551edefc9fa92ddddd63bc09598be

Download Submit
C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd
Filesize
130KB

MD5
0e07f4f1f0413078bd9321be6c2516aa

SHA1
9a9abe829685a8266455322ef34177369436cb1f

SHA256
fa6c79d1021e9af7afde6d6312f9ee93c01b33335836e29a0081816f2171aa7d

SHA512
e8597f9c3f5c8c61cb407c41444e15201780c1a7eb791c39ca4b7f60abecd4303759c976cf8511db12900738b7e046ca0ba4bff1da2957dc9da2071a298c8a78

Download Submit
C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd
Filesize
130KB

MD5
abb5a127198d1361c71ad2061ec71d3d

SHA1
e1bb0d76e6d7f20608e4bb5d6f730300f54a05c6

SHA256
736cb38a12909cbeda755294c22f2ec6359735444978a99f1e6d862068c13f18

SHA512
e79b85470f7ffbbd71130d841d1eb4fa54ba34d3c347c2a2847bc104eb753d08d16b276abfc56850b090e0434e9d8118cdfca58c186d6622ef1da44cff7dd4b7

Download Submit
C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe
Filesize
130KB

MD5
100e0b141e598cc9dd863320fc5fba43

SHA1
80978a30ac4ff24242df992a8bbf899c0a1eb3fd

SHA256
be7f02a9b5f06e1029f74ffcb7b1e7aaa1380f971fbbfbe85fcb3beef94bc9f3

SHA512
9e21fed3229d6c691b78eb1e1d2683be7a3a06d2bf7732611773401b9ec1069a4636293f2aa5c6025d1a4d24afd6e09758577671036ca00040e8c836b5c394a6

Download Submit
C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe
Filesize
130KB

MD5
a326ee27189583aca1a81906ba6287c4

SHA1
a38fa018260f762b42f05dcc55e77327a24f14d5

SHA256
e152fa1eed5d8335112a9414f055ba577f258bbb6b12b5215ed4e71bf11a1d61

SHA512
1711c05f1ca64d70f2c56fd8cc3170c6fe944065d851665c56a232850571d86727d1ad7c14ee930060723fd3163cdbd230b3f6f41765a065b80daa97bc006765

Download Submit
C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe
Filesize
130KB

MD5
7e876e4fb1cac6a1d4a0ccd8244be9ba

SHA1
561055850afaa050bb53c4c3bc3ec29bec9b6fa5

SHA256
b95fc7baad2f0e75658754b3e4eab3c634056d0b0fd75344f5c003cb8e546601

SHA512
a32b9a3a9888812340e942740319c34f5b31aa7a28ca03ee94a7cff518b6c5c22f6bf7560a099ea73dcf3bd2db9f0762580284968392584f4377bff03b4f2a71

Download Submit
C:\Windows\OTC4D7P.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe
Filesize
130KB

MD5
1133ce8225bec481b125f63fa43fefa0

SHA1
47940bff1e092d577b954dd47a1efab59b7c9c31

SHA256
4cd3d81091231e3b28685cd5eff7ef7b7616fe45ef20b1a05b977859606d42d8

SHA512
c58eed39b221e7f12e76796b5826e2c67bd499de33ba145b2e117d5f8c8215c01fc1f3c1effd346f48f7f25fec97c48c6c26bd1f5f46a2347da3b1a24655dce3

Download Submit
C:\Windows\SysWOW64\CUS4C0UVDM2I2G.exe
Filesize
130KB

MD5
f3cda350ae61784046545a91a697dbb6

SHA1
f77c214d083651e4a2357f4949f5c462b0a2e8b2

SHA256
7610c8ccd29e38bfd10d5c920a46b07b23318891a9bd8575a644cb4e0ee31fc3

SHA512
3bc54aae52aef9c9c42da7dc94215e8e8b107345dbeb4428618ff57732b6a5cd7150598c2dd70d3c339889a51b40450cd723500d57ef20bf07c6b4aadd6c89ac

Download Submit
C:\Windows\SysWOW64\CUS4C0UVDM2I2G.exe
Filesize
130KB

MD5
f27c7ece25742d5282a4cdd72fa2e228

SHA1
1625d5479031083f5ce10aa5bcb3e6b0b2474dc5

SHA256
b98185e5911dfabee328fed88c77f1dc5b50044fb95c15f02eae02c658637dc8

SHA512
f9809ef753a97ac5abd58262d9a72969ae5b54956f552307b9c9e4503bd5cbb15bc3b139df1c4726883655524a08bf48f9e3d68358e7f22df4a77241ee4a68b9

Download Submit
C:\Windows\SysWOW64\IHL8Q6D.exe
Filesize
130KB

MD5
2cfd6feca1a9d8739786ba5f1987e9cf

SHA1
a437a423c0016a39684a67992795a72036f75da8

SHA256
17b6c4ea08f9b8d4d1c9e587b988b231df48b8486f4b3303dad09c45fa56e003

SHA512
c20817f12f4d3a05ac3b7f8a654d408a4aaa1d3fe1f2426f92da1ef3547b2165f4c2cacedc341eeab54fb0ddb887e90f78021cc736831d4c652d27477c5e626e

Download Submit
C:\Windows\SysWOW64\IHL8Q6D.exe
Filesize
130KB

MD5
a002046e6a08f24b959b5167e71e4e97

SHA1
c7b918c40d32e054cb6e304c7cbdd1b4394380fb

SHA256
da0f3addd92984057e7eb06b314cd3f7393d264db492905f4208579d173d3182

SHA512
6170dcace6538d3cd00bc2f8bb98d68a3f2ac021c1e38c8cf3b8af07d0995a6c890ae63b7e4260827b20c879c010156e0df60b9b595138280cd1f58cfb22ff65

Download Submit
C:\Windows\SysWOW64\RJK8O0X\CUS4C0U.cmd
Filesize
130KB

MD5
645aaf399a64a16baa6dd339519b9ee5

SHA1
215789034ef2c5b7db247a420eee3374db0947ca

SHA256
cc2aa5d23d95a7435bfc31e4d6ce311f5b0569caf9fc2b131d59711c37e58a4e

SHA512
2824b51ed1dcddebccac852d834c813e9c8e06babe5ac0124e5e1dc447cbab4a60682bba30a688734aad91549ee9c0fedd94a7e16a5e7479dc52c5bab3e4d7b6

Download Submit
C:\Windows\SysWOW64\systear.dll
Filesize
127B

MD5
5b69821c7b59a51fa23f8125c58d4f78

SHA1
42f2dc22c8ba615a500574b1cb2bd1e959fba1c0

SHA256
288d45a788bf7be3ab1cbb1efc3cff2a4333f36e0ee98df5708d76985a57e6c3

SHA512
d5238fbe5c36d7505cf9d4b337d4461cf220c71d796fe531510b93429e7ad6481a80ea1ee743dc6a7b3524a6cf618feb251bba5b2709fc6a4c4061d0e8ff3893

Download Submit
C:\Windows\SysWOW64\systear.dll
Filesize
141B

MD5
32c3db4ddd00bd14a00873fbaa8c61cf

SHA1
d70cc8045aacd222f6aacfea50f05b4168a83498

SHA256
fa1c687bfa8181ec011f2ab6d5ca4f4a3940bea3f45fe61c89414a553ff68641

SHA512
e132f9ff34064d57b4b4a7cf71d3d816f8a385ca79289fddb9d7efb5679ec8f330595e1ec523837568f120ae6e6e1f27fa0a3dc5fe1a37fc6228573ebf7d5dd2

Download Submit
C:\Windows\cypreg.dll
Filesize
361KB

MD5
da277f942f662c7cc42f98c5f6203ad3

SHA1
1f7c7f5b09b2b7ea73c85e74ed4e09ecb72727e4

SHA256
c277b2e10adab2360bd59d4ee4b53cc63ce545605226a43453422293a3277b1b

SHA512
da91c15fb47f782ee9338b4ea8fca1553af29b3849d82330c31d68b764b235107170c6c32573b4afe6adddc07d963c808a92f8d6f1bb7a5ec113183cf639a6e6

Download Submit
C:\Windows\cypreg.dll
Filesize
361KB

MD5
2ec2659ec7f07edc03a3961477fec1ba

SHA1
5bddbaf25724142738f70896ddf079c5445d1aa1

SHA256
77e1e0a750cdaf9a6a54c8ab0857f2787e3a1280ac2762f320a5d6e98b340bb7

SHA512
243d5d33ccbd52f47406c4e687801263b971c4604469cdd94d5fce9a42054af6efc7463c6524c9aa3a25f37d291d1356a134f9e76fd099504c57e70e783b1d3f

Download Submit
C:\Windows\cypreg.dll
Filesize
361KB

MD5
3b2d06f4c718b88b450ce1ccd437e73f

SHA1
e0b49b16b45bae734cb30316a3237d245f22bdce

SHA256
6a4bf06e7d1c2ec235003c0a21c41fbd4505b0f60b419af144ee6a1c9a9a7610

SHA512
641968623fc81751675ee4ca67dad5964ae77e9d0fbf5f09e82a6dde9a63f88671d7f8637b2d047a4b56402ede648aeafa51420d99056fdaf6f3a566fc5a67bb

Download Submit
C:\Windows\lsass.exe
Filesize
130KB

MD5
3a09aae1bbeaad5c0188e5d703a44e2b

SHA1
89a9960735d7633b5aed9fab4211ff2715fad196

SHA256
0a9dec028c90dc2965db8601a9a003b9d3211c551190cdaf6674fa96e4d3e15f

SHA512
00df7b41d9fefc93f3970095f623368a5c36803cae26b13171adafa9810e70a56b9e7997d20d908f8fe71cd2955fa9040519d391bcd8333a0f03e6732444725f

Download Submit
C:\Windows\lsass.exe
Filesize
130KB

MD5
2ff036f2b13b54e8938dc6bc500661cb

SHA1
99f6a7aea17d578df14fd2ad5dec5d1a17ed57e7

SHA256
1d42fb7ae1f8a784779f99f5e970260fce9ac8366d917ad2c31c0ef9aad29ca1

SHA512
ed4a645da7f6850c5261e128fc028a6c30134b116d93912dee974a9417b2f97651d92c4ca850c1c8b34986f7200f811390f0b761d31fd5fef09fc5f49b0a89b5

Download Submit
C:\Windows\lsass.exe
Filesize
130KB

MD5
e38a6fc2c6bc1408f0607cd66d5e788d

SHA1
edfdeb4301272a8589f58a93389cf0d38adcbfd8

SHA256
b2abc89c9c3eae876781a4f6911ea1d73254872f0ddf9ba27ed52d0ff971bd78

SHA512
8d6e691bcf4d5e0709423fc863412665119de23a4e5e5ce013594ba0b0c3b8f9dd17355002753a15d14eaad326a3674c5f87f0a9d723c7d7e96163e3467d0337

Download Submit
C:\Windows\moonlight.dll
Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\onceinabluemoon.mid
Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\system\msvbvm60.dll
Filesize
1.4MB

MD5
1f7ae8bd1269304b9677a1e8b458c273

SHA1
914c035fcd8fc2d26276175240326923e439a2d8

SHA256
a0971629b884006036919ac4d076303a24ae0fff9e0d5d22f3e309f344bc5cc9

SHA512
c298313cf76eb5db48de59025e60f02eccbb48d7cf1d71c71facbb97fb0112ccab129adfb80db6e23d3c7e50a530d554c25ff4c01555dc217b9e01bc078d6c99

Download Submit
C:\Windows\system\msvbvm60.dll
Filesize
1.4MB

MD5
d31617474ea8cb619c37c0e5d1eca2c0

SHA1
8fe43a3362d5967982bd7887119231ad2d0460e3

SHA256
3d94af26a2348814cd2923d338d5c08bcf0d13152f66f4cf8480b7bc56655fec

SHA512
54028f19d0332cadd5ae5ce6220b76380bccfc1d6eff1116cabd4e9c72e0279fddc331b13b3e4cb1bc7e5a349cd9666b0c02de82206fbccd439ca42d991a443d

Download Submit
C:\Windows\system\msvbvm60.dll
Filesize
1.4MB

MD5
8d205ffd6d88ed41b19caa91a7aa994c

SHA1
5ee0cc6ef7ab500ffb99e42323fe5074b52cce91

SHA256
7500ef088d9a7f141d896bdcc21fc38675dc4763a301d657107ca9622f74ca99

SHA512
8462003ca9aead0737789bdd8a769608e6217e80c82264b439a1d649bc185880220959f9c4b2578cd0467fbca9409bfaeedaf1ab13e70e3a545eb11b239bb68f

Download Submit
C:\Windows\system\msvbvm60.dll
Filesize
1.4MB

MD5
c79ec3a7a2675b90e0c9af40f8d1cab8

SHA1
ec1d7cd4b3b2ecee295e178d4b0bc6afe16b4deb

SHA256
104fcb338da8345db51670d5f8f60c4041ea2ab55ea48c18d408866afddfd5d9

SHA512
dded4fa9b47f4e1e31639c3c5f20474cc94b634ed757ccc2da449619a2fa63dc8a5c59160279ec1458ac6160123f061f798f5a97798cbecb5df78873aa8be736

Download Submit
C:\update.exe
Filesize
130KB

MD5
0dc357c29fd5a7f91e8259c0b283f26d

SHA1
2d24d78692e7422c7531c6c80656853e88a7b00c

SHA256
87896adcda1e7604001890212f321f042d56c7667a45adb33fd94b628be0692c

SHA512
ac197391faa016c05d2229c54ee0cc5dadb8145858fd93189c7d158b532f45a3b522c508b956c442cea7562f2d0977e64f6748539bdcc991ca79f183fca3d954

Download Submit
memory/1028-386-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1028-311-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1028-380-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1028-368-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1028-360-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1028-354-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1028-342-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1800-329-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/1800-363-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1800-315-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1800-389-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1800-335-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1800-377-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1800-351-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1800-88-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1976-286-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1976-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3056-63-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3056-313-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3376-341-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3376-347-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3376-121-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3376-353-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3376-365-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3376-391-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3376-373-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3376-359-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3376-316-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3376-379-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3376-385-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3376-340-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4172-314-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4172-87-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download