babadeda | 1b9a300d4e882a59e4bb15f7aa7069df6cc48057d1f89a71fff6df4e70d483f1

Analysis

max time kernel
300s
max time network
304s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
02-04-2022 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b9a300d4e882a59e4bb15f7aa7069df6cc48057d1f89a71fff6df4e70d483f1.exe
Size

8.1MB
MD5

72ad5cebf69de22b971997bb261ef519
SHA1

27aef0b7214b93b44cbeab76af1dd39db3d938fd
SHA256

1b9a300d4e882a59e4bb15f7aa7069df6cc48057d1f89a71fff6df4e70d483f1
SHA512

a4879dae60d580b3fad31311ae64acdc92604164cc95bd721a4a789c66791c5586eac3922e621c33aab5f919ad92e68ef6cbbc43b3d4857b547e627855bcefe8

Score

10^/10

babadeda phobos crypter evasion loader persistence ransomware spyware stealer

Malware Config

Signatures

Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 5 IoCs

resource	yara_rule
behavioral2/files/0x00070000000162aa-146.dat	family_babadeda
behavioral2/memory/2244-180-0x0000000003330000-0x0000000006530000-memory.dmp	family_babadeda
behavioral2/memory/4704-182-0x0000000002C90000-0x0000000005E90000-memory.dmp	family_babadeda
behavioral2/memory/1900-183-0x0000000002CF0000-0x0000000005EF0000-memory.dmp	family_babadeda
behavioral2/memory/3480-186-0x0000000002C50000-0x0000000005E50000-memory.dmp	family_babadeda

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 2712 created 2244	2712	svchost.exe	82
PID 2712 created 2244	2712	svchost.exe	82
PID 2712 created 4704	2712	svchost.exe	84

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3280	bcdedit.exe
2704	bcdedit.exe
4964	bcdedit.exe
696	bcdedit.exe

Deletes backup catalog 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command-Line Interface

T1059

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
5092	wbadmin.exe
3260	wbadmin.exe

Executes dropped EXE 4 IoCs

pid	Process
2244	AdobeIPCBroker.exe
4704	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
1900	AdobeIPCBroker.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\StopRedo.tiff	AdobeIPCBroker.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	1b9a300d4e882a59e4bb15f7aa7069df6cc48057d1f89a71fff6df4e70d483f1.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\AdobeIPCBroker.exe	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	AdobeIPCBroker.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe

Loads dropped DLL 23 IoCs

pid	Process
1484	1b9a300d4e882a59e4bb15f7aa7069df6cc48057d1f89a71fff6df4e70d483f1.exe
1484	1b9a300d4e882a59e4bb15f7aa7069df6cc48057d1f89a71fff6df4e70d483f1.exe
2244	AdobeIPCBroker.exe
2244	AdobeIPCBroker.exe
2244	AdobeIPCBroker.exe
2244	AdobeIPCBroker.exe
2244	AdobeIPCBroker.exe
2244	AdobeIPCBroker.exe
4704	AdobeIPCBroker.exe
4704	AdobeIPCBroker.exe
4704	AdobeIPCBroker.exe
4704	AdobeIPCBroker.exe
4704	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
1900	AdobeIPCBroker.exe
1900	AdobeIPCBroker.exe
1900	AdobeIPCBroker.exe
1900	AdobeIPCBroker.exe
1900	AdobeIPCBroker.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeIPCBroker = "C:\\Users\\Admin\\AppData\\Local\\AdobeIPCBroker.exe"	AdobeIPCBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeIPCBroker = "C:\\Users\\Admin\\AppData\\Local\\AdobeIPCBroker.exe"	AdobeIPCBroker.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1346565761-3498240568-4147300184-1000\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Public\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	AdobeIPCBroker.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	AdobeIPCBroker.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	AdobeIPCBroker.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\tesselate.x3d	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.tree.dat	AdobeIPCBroker.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_checkbox_selected_18.svg.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp_5.5.0.165303.jar.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\7739_32x32x32.png	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-64.png	AdobeIPCBroker.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ro-ro\ui-strings.js.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-125_contrast-black.png	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-24_altform-fullcolor.png	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	AdobeIPCBroker.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\circle.cur.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\AXIS.ELM.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-unplated_contrast-black.png	AdobeIPCBroker.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\MpAsDesc.dll.mui	AdobeIPCBroker.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-awt.xml	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-256_altform-lightunplated.png	AdobeIPCBroker.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-disabled_32.svg.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-ma\ui-strings.js.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hu-hu\ui-strings.js.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeSmallTile.scale-125.png	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\Xbox360PurchaseControl.xaml	AdobeIPCBroker.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot_2x.png.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-30_contrast-white.png	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png	AdobeIPCBroker.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.153.55\MicrosoftEdgeUpdate.exe	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Diagnostics.StackTrace.dll	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\x64\msvp9dec_store.dll	AdobeIPCBroker.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\example_icons.png.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.153.55\msedgeupdateres_el.dll	AdobeIPCBroker.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\ui-strings.js.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pl-pl\ui-strings.js.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Google.scale-400.png	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_contrast-white.png	AdobeIPCBroker.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Contain.Tests.ps1	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\msipc.dll.mui	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupLargeTile.scale-400.png	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML	AdobeIPCBroker.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.White.png.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms	AdobeIPCBroker.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_cs_135x40.svg	AdobeIPCBroker.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_altform-unplated_contrast-black.png	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailBadge.scale-100.png	AdobeIPCBroker.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_pl.dll	AdobeIPCBroker.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\MSFT_PackageManagementSource.strings.psd1.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64.png	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_scale-200.png	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.Tests.ps1	AdobeIPCBroker.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\TestDrive.Tests.ps1	AdobeIPCBroker.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml.id[604F613E-2686].[[email protected]].Devos	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms	AdobeIPCBroker.exe
File opened for modification	C:\Program Files\SendEnter.lock	AdobeIPCBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
5048	vssadmin.exe
4748	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings	AdobeIPCBroker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe
3480	AdobeIPCBroker.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3480	AdobeIPCBroker.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2244	AdobeIPCBroker.exe
Token: SeTcbPrivilege	2712	svchost.exe
Token: SeTcbPrivilege	2712	svchost.exe
Token: SeIncreaseQuotaPrivilege	4704	AdobeIPCBroker.exe
Token: SeDebugPrivilege	3480	AdobeIPCBroker.exe
Token: SeBackupPrivilege	3120	vssvc.exe
Token: SeRestorePrivilege	3120	vssvc.exe
Token: SeAuditPrivilege	3120	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4276	WMIC.exe
Token: SeSecurityPrivilege	4276	WMIC.exe
Token: SeTakeOwnershipPrivilege	4276	WMIC.exe
Token: SeLoadDriverPrivilege	4276	WMIC.exe
Token: SeSystemProfilePrivilege	4276	WMIC.exe
Token: SeSystemtimePrivilege	4276	WMIC.exe
Token: SeProfSingleProcessPrivilege	4276	WMIC.exe
Token: SeIncBasePriorityPrivilege	4276	WMIC.exe
Token: SeCreatePagefilePrivilege	4276	WMIC.exe
Token: SeBackupPrivilege	4276	WMIC.exe
Token: SeRestorePrivilege	4276	WMIC.exe
Token: SeShutdownPrivilege	4276	WMIC.exe
Token: SeDebugPrivilege	4276	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4276	WMIC.exe
Token: SeRemoteShutdownPrivilege	4276	WMIC.exe
Token: SeUndockPrivilege	4276	WMIC.exe
Token: SeManageVolumePrivilege	4276	WMIC.exe
Token: SeImpersonatePrivilege	4276	WMIC.exe
Token: 33	4276	WMIC.exe
Token: 34	4276	WMIC.exe
Token: 35	4276	WMIC.exe
Token: 36	4276	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4276	WMIC.exe
Token: SeSecurityPrivilege	4276	WMIC.exe
Token: SeTakeOwnershipPrivilege	4276	WMIC.exe
Token: SeLoadDriverPrivilege	4276	WMIC.exe
Token: SeSystemProfilePrivilege	4276	WMIC.exe
Token: SeSystemtimePrivilege	4276	WMIC.exe
Token: SeProfSingleProcessPrivilege	4276	WMIC.exe
Token: SeIncBasePriorityPrivilege	4276	WMIC.exe
Token: SeCreatePagefilePrivilege	4276	WMIC.exe
Token: SeBackupPrivilege	4276	WMIC.exe
Token: SeRestorePrivilege	4276	WMIC.exe
Token: SeShutdownPrivilege	4276	WMIC.exe
Token: SeDebugPrivilege	4276	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4276	WMIC.exe
Token: SeRemoteShutdownPrivilege	4276	WMIC.exe
Token: SeUndockPrivilege	4276	WMIC.exe
Token: SeManageVolumePrivilege	4276	WMIC.exe
Token: SeImpersonatePrivilege	4276	WMIC.exe
Token: 33	4276	WMIC.exe
Token: 34	4276	WMIC.exe
Token: 35	4276	WMIC.exe
Token: 36	4276	WMIC.exe
Token: SeBackupPrivilege	4080	wbengine.exe
Token: SeRestorePrivilege	4080	wbengine.exe
Token: SeSecurityPrivilege	4080	wbengine.exe
Token: SeIncreaseQuotaPrivilege	1152	WMIC.exe
Token: SeSecurityPrivilege	1152	WMIC.exe
Token: SeTakeOwnershipPrivilege	1152	WMIC.exe
Token: SeLoadDriverPrivilege	1152	WMIC.exe
Token: SeSystemProfilePrivilege	1152	WMIC.exe
Token: SeSystemtimePrivilege	1152	WMIC.exe
Token: SeProfSingleProcessPrivilege	1152	WMIC.exe
Token: SeIncBasePriorityPrivilege	1152	WMIC.exe
Token: SeCreatePagefilePrivilege	1152	WMIC.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 2244	1484	1b9a300d4e882a59e4bb15f7aa7069df6cc48057d1f89a71fff6df4e70d483f1.exe	82
PID 1484 wrote to memory of 2244	1484	1b9a300d4e882a59e4bb15f7aa7069df6cc48057d1f89a71fff6df4e70d483f1.exe	82
PID 1484 wrote to memory of 2244	1484	1b9a300d4e882a59e4bb15f7aa7069df6cc48057d1f89a71fff6df4e70d483f1.exe	82
PID 2712 wrote to memory of 4704	2712	svchost.exe	84
PID 2712 wrote to memory of 4704	2712	svchost.exe	84
PID 2712 wrote to memory of 4704	2712	svchost.exe	84
PID 2712 wrote to memory of 3480	2712	svchost.exe	85
PID 2712 wrote to memory of 3480	2712	svchost.exe	85
PID 2712 wrote to memory of 3480	2712	svchost.exe	85
PID 2712 wrote to memory of 1900	2712	svchost.exe	86
PID 2712 wrote to memory of 1900	2712	svchost.exe	86
PID 2712 wrote to memory of 1900	2712	svchost.exe	86
PID 3480 wrote to memory of 2936	3480	AdobeIPCBroker.exe	88
PID 3480 wrote to memory of 2936	3480	AdobeIPCBroker.exe	88
PID 3480 wrote to memory of 3376	3480	AdobeIPCBroker.exe	87
PID 3480 wrote to memory of 3376	3480	AdobeIPCBroker.exe	87
PID 3376 wrote to memory of 4272	3376	cmd.exe	92
PID 3376 wrote to memory of 4272	3376	cmd.exe	92
PID 2936 wrote to memory of 4748	2936	cmd.exe	91
PID 2936 wrote to memory of 4748	2936	cmd.exe	91
PID 3376 wrote to memory of 2584	3376	cmd.exe	95
PID 3376 wrote to memory of 2584	3376	cmd.exe	95
PID 2936 wrote to memory of 4276	2936	cmd.exe	96
PID 2936 wrote to memory of 4276	2936	cmd.exe	96
PID 2936 wrote to memory of 3280	2936	cmd.exe	98
PID 2936 wrote to memory of 3280	2936	cmd.exe	98
PID 2936 wrote to memory of 2704	2936	cmd.exe	99
PID 2936 wrote to memory of 2704	2936	cmd.exe	99
PID 2936 wrote to memory of 5092	2936	cmd.exe	100
PID 2936 wrote to memory of 5092	2936	cmd.exe	100
PID 3480 wrote to memory of 3528	3480	AdobeIPCBroker.exe	116
PID 3480 wrote to memory of 3528	3480	AdobeIPCBroker.exe	116
PID 3480 wrote to memory of 3528	3480	AdobeIPCBroker.exe	116
PID 3480 wrote to memory of 3108	3480	AdobeIPCBroker.exe	117
PID 3480 wrote to memory of 3108	3480	AdobeIPCBroker.exe	117
PID 3480 wrote to memory of 3108	3480	AdobeIPCBroker.exe	117
PID 3480 wrote to memory of 4852	3480	AdobeIPCBroker.exe	118
PID 3480 wrote to memory of 4852	3480	AdobeIPCBroker.exe	118
PID 4852 wrote to memory of 5048	4852	cmd.exe	120
PID 4852 wrote to memory of 5048	4852	cmd.exe	120
PID 4852 wrote to memory of 1152	4852	cmd.exe	121
PID 4852 wrote to memory of 1152	4852	cmd.exe	121
PID 4852 wrote to memory of 4964	4852	cmd.exe	123
PID 4852 wrote to memory of 4964	4852	cmd.exe	123
PID 4852 wrote to memory of 696	4852	cmd.exe	124
PID 4852 wrote to memory of 696	4852	cmd.exe	124
PID 4852 wrote to memory of 3260	4852	cmd.exe	125
PID 4852 wrote to memory of 3260	4852	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\1b9a300d4e882a59e4bb15f7aa7069df6cc48057d1f89a71fff6df4e70d483f1.exe
"C:\Users\Admin\AppData\Local\Temp\1b9a300d4e882a59e4bb15f7aa7069df6cc48057d1f89a71fff6df4e70d483f1.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Users\Admin\AppData\Roaming\GreatSim\Milling\AdobeIPCBroker.exe
  "C:\Users\Admin\AppData\Roaming\GreatSim\Milling\AdobeIPCBroker.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- - C:\Users\Admin\AppData\Roaming\GreatSim\Milling\AdobeIPCBroker.exe
    "C:\Users\Admin\AppData\Roaming\GreatSim\Milling\AdobeIPCBroker.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
  - - C:\Users\Admin\AppData\Roaming\GreatSim\Milling\AdobeIPCBroker.exe
      C:\Users\Admin\AppData\Roaming\GreatSim\Milling\AdobeIPCBroker.exe "-relaunchedForIntegrityLevel -launchedbyvulcan-4704 C:\Users\Admin\AppData\Roaming\GreatSim\Milling\AdobeIPCBroker.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1900
- - C:\Users\Admin\AppData\Roaming\GreatSim\Milling\AdobeIPCBroker.exe
    C:\Users\Admin\AppData\Roaming\GreatSim\Milling\AdobeIPCBroker.exe "-relaunchedForIntegrityLevel -launchedbyvulcan-2244 C:\Users\Admin\AppData\Roaming\GreatSim\Milling\AdobeIPCBroker.exe"
    3⤵
    - Executes dropped EXE
    - Modifies extensions of user files
    - Drops startup file
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: RenamesItself
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3376
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set currentprofile state off
        5⤵
        
        PID:4272
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall set opmode mode=disable
        5⤵
        
        PID:2584
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2936
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:4748
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4276
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:3280
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled no
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2704
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin delete catalog -quiet
        5⤵
        Deletes backup catalog
        
        PID:5092
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      4⤵
      PID:3528
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      4⤵
      PID:3108
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4852
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5048
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1152
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:4964
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled no
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:696
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin delete catalog -quiet
        5⤵
        Deletes backup catalog
        
        PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3120

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4080

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:3532

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pbD2F085CC\PB3Dll.dll

Filesize
202KB

MD5
142bc2bb269b896cc0f11f9021dcbc52

SHA1
75b09b25f8f6b3b0fc94fcdcc61d932f303ac418

SHA256
5da7da9abb77790ddbb87d86b9ea4b01a4f375035827e30fa879dab8c2a737db

SHA512
150ffd4e66ee126912c6a5071bec750e4b5e603af9cc79b26c63e482f7d5d0aafcae1c995f10b60ba2da138effb19c668e1515f35db3b8b7a508ef34f59d134a

Download Submit
C:\Users\Admin\AppData\Local\Temp\pbD2F085CC\PBCore.dll

Filesize
444KB

MD5
bf34ceda78a3ff4016e8eca82337ec06

SHA1
38966df0f48da3ee15e2a44545c982693d6f552a

SHA256
3b4e89de9ccb5b1beba22030e29e921460b375bcbe5364115cc093f329596889

SHA512
b5d4af43a78e8c061c823778786fa53db2736543ed2513a033b93302328f4af10d565a7ce4116ee6580400a02e23694eb2183ccfbc9c3d8132fef3e63ae58cae

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\AdobeIPCBroker.exe

Filesize
4.6MB

MD5
25d5826c1136dde91cb8ed3b9319c50d

SHA1
627b989677c7d3d7431ca2d1c591fee095197a1e

SHA256
098467cdf594b08bd6643592f24745f6f37132ab794da2d0263919d5d131bc81

SHA512
73bf5a1b8371bd70df4fb40ed1c08e2ad0db72722634de0167c8bcca7423b0f7fec9fa20bea66521aa051d842442432c623d440873d448af07b85914dbdf532e

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\AdobeIPCBroker.exe

Filesize
4.6MB

MD5
25d5826c1136dde91cb8ed3b9319c50d

SHA1
627b989677c7d3d7431ca2d1c591fee095197a1e

SHA256
098467cdf594b08bd6643592f24745f6f37132ab794da2d0263919d5d131bc81

SHA512
73bf5a1b8371bd70df4fb40ed1c08e2ad0db72722634de0167c8bcca7423b0f7fec9fa20bea66521aa051d842442432c623d440873d448af07b85914dbdf532e

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\AdobeIPCBroker.exe

Filesize
4.6MB

MD5
25d5826c1136dde91cb8ed3b9319c50d

SHA1
627b989677c7d3d7431ca2d1c591fee095197a1e

SHA256
098467cdf594b08bd6643592f24745f6f37132ab794da2d0263919d5d131bc81

SHA512
73bf5a1b8371bd70df4fb40ed1c08e2ad0db72722634de0167c8bcca7423b0f7fec9fa20bea66521aa051d842442432c623d440873d448af07b85914dbdf532e

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\AdobeIPCBroker.exe

Filesize
4.6MB

MD5
25d5826c1136dde91cb8ed3b9319c50d

SHA1
627b989677c7d3d7431ca2d1c591fee095197a1e

SHA256
098467cdf594b08bd6643592f24745f6f37132ab794da2d0263919d5d131bc81

SHA512
73bf5a1b8371bd70df4fb40ed1c08e2ad0db72722634de0167c8bcca7423b0f7fec9fa20bea66521aa051d842442432c623d440873d448af07b85914dbdf532e

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\AdobeIPCBroker.exe

Filesize
4.6MB

MD5
25d5826c1136dde91cb8ed3b9319c50d

SHA1
627b989677c7d3d7431ca2d1c591fee095197a1e

SHA256
098467cdf594b08bd6643592f24745f6f37132ab794da2d0263919d5d131bc81

SHA512
73bf5a1b8371bd70df4fb40ed1c08e2ad0db72722634de0167c8bcca7423b0f7fec9fa20bea66521aa051d842442432c623d440873d448af07b85914dbdf532e

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\AdobeIPCBrokerCustomHook.exe

Filesize
216KB

MD5
73507dcde40df88d3c4e2452727581d8

SHA1
cc335de683f272a8dddf12ad81d6cb6cb1b7ce7c

SHA256
68532f2af2c5242bc9c7e71a82b50c184fb2303d41b3ed9bbf023afd09835fde

SHA512
86eeaf01184c2f10b769cd9427d625d52f1dfeca995494a905000ca728a9981032512f2f507e20de4cc0cd98737e132dcab5376bf75166c00f8b343a98e40f17

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\CRClient.dll

Filesize
839KB

MD5
08abdf28c00df306cb339fc1324f2f43

SHA1
e54e1a1c009b3f6d94c0a9731ab3a1b54e8d50c6

SHA256
874f47e7f82114b68f443ef80a0188553dcba74356ccc579ffb41ecea606dde8

SHA512
e14e83356dc5f4c741d9479b33abac65dd365865605973c5b10b477bccab89b836bd41677e015c894c81c642ab582bb3f75e85374b44efde0f4acacbbb848027

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\CRClient.dll

Filesize
839KB

MD5
08abdf28c00df306cb339fc1324f2f43

SHA1
e54e1a1c009b3f6d94c0a9731ab3a1b54e8d50c6

SHA256
874f47e7f82114b68f443ef80a0188553dcba74356ccc579ffb41ecea606dde8

SHA512
e14e83356dc5f4c741d9479b33abac65dd365865605973c5b10b477bccab89b836bd41677e015c894c81c642ab582bb3f75e85374b44efde0f4acacbbb848027

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\CRClient.dll

Filesize
839KB

MD5
08abdf28c00df306cb339fc1324f2f43

SHA1
e54e1a1c009b3f6d94c0a9731ab3a1b54e8d50c6

SHA256
874f47e7f82114b68f443ef80a0188553dcba74356ccc579ffb41ecea606dde8

SHA512
e14e83356dc5f4c741d9479b33abac65dd365865605973c5b10b477bccab89b836bd41677e015c894c81c642ab582bb3f75e85374b44efde0f4acacbbb848027

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\CRClient.dll

Filesize
839KB

MD5
08abdf28c00df306cb339fc1324f2f43

SHA1
e54e1a1c009b3f6d94c0a9731ab3a1b54e8d50c6

SHA256
874f47e7f82114b68f443ef80a0188553dcba74356ccc579ffb41ecea606dde8

SHA512
e14e83356dc5f4c741d9479b33abac65dd365865605973c5b10b477bccab89b836bd41677e015c894c81c642ab582bb3f75e85374b44efde0f4acacbbb848027

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\CRClient.dll

Filesize
839KB

MD5
08abdf28c00df306cb339fc1324f2f43

SHA1
e54e1a1c009b3f6d94c0a9731ab3a1b54e8d50c6

SHA256
874f47e7f82114b68f443ef80a0188553dcba74356ccc579ffb41ecea606dde8

SHA512
e14e83356dc5f4c741d9479b33abac65dd365865605973c5b10b477bccab89b836bd41677e015c894c81c642ab582bb3f75e85374b44efde0f4acacbbb848027

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\MSVCP140.dll

Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\StartupOptions.xml

Filesize
1KB

MD5
dcd02122ff75c24cee25500ad3a3d812

SHA1
76e733331554e9aaff6ccf0df22931db9ca852a4

SHA256
059280e2b72f31d15fe6b83b9362be359ebd2f16a5de4763a21d0885183854ba

SHA512
e7fb7605a3d46b302a977b21e14743a5d367ffd50a9ab339108a356894b5d75c7c2693609c9aed84cb8aeaddeb041dc018428ce20f7bc9bbc984b431db58ff21

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\TmEvent.dll

Filesize
196KB

MD5
5766b7a2fd2431d5fd95e7dfe53e9059

SHA1
d59d571b7ea52a1cc08d734794825e19bbb8c5da

SHA256
58e6af41baa0b14777ee3daa03e1ed021e80c8a7b773efebb532b1225bf821b9

SHA512
6ddae690f205b81e58eab38a93c504ff18903bc58e10620f8a8ef2d17a862cded1f6654ffbd8803f1473a265a10b3b1f5ae2b80c39b4542fe428a914f8a5b017

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\TmEvent.dll

Filesize
196KB

MD5
5766b7a2fd2431d5fd95e7dfe53e9059

SHA1
d59d571b7ea52a1cc08d734794825e19bbb8c5da

SHA256
58e6af41baa0b14777ee3daa03e1ed021e80c8a7b773efebb532b1225bf821b9

SHA512
6ddae690f205b81e58eab38a93c504ff18903bc58e10620f8a8ef2d17a862cded1f6654ffbd8803f1473a265a10b3b1f5ae2b80c39b4542fe428a914f8a5b017

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\TmEvent.dll

Filesize
196KB

MD5
5766b7a2fd2431d5fd95e7dfe53e9059

SHA1
d59d571b7ea52a1cc08d734794825e19bbb8c5da

SHA256
58e6af41baa0b14777ee3daa03e1ed021e80c8a7b773efebb532b1225bf821b9

SHA512
6ddae690f205b81e58eab38a93c504ff18903bc58e10620f8a8ef2d17a862cded1f6654ffbd8803f1473a265a10b3b1f5ae2b80c39b4542fe428a914f8a5b017

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\TmEvent.dll

Filesize
196KB

MD5
5766b7a2fd2431d5fd95e7dfe53e9059

SHA1
d59d571b7ea52a1cc08d734794825e19bbb8c5da

SHA256
58e6af41baa0b14777ee3daa03e1ed021e80c8a7b773efebb532b1225bf821b9

SHA512
6ddae690f205b81e58eab38a93c504ff18903bc58e10620f8a8ef2d17a862cded1f6654ffbd8803f1473a265a10b3b1f5ae2b80c39b4542fe428a914f8a5b017

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\TmEvent.dll

Filesize
196KB

MD5
5766b7a2fd2431d5fd95e7dfe53e9059

SHA1
d59d571b7ea52a1cc08d734794825e19bbb8c5da

SHA256
58e6af41baa0b14777ee3daa03e1ed021e80c8a7b773efebb532b1225bf821b9

SHA512
6ddae690f205b81e58eab38a93c504ff18903bc58e10620f8a8ef2d17a862cded1f6654ffbd8803f1473a265a10b3b1f5ae2b80c39b4542fe428a914f8a5b017

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\TmEvent.dll

Filesize
196KB

MD5
5766b7a2fd2431d5fd95e7dfe53e9059

SHA1
d59d571b7ea52a1cc08d734794825e19bbb8c5da

SHA256
58e6af41baa0b14777ee3daa03e1ed021e80c8a7b773efebb532b1225bf821b9

SHA512
6ddae690f205b81e58eab38a93c504ff18903bc58e10620f8a8ef2d17a862cded1f6654ffbd8803f1473a265a10b3b1f5ae2b80c39b4542fe428a914f8a5b017

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\VCRUNTIME140.dll

Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-console-l1-1-0.dll

Filesize
11KB

MD5
f8e89fd609cdafb84e30f133c578c889

SHA1
288542be2a93a58df2a720a8593384847c5e31fa

SHA256
6941f212d635b6be7a3e0df2f0e94f653d30cde504f5036820a489ed9fcd7b29

SHA512
17f55c6d71fc7dc743be07e63a8f31c12beba3bdfcf999fbbcb9c7a374769f7f0bc372c7e4dcc1727eee7a0984c478802adae42f1f93bafc215d59a18a3b6fea

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-console-l1-2-0.dll

Filesize
11KB

MD5
c26d7d913fd245afc0f0d658595447dc

SHA1
b5e00a0516b6c8c6f6a51ea40fae1beba3dd49ba

SHA256
73e4264dd66696163fbbf868729841f2e9b86f5a59912e64fb9718a8c889a7aa

SHA512
f7e22751671ef8f5d9768cb96733377cd5f38cdf241503234f69c4c6ac9348416c1a7622d7008fc1323a8673359db9e0bef29a4fec7853c5b5fe0b94e294471a

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-datetime-l1-1-0.dll

Filesize
10KB

MD5
7435c7831c7b3b47e55701e5c6cca67a

SHA1
8e0fcc170f5d66beea796b38cd544a045375204b

SHA256
7ea1c2902a47fcd4a30180a4fe5ba5800fcad76b63da5ca4494e24954cea9bd3

SHA512
453fde0df6bf8867dac38e1dd155300a4fb3ab88a20de3420f14ce2c05d890459b767671b23d21422c49ff1aebb9ea84b47bee0e2b2305a7af1314393de28267

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-debug-l1-1-0.dll

Filesize
10KB

MD5
95db296ca880a4c9660a5397430f18f1

SHA1
06ee315191597ee938c3cdb3cf0c4955ea1e539b

SHA256
7c46dffc7e70d2ce09cd67afeed97dee59420e070fc87a7cb9997552bf59f441

SHA512
914e9ea3ec02e6dcb7d699dc40b34fc55cef472809e48be6534ec1dec3d52a18ebbd78e9f40024d2e5c687628586552231c8b16889eb49985a8a8196866b4488

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
10KB

MD5
812a7fc799d9487afd81bf6104b715e2

SHA1
74d67d026f192ee7ffc6fabeb176487ebdbffc0e

SHA256
e807ce65dd79c5f11e4e9a2a4e833664de3918360813391abfa772b456fb56ce

SHA512
fcb5c69ceda69ceb72031f126d3682bb57e3c76f58f838d80d053fd10cb112095904745f0462167877dfbf3088b19bf081a101f5484f29d22f63614972a660ff

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-file-l1-1-0.dll

Filesize
14KB

MD5
e4749e7725c8642cc04cc2467574b40e

SHA1
4d8c7f70f057fb9b13a699efbbc9f0d6842914df

SHA256
7f5d3997a4de8468290e82bd54b25ea9f3897d59829fc662fb1af54c5b12a6c1

SHA512
ef2312a7876b35b59f36fcd402a9acb368ef0c6f20407c43d6424fe614b012d25097d1e1b8349ed7606967a845e8f4db5c6e3d0ff4cf7bb03b0194edd9220b39

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-file-l1-2-0.dll

Filesize
11KB

MD5
75614f411dec3bff7a4c3443fb06eebe

SHA1
bb77b493f3329284437f2173e5031908f080d68f

SHA256
196c741e12fe57d9fd3c274af8a93d95e148ac91ada451b31b78923bcea77b17

SHA512
f03b71cee885140edc53463132e1d736978ebb0c5e76f2db8c1f7cfd61afa1bf925109f2721cc796ffad4619ca69605c37db496d444c9d34616de5f95c7c9623

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-file-l2-1-0.dll

Filesize
11KB

MD5
f90b9300d778472a7618dbffb1dbb582

SHA1
69c23b7891d8178c230768eff6378c3a8df1d63c

SHA256
ec8b6f39c0d5aaef685fd46d8cc865f48b52dd6eb391c4df6400fd7804f607f7

SHA512
38d5d5f8bd77411dc1bf525cd2434aab1256d0bbf319ef29e888700b9417366e601e8e2e142d5ef4bfab4084546b38904c426d13c77283a8c3b6c89ba3691c0a

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-handle-l1-1-0.dll

Filesize
10KB

MD5
d65ef6902015757c4b5e2b550c233e1d

SHA1
8b3a44beceb81727071337a9c9e7d0f3b1370455

SHA256
9f2c87a8f541fd2e563778208c51f1e1852d4874571b6c5218066c0d58f9539c

SHA512
01dc60cf2d8f902848a4234cb97b12329d813f836786407ee090083a9fa6750df7f6b4db6d3496a873fc352bba4edf109ea6d5811d124075d8f3d21008c96773

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-heap-l1-1-0.dll

Filesize
11KB

MD5
8af9779906d36b71166a1e286c880d0d

SHA1
deb18c79ab7def1f7ce1b22f90d21b3f6c5d8ef3

SHA256
2e9a683aa69db2f8186ce9ac3e6a610fc727390155668b2680a728a6e6c67247

SHA512
c9927edc959272747aad42f9d243119fba2d126ac7e0463b59847e3738fe62fe58c01f666791d66177949e61b6bf36da67d558475382aa71a236794137186e96

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
11KB

MD5
2f68cbb35c4c8e66c7d1a8b6c2079700

SHA1
2acb3bdfb7209323d586866e276e152d540d5ae3

SHA256
96509b560bc604a30af26e08d6181d24dde1d51bf3654a12cd663a4ba1a11eac

SHA512
d5886e85abb2b2b4dd0d632e56d7f056f58374b774769bc83dc84f734827fc87b91d85f609f6faae3e3c10703716b31d775ca7f5819a1f719a355a154a8cc1ec

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-kernel32-legacy-l1-1-0.dll

Filesize
21KB

MD5
cc6a9051787a58574bd551f3f28141de

SHA1
3ebafab90362333fb2562cb0187ce9cd4f789eb2

SHA256
33c303af3479bade024c474a6796c58f28c16f047323b3609d22eb10089067b6

SHA512
d061811d8572f723e3c6e56ef433dc4998c4738d21da654c8836dc03addb32119120d023e4124226c38c0d9eca5a7fdcfa1ed5d6096dc0ea687e9a6c536aeff4

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
11KB

MD5
da1f9d198c61b18762187efac599b260

SHA1
73242d9fd34b677b0435dfc94eb06b085dfdbd02

SHA256
e7013dd5fb9f267d0efbd39a56eb48351b1bf13cc76bc52a5197d342c9c6507c

SHA512
fc60a9b5321e715db1d16631f7750ca14c1a4be9d754f257d049745680fd6670c9ddcfde82f91ee4db8b9d8346174031ec4908afc81c81a2a8013059682ab853

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-localization-l1-2-0.dll

Filesize
14KB

MD5
a5ef3ecb8ece8f31bfe429316281d64b

SHA1
13b0679242a262ecbda857b163c7db5a4b473c5b

SHA256
8678396666040b289999e82d1a0bb2175a6b5543922f05394252f7b3e986d0e7

SHA512
6f8da1d0c0122c10051a699cd77c1a21864ab14ba1cd485bd6d4c041e45591024254e642d0ae6310a9e1d1ad32e77183a62dab9dfc8ff050cce9e96d398e7ec2

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-memory-l1-1-0.dll

Filesize
11KB

MD5
f8e89fd609cdafb84e30f133c578c889

SHA1
288542be2a93a58df2a720a8593384847c5e31fa

SHA256
6941f212d635b6be7a3e0df2f0e94f653d30cde504f5036820a489ed9fcd7b29

SHA512
17f55c6d71fc7dc743be07e63a8f31c12beba3bdfcf999fbbcb9c7a374769f7f0bc372c7e4dcc1727eee7a0984c478802adae42f1f93bafc215d59a18a3b6fea

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
10KB

MD5
d8873df4158c5d449f13fd32442f10f5

SHA1
52c9bf4137e466124eab9aa639671795d05125f1

SHA256
04532aed545a391a9e95d6103a816ec5d26df14af51f51dd0c649ddd57862e5c

SHA512
e52876ca557755f50bdd3f9adf124a6a562798a725480238f747348c9f81539903f8a19eeb00a61e50f5fde6e7acc8e613b4ba94cc0d8facc2a91f98078997d3

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
11KB

MD5
da1f9d198c61b18762187efac599b260

SHA1
73242d9fd34b677b0435dfc94eb06b085dfdbd02

SHA256
e7013dd5fb9f267d0efbd39a56eb48351b1bf13cc76bc52a5197d342c9c6507c

SHA512
fc60a9b5321e715db1d16631f7750ca14c1a4be9d754f257d049745680fd6670c9ddcfde82f91ee4db8b9d8346174031ec4908afc81c81a2a8013059682ab853

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
13KB

MD5
62d6745eaae6d83b69dfc04ad2d9cdd9

SHA1
c2f9bd4c51538c260297ebe251b7d115be504931

SHA256
4456fa6d5a415b66cbfd7ca461fe91d831d64357c56845b631cd996af3a6cb46

SHA512
9f8c1195d04d5a5e1d225e1254e7d34613d3e00ad4b53614f3c01e172147d86a98df65c49057ea519c84d008fb6ff8f2bcb910217727a2a79792aa921dc37d9e

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
11KB

MD5
d3879924c7ad13aea1da8da80009270e

SHA1
bda01a29b475b95a238763bcf3526b466dce77ef

SHA256
1924df08cef53857ee2270e44e579ea9992be7afea75ebbbadfc5d4d87d1981c

SHA512
ec7c64594bc83b21500f7e4a1bb0d918a9706d709941a7a92f948b05d1599b700065b73c7ad6da96ba62f5c980f0252392c32b292214685d79fb50019101607c

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-profile-l1-1-0.dll

Filesize
10KB

MD5
ffde79c6632c92cee6768eeae7beaf0f

SHA1
2e44223f3d9fbdb821404a63e883ae95f7c8a1cb

SHA256
2c977e27d3638fe65aca9e93912320946809565cf12fd2663cf66d4a339e5893

SHA512
ba39e33b6a8926ce53d56dd4a345296e39e931426312a58b4ba529a4cde3d71c73abe154ab547a936e59aa4e58ad6186671042dca05d325b0b2ff1a54f531be3

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
10KB

MD5
83cad14da9e92a8baf84a9afe2c9a5b0

SHA1
14c89f2ade657eb9249b95f9290fb4284908c9c6

SHA256
a45a7143971e7f8bbe4d5667927e3ba0fe5d0c025ef5d776ff8a5826341a99cf

SHA512
a5e93d77555e65bff5d47b2d6e9f7668cc6353a815cb1b11eaa6910594d53a9a2a538b8fe6b89cc2589f0dee321215039c012637809fc513b39fb902c02fdb4d

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-string-l1-1-0.dll

Filesize
10KB

MD5
0feee6ff4ca2cc72ceaf2a051bb88837

SHA1
a4e855e9a89da8e423925d2376d92185f18ca1d7

SHA256
02f4bea05fc57e22df3f9d76e53ba545bd777c6acd4cb435599490df094261b7

SHA512
142fdd21e045ceca177027d08233c0b6d15a456fbd7a7fad0a26acaeeb835d64eaf7f8ad1b7c26c738bcaa8cc258dfb8ed41e7188b6f04be8bfc2a9f921c5879

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-synch-l1-1-0.dll

Filesize
12KB

MD5
83765785fda6c25256332f13a5f8ab1b

SHA1
fd42939483dd6990dcc28e7f60775fb79aa43f3b

SHA256
1c1c8ea262dee6da75b2532db3e7afa7a6150493900b11d89b0940bd8a4d4f18

SHA512
8201340bf2ede73364ef7f77daec891e30f16e027c9589de0dbf239bf5715cf9d7518bf0dc99a4e858ca1b938bfc9683954a6a23cb2e2e6e4eb7e5cb7eb448c7

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-synch-l1-2-0.dll

Filesize
11KB

MD5
d3edadb5e0ab93a314a2a1212e8fdcd8

SHA1
d280832da49c5c171b4bd4296c1be89b95776905

SHA256
51fbf7342b599da1dc7bc5b6bb3f885939ff0d2d782b93d62d611e14e38829f6

SHA512
7de540638933c6ca980ee3a56594924fa31932f88024229eb6ebe02825b99ccbf464b3f8c4a3bfbc7ade81145593ace954624c692745ba57701c303396b673b0

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
11KB

MD5
da1f9d198c61b18762187efac599b260

SHA1
73242d9fd34b677b0435dfc94eb06b085dfdbd02

SHA256
e7013dd5fb9f267d0efbd39a56eb48351b1bf13cc76bc52a5197d342c9c6507c

SHA512
fc60a9b5321e715db1d16631f7750ca14c1a4be9d754f257d049745680fd6670c9ddcfde82f91ee4db8b9d8346174031ec4908afc81c81a2a8013059682ab853

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-sysinfo-l1-2-0.dll

Filesize
3KB

MD5
d02f8c0952c2605ea64f43dd3f1cfe93

SHA1
6f2e04ee14176e009759975c0c292c8cb275ffae

SHA256
7ae6c9db669f8496ab365dc54a99b47e6e598d6a7e65f0e58c9f763febe4e0bf

SHA512
a2407a8596d9f4e5c4270958c888220c2ca25c9680bcfedc4726a37ec815af103ecf4a8eea9cd49254544ba7606a8d8ba1e057406cc4576f1b64e5f383879a6f

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-timezone-l1-1-0.dll

Filesize
11KB

MD5
da1f9d198c61b18762187efac599b260

SHA1
73242d9fd34b677b0435dfc94eb06b085dfdbd02

SHA256
e7013dd5fb9f267d0efbd39a56eb48351b1bf13cc76bc52a5197d342c9c6507c

SHA512
fc60a9b5321e715db1d16631f7750ca14c1a4be9d754f257d049745680fd6670c9ddcfde82f91ee4db8b9d8346174031ec4908afc81c81a2a8013059682ab853

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\api-ms-win-core-util-l1-1-0.dll

Filesize
10KB

MD5
0feee6ff4ca2cc72ceaf2a051bb88837

SHA1
a4e855e9a89da8e423925d2376d92185f18ca1d7

SHA256
02f4bea05fc57e22df3f9d76e53ba545bd777c6acd4cb435599490df094261b7

SHA512
142fdd21e045ceca177027d08233c0b6d15a456fbd7a7fad0a26acaeeb835d64eaf7f8ad1b7c26c738bcaa8cc258dfb8ed41e7188b6f04be8bfc2a9f921c5879

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\ground

Filesize
393KB

MD5
996c12ac07c7955fe018b68ac29ff8fb

SHA1
a88d9543aaa0f748a1997162b0e7e67249ba7cfa

SHA256
94f19678077f95de2f8200fa32dbc538cd8ec839a0513741613e35a86a2ad3e2

SHA512
8271c0aa844b4b5598690bb44012d3597edb347c3e171835a340d66d5874f5e6bd2d76fda0e62b0e28967fcb479e227d95d67d120ab4977ea1e029890dd1cf21

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\libcui40.dll

Filesize
125KB

MD5
a43453dc3f04860653ff23db54f91f0d

SHA1
17877adc35e03eb2e7f7a90281a97067a839b70d

SHA256
55135de67a5816c6622ae671c934d5a2bfac1b8f3f09083f64a3ae5997bfbfdf

SHA512
8b97417f00175408eaf348cd2315f954609b98434337c2d822b9e0f11d2d249c584ef8e58fc33ffbd107ef56581964735a62801096779a9f43899e69fd8d9a66

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\libcui40.dll

Filesize
125KB

MD5
a43453dc3f04860653ff23db54f91f0d

SHA1
17877adc35e03eb2e7f7a90281a97067a839b70d

SHA256
55135de67a5816c6622ae671c934d5a2bfac1b8f3f09083f64a3ae5997bfbfdf

SHA512
8b97417f00175408eaf348cd2315f954609b98434337c2d822b9e0f11d2d249c584ef8e58fc33ffbd107ef56581964735a62801096779a9f43899e69fd8d9a66

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\libcui40.dll

Filesize
125KB

MD5
a43453dc3f04860653ff23db54f91f0d

SHA1
17877adc35e03eb2e7f7a90281a97067a839b70d

SHA256
55135de67a5816c6622ae671c934d5a2bfac1b8f3f09083f64a3ae5997bfbfdf

SHA512
8b97417f00175408eaf348cd2315f954609b98434337c2d822b9e0f11d2d249c584ef8e58fc33ffbd107ef56581964735a62801096779a9f43899e69fd8d9a66

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\libcui40.dll

Filesize
125KB

MD5
a43453dc3f04860653ff23db54f91f0d

SHA1
17877adc35e03eb2e7f7a90281a97067a839b70d

SHA256
55135de67a5816c6622ae671c934d5a2bfac1b8f3f09083f64a3ae5997bfbfdf

SHA512
8b97417f00175408eaf348cd2315f954609b98434337c2d822b9e0f11d2d249c584ef8e58fc33ffbd107ef56581964735a62801096779a9f43899e69fd8d9a66

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\libcui40.dll

Filesize
125KB

MD5
a43453dc3f04860653ff23db54f91f0d

SHA1
17877adc35e03eb2e7f7a90281a97067a839b70d

SHA256
55135de67a5816c6622ae671c934d5a2bfac1b8f3f09083f64a3ae5997bfbfdf

SHA512
8b97417f00175408eaf348cd2315f954609b98434337c2d822b9e0f11d2d249c584ef8e58fc33ffbd107ef56581964735a62801096779a9f43899e69fd8d9a66

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\msvcp140.dll

Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\msvcp140.dll

Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\msvcp140.dll

Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\msvcp140.dll

Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\vcruntime140.dll

Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\vcruntime140.dll

Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\vcruntime140.dll

Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\Users\Admin\AppData\Roaming\GreatSim\Milling\vcruntime140.dll

Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
memory/1900-183-0x0000000002CF0000-0x0000000005EF0000-memory.dmp

Filesize
50.0MB

Download
memory/2244-180-0x0000000003330000-0x0000000006530000-memory.dmp

Filesize
50.0MB

Download
memory/2244-147-0x0000000002CF0000-0x0000000002D03000-memory.dmp

Filesize
76KB

Download
memory/3480-186-0x0000000002C50000-0x0000000005E50000-memory.dmp

Filesize
50.0MB

Download
memory/3480-175-0x0000000002720000-0x0000000002733000-memory.dmp

Filesize
76KB

Download
memory/4704-182-0x0000000002C90000-0x0000000005E90000-memory.dmp

Filesize
50.0MB

Download