50e54a92cfb093572af8564810a98cdd8ce3c582a187acf8c641f0447590c9ba

Analysis

max time kernel
161s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

metafather-1.020.exe
Size

220.4MB
MD5

6cfc4a3300cd619de726ba040f9d3343
SHA1

5ebc84d0469e4d6685a4491c6189ca5b68bb3eff
SHA256

50e54a92cfb093572af8564810a98cdd8ce3c582a187acf8c641f0447590c9ba
SHA512

6a00a3583903f44ad99aade1ee22edd1e1a25ee62c1774bba324b5137c3e83c19e42d7a37dd4e8b6abeb9e0801502864ddf9c586b944c04b613487a78e51eabf
SSDEEP

3145728:vCcGnx6fyYOdU9ju9d/UnaM92qqo1xhxk7Sy0Hn/ytNN8p6rpzA0bdjyJdb+:a3nkfadUIXUIqqo1vWOHnaNNRhXbd+JA

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	metafather.exe

Executes dropped EXE 54 IoCs

pid	Process
216	metafather-1.020.tmp
1984	metafather.exe
1924	metafatheradb.exe
4016	metafathernginx.exe
1340	metafathernginx.exe
4164	metafatheripfs.exe
2508	metafatheradb.exe
2020	metafatheradb.exe
4940	metafatheradb.exe
1048	metafatheradb.exe
1784	metafatheradb.exe
3504	metafatheradb.exe
4012	metafatheradb.exe
692	metafatheradb.exe
2664	metafatheradb.exe
2520	metafatheradb.exe
2700	metafatheradb.exe
3940	metafatheradb.exe
4876	metafatheradb.exe
4884	metafatheradb.exe
2200	metafatheradb.exe
1096	metafatheradb.exe
1544	metafatheradb.exe
1936	metafatheradb.exe
4520	metafatheradb.exe
4628	metafatheradb.exe
2408	metafatheradb.exe
4396	metafatheradb.exe
3192	metafatheradb.exe
2156	metafatheradb.exe
3940	metafatheradb.exe
1604	metafatheradb.exe
552	metafatheradb.exe
3256	metafatheradb.exe
4460	metafatheradb.exe
448	metafatheradb.exe
3728	metafatheradb.exe
4856	metafatheradb.exe
4132	metafatheradb.exe
3240	metafatheradb.exe
3052	metafatheradb.exe
688	metafatheradb.exe
1456	metafatheradb.exe
4188	metafatheradb.exe
1176	metafatheradb.exe
2500	metafatheradb.exe
1796	metafatheradb.exe
4848	metafatheradb.exe
3348	metafatheradb.exe
4448	metafatheradb.exe
2428	metafatheradb.exe
2640	metafatheradb.exe
2044	metafatheradb.exe
3292	metafatheradb.exe

Loads dropped DLL 64 IoCs

pid	Process
216	metafather-1.020.tmp
216	metafather-1.020.tmp
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1924	metafatheradb.exe
1924	metafatheradb.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
2508	metafatheradb.exe
2508	metafatheradb.exe
2020	metafatheradb.exe
2020	metafatheradb.exe
4940	metafatheradb.exe
4940	metafatheradb.exe
1048	metafatheradb.exe
1048	metafatheradb.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2496	tasklist.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
3572	taskkill.exe
2708	taskkill.exe

Modifies registry class 55 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	metafather.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	metafather.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\metafather\DefaultIcon\ = "C:\\metafather\\metafather.exe"	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\mft\	metafather.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	metafather.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	metafather.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\metafather\shell	metafather.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\metafather\shell\open\command\	metafather.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\mft\shell\open\command\ = "\"C:\\metafather\\metafather.exe\" \"%1\""	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	metafather.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\metafather\URL Protocol	metafather.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\mft\DefaultIcon\ = "C:\\metafather\\metafather.exe"	metafather.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	metafather.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	metafather.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	metafather.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\mft\DefaultIcon\	metafather.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	metafather.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	metafather.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\mft	metafather.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\mft\URL Protocol	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\mft\shell	metafather.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	metafather.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	metafather.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\metafather\shell\open\command	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\metafather\DefaultIcon\	metafather.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	metafather.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\mft\ = "URL: MetaFather Protocol"	metafather.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\mft\shell\open\command	metafather.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\mft\shell\open\command\	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\mft\shell\open	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	metafather.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\metafather\shell\open	metafather.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\metafather\shell\open\command\ = "\"C:\\metafather\\metafather.exe\" \"%1\""	metafather.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	metafather.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\metafather	metafather.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\metafather\	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	metafather.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	metafather.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\metafather\ = "URL: MetaFather Protocol"	metafather.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	metafather.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f53000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c7f000000010000000c000000300a06082b060105050703097e000000010000000800000000c001b39667d601030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	metafather.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae4747e000000010000000800000000c001b39667d6017f000000010000000c000000300a06082b060105050703091d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb0b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	metafather.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f53000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c7f000000010000000c000000300a06082b060105050703097e000000010000000800000000c001b39667d601030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	metafather.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 5c000000010000000400000000080000040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae4747e000000010000000800000000c001b39667d6017f000000010000000c000000300a06082b060105050703091d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb0b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f19000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	metafather.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1984	metafather.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
216	metafather-1.020.tmp
216	metafather-1.020.tmp
216	metafather-1.020.tmp
216	metafather-1.020.tmp
216	metafather-1.020.tmp
216	metafather-1.020.tmp
216	metafather-1.020.tmp
216	metafather-1.020.tmp
216	metafather-1.020.tmp
216	metafather-1.020.tmp
216	metafather-1.020.tmp
216	metafather-1.020.tmp
1984	metafather.exe
1984	metafather.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1984	metafather.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2708	taskkill.exe
Token: SeDebugPrivilege	3572	taskkill.exe
Token: SeDebugPrivilege	2496	tasklist.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
216	metafather-1.020.tmp
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe

Suspicious use of SetWindowsHookEx 61 IoCs

pid	Process
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe
1984	metafather.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 216	4604	metafather-1.020.exe	85
PID 4604 wrote to memory of 216	4604	metafather-1.020.exe	85
PID 4604 wrote to memory of 216	4604	metafather-1.020.exe	85
PID 216 wrote to memory of 1984	216	metafather-1.020.tmp	94
PID 216 wrote to memory of 1984	216	metafather-1.020.tmp	94
PID 1984 wrote to memory of 2520	1984	metafather.exe	97
PID 1984 wrote to memory of 2520	1984	metafather.exe	97
PID 2520 wrote to memory of 1924	2520	cmd.exe	99
PID 2520 wrote to memory of 1924	2520	cmd.exe	99
PID 2520 wrote to memory of 1924	2520	cmd.exe	99
PID 1984 wrote to memory of 1288	1984	metafather.exe	100
PID 1984 wrote to memory of 1288	1984	metafather.exe	100
PID 1288 wrote to memory of 2708	1288	cmd.exe	102
PID 1288 wrote to memory of 2708	1288	cmd.exe	102
PID 1288 wrote to memory of 4016	1288	cmd.exe	103
PID 1288 wrote to memory of 4016	1288	cmd.exe	103
PID 1288 wrote to memory of 4016	1288	cmd.exe	103
PID 4016 wrote to memory of 1340	4016	metafathernginx.exe	104
PID 4016 wrote to memory of 1340	4016	metafathernginx.exe	104
PID 4016 wrote to memory of 1340	4016	metafathernginx.exe	104
PID 1984 wrote to memory of 2996	1984	metafather.exe	106
PID 1984 wrote to memory of 2996	1984	metafather.exe	106
PID 2996 wrote to memory of 3572	2996	cmd.exe	108
PID 2996 wrote to memory of 3572	2996	cmd.exe	108
PID 2996 wrote to memory of 4164	2996	cmd.exe	109
PID 2996 wrote to memory of 4164	2996	cmd.exe	109
PID 1984 wrote to memory of 2496	1984	metafather.exe	110
PID 1984 wrote to memory of 2496	1984	metafather.exe	110
PID 1984 wrote to memory of 692	1984	metafather.exe	112
PID 1984 wrote to memory of 692	1984	metafather.exe	112
PID 692 wrote to memory of 2508	692	cmd.exe	114
PID 692 wrote to memory of 2508	692	cmd.exe	114
PID 692 wrote to memory of 2508	692	cmd.exe	114
PID 2508 wrote to memory of 2020	2508	metafatheradb.exe	115
PID 2508 wrote to memory of 2020	2508	metafatheradb.exe	115
PID 2508 wrote to memory of 2020	2508	metafatheradb.exe	115
PID 1984 wrote to memory of 4404	1984	metafather.exe	116
PID 1984 wrote to memory of 4404	1984	metafather.exe	116
PID 4404 wrote to memory of 4940	4404	cmd.exe	118
PID 4404 wrote to memory of 4940	4404	cmd.exe	118
PID 4404 wrote to memory of 4940	4404	cmd.exe	118
PID 1984 wrote to memory of 1240	1984	metafather.exe	119
PID 1984 wrote to memory of 1240	1984	metafather.exe	119
PID 1240 wrote to memory of 1048	1240	cmd.exe	121
PID 1240 wrote to memory of 1048	1240	cmd.exe	121
PID 1240 wrote to memory of 1048	1240	cmd.exe	121
PID 1984 wrote to memory of 1712	1984	metafather.exe	122
PID 1984 wrote to memory of 1712	1984	metafather.exe	122
PID 1712 wrote to memory of 1784	1712	cmd.exe	124
PID 1712 wrote to memory of 1784	1712	cmd.exe	124
PID 1712 wrote to memory of 1784	1712	cmd.exe	124
PID 1984 wrote to memory of 4176	1984	metafather.exe	125
PID 1984 wrote to memory of 4176	1984	metafather.exe	125
PID 4176 wrote to memory of 3504	4176	cmd.exe	127
PID 4176 wrote to memory of 3504	4176	cmd.exe	127
PID 4176 wrote to memory of 3504	4176	cmd.exe	127
PID 1984 wrote to memory of 3572	1984	metafather.exe	128
PID 1984 wrote to memory of 3572	1984	metafather.exe	128
PID 3572 wrote to memory of 4012	3572	cmd.exe	130
PID 3572 wrote to memory of 4012	3572	cmd.exe	130
PID 3572 wrote to memory of 4012	3572	cmd.exe	130
PID 1984 wrote to memory of 3588	1984	metafather.exe	131
PID 1984 wrote to memory of 3588	1984	metafather.exe	131
PID 3588 wrote to memory of 692	3588	cmd.exe	133

C:\Users\Admin\AppData\Local\Temp\metafather-1.020.exe
"C:\Users\Admin\AppData\Local\Temp\metafather-1.020.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Users\Admin\AppData\Local\Temp\is-FTAAG.tmp\metafather-1.020.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FTAAG.tmp\metafather-1.020.tmp" /SL5="$40210,229967529,900096,C:\Users\Admin\AppData\Local\Temp\metafather-1.020.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:216
- - \??\c:\metafather\metafather.exe
    "c:\metafather\metafather.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Modifies system certificate store
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2520
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1924
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c taskkill /F /IM metafathernginx.exe & metafathernginx.exe -c conf/nginx.conf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1288
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM metafathernginx.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
    - - C:\metafather\windows\webcache\metafathernginx.exe
        
        metafathernginx.exe -c conf/nginx.conf
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4016
      - C:\metafather\windows\webcache\metafathernginx.exe
        
        metafathernginx.exe -c conf/nginx.conf
        6⤵
        Executes dropped EXE
        
        PID:1340
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c taskkill /F /IM metafatheripfs.exe & set IPFS_PATH=C:/mftdata/ipfs & metafatheripfs.exe init
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2996
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM metafatheripfs.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3572
    - - C:\metafather\windows\platform-tools\metafatheripfs.exe
        
        metafatheripfs.exe init
        5⤵
        Executes dropped EXE
        
        PID:4164
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /NH /FO CSV /FI "IMAGENAME eq SideQuest.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2496
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:692
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2508
      - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        adb -L tcp:5137 fork-server server --reply-fd 564
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2020
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4404
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4940
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1240
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1048
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1712
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:1784
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4176
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:3504
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3572
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:4012
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3588
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:692
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:4524
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:2664
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:4188
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:2520
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:4568
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:2700
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:1660
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:3940
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:3348
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:4876
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:2748
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:4884
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:3924
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:2200
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:4400
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:1096
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:4000
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:1544
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:2832
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:1936
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:4284
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:4520
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:4620
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:4628
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:4044
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:2408
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:1924
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:4396
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:2296
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:3192
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:3124
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:2156
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:1188
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:3940
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:4940
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:1604
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:4876
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:552
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:4472
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:3256
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:4652
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:4460
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:3332
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:448
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:4668
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:3728
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:1412
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:4856
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:4924
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:4132
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:4432
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:3240
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:4496
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:3052
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:4048
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:688
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:4628
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:1456
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:2484
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:4188
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:3108
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:1176
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:444
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:2500
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:2600
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:1796
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:2628
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:4848
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:4540
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:3348
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:4084
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:4448
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:1240
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:2428
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:1856
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:2640
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5037 kill-server" 2>&1
      4⤵
      PID:448
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5037 kill-server
        5⤵
        Executes dropped EXE
        
        PID:2044
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "metafatheradb -P 5137 devices -l" 2>&1
      4⤵
      PID:3016
    - - C:\metafather\windows\platform-tools\metafatheradb.exe
        
        metafatheradb -P 5137 devices -l
        5⤵
        Executes dropped EXE
        
        PID:3292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-FTAAG.tmp\metafather-1.020.tmp

Filesize
3.1MB

MD5
7c76edea96cef7de0435020412d934ce

SHA1
79809689e68df8ce7c20a747dc701ec04650618f

SHA256
2423ff4c086a0c2fd1fe7f5d76f61027b4c9c21cde98e0ac346d24ecc25d2f31

SHA512
d61db1dee5c33b4cf1b375f3af82e9f06320c17cf512011a5f22ac727c1ed961fb0806d9de25d063d9ee7876ae10a5d58256f269121071ad755178323951cd7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-K1DJ6.tmp\istask.dll

Filesize
66KB

MD5
86a1311d51c00b278cb7f27796ea442e

SHA1
ac08ac9d08f8f5380e2a9a65f4117862aa861a19

SHA256
e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d

SHA512
129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec

Download Submit
C:\metafather\Qt6Core.dll

Filesize
6.0MB

MD5
bb0a7ab5c0a3286b9b2a13faca526037

SHA1
a5a8b6ae4e5c5171a63e8884aa049543c0af7917

SHA256
665eeb97b9cff1fa96df7d255c94a8ad52282eef8f7b7449940fb943b6a5cf70

SHA512
3d540903f212fe2a903cb117daf1feec1606cb725d85657674cd657e727c7033b2c8f1bed1a8878751b2a855a7068323704cc69ea4997ff396fa0b7af0ba0721

Download Submit
C:\metafather\Qt6Core5Compat.dll

Filesize
851KB

MD5
8cfc6627fb65256305f32faf84c95d00

SHA1
7208d1c02c63da772a52e18ebda823cfef54803a

SHA256
c3d1f4338a54697fa887d2b3b38c2d8482cfb86b32b87fa7fb8915183b6670ba

SHA512
ae9fb66291a4476bba1412f55ec81d43e227075d31b71b30048b1fcba0a76d49b94d2f7d05c551838596fd5b1743cc8ab8a05a6d518850cf79d504cf424939d5

Download Submit
C:\metafather\Qt6Gui.dll

Filesize
8.5MB

MD5
a1692e286dceccf67145ee0a62214575

SHA1
72c741e5bd313f49dfcb4770ed66a55ac068f8e5

SHA256
4fa9896553089e22e011414db3b9abe74d83f4cde947732e74c103d3a039b9a6

SHA512
89ddb5f97ec1bf9b6e3a33866d767cf4337ae9dd498892ebff84df6cb65cf3d734352d0eddc317931865d9ddec27303900a0de0b85f4172d6ab992378bd343ae

Download Submit
C:\metafather\Qt6Network.dll

Filesize
1.4MB

MD5
ef5fef77c4b751c549bd801694283381

SHA1
0ac36e09ab6596e81a13fc222535362e21aac267

SHA256
44dd991d5bf2d9036e15016354a14c01a9095661f01fdf5a903742172d1ecadf

SHA512
f7071b38965d6b0b89702811b881598d46d12d2517352499ed3e5df04c577d95c564367f709f94e3f630180b894fa89c3cb03d39d331f983653cbbde209c448b

Download Submit
C:\metafather\Qt6OpenGL.dll

Filesize
1.9MB

MD5
288f11a8f6537f32480355d53077fbc8

SHA1
cf2f75a24715eeee6228c6646d5b57a844f85f6b

SHA256
cdd0a4d609577c5469f37de83a495d18f441908608e2a88b2a122905bb1dae94

SHA512
09d72550c181127f4a3ca55a11e2bb8ef7505ffb57ed49af28eeda0c465358d8cc0bcaaf27871d31cb4fa4975997ecd9454987bc734df3a6699997942288da65

Download Submit
C:\metafather\Qt6Qml.dll

Filesize
4.8MB

MD5
0429ae1376d99c4cfcdf4f0df9c9db33

SHA1
8a293925335880d81d6f9a9e418dded209571b62

SHA256
6485c5eaaccf33d00a4ebf3cd960c951436ec4effabe3bee469e371210bef8c8

SHA512
a7dea8a8cf5d60daf95d628683587b23f0b4fecaa707a153439df4e53cdad7011012a913740cf3c5604520ecb2fa833f7c4ca387ab8c412d69e375a0185f02cc

Download Submit
C:\metafather\Qt6QmlModels.dll

Filesize
708KB

MD5
98edf66190ccc59fe9a8c2182f2fa618

SHA1
6e82f4897f2c5345cf0bfd662095128d7ab9379d

SHA256
10728e5866635979d12f537ce670ce68a225db516cba9150e1d5137b18366c06

SHA512
126ad3669d6e5e3e4e87047c3be1714a2cf2e6a9d14d05d436c4360877cf83bc96dbed593dbc74db1fe418e157e3f12a38da147aec12881c6ab39573ffe4460b

Download Submit
C:\metafather\Qt6Quick.dll

Filesize
5.2MB

MD5
e5f1231f6d2a72c3bb695c810b7d1450

SHA1
a5664192426158e55a7ca8fdcf08ba08f9c9bb75

SHA256
69bd00402ac1938f675f30755233b76c77bc05c4dfb017d8a9a6508e576027c3

SHA512
f233c58dc608939f0bc02b3b7abb141830ebba2d7372c3f7fc03acfc9696dc47f2b05bf0dfd8eb17c37d7918aa1a45458266d8be7d9bc884b298ccc738353604

Download Submit
C:\metafather\Qt6Svg.dll

Filesize
373KB

MD5
fd56ee63bc4a68324ccd2a9299e8cb4a

SHA1
ea6f3512743540613c32ffde26c6dc97f38387f1

SHA256
bcc96b7b74ebfa66ac9cee501d3493ea2e36ef8378547fd29557e9e0e054d6f8

SHA512
e6550d7b764cbdad2d90f0fefe0cef4e4e2e72f8350cd8dd3550cd7c4b82374fa20ac563fb34862e2ebf0345ab2689e9faf4b4227484d673d9338dceefc54d73

Download Submit
C:\metafather\Qt6Widgets.dll

Filesize
6.2MB

MD5
31443ac72b363e87d2ae19c991e59f7e

SHA1
0200757254b386a68fbd5230c135e12082053f4f

SHA256
97c5e9bcd1fb9433bc08adfb4d41fece51f451cbf1dcdefde31ddea7767c08a6

SHA512
9903099ea7366b997d537cc6af9867c166286d8ee909d3fbd900f5b183abeeab195d939cdb088b1940574bb2db90ba1a3dc19ff94468f9ad139829f195c1b435

Download Submit
C:\metafather\QtQuick3D\Helpers\designer\images\is-08ENS.tmp

Filesize
375B

MD5
762ab24b219270dc7ee7183da2f1ef79

SHA1
de4b6ccb4d5b6743903e91915d8ff00e52f1336a

SHA256
fbc370c541a931e22eeba5157b47f30fc60c7e29580b9b4904703b6e17910bf3

SHA512
c11bae321fe32044d8c7f05590bf30f15585283c0a95ea2a2eac63e3e493bd3386354de050df13b554b197cceebe03069b523286fd3297d16cc0a27072cdc031

Download Submit
C:\metafather\QtQuick3D\Helpers\designer\images\is-JRP2S.tmp

Filesize
253B

MD5
bbff95cfc3d26e011d4cd5b6a978625b

SHA1
6e2c4e01dcc78e1210ec39a236ccb4388a71cd5f

SHA256
20367abdb3621f0bbbe473dc2c16708318303c600356dd3a53c9465c8a694e22

SHA512
7378c69a5c23a36226c9f82aa2ef7cb693868425989a1baced24b73830917e354949af640b7b5aef82124902275debfba1d8fd46a2767c71189dfc935bcfc738

Download Submit
C:\metafather\QtQuick3D\Helpers\designer\images\is-JTUG1.tmp

Filesize
499B

MD5
73dd25fb185b415c0590f122bf05cf7b

SHA1
0d268a5bfeaacb8744a9b372409caeb6f1039653

SHA256
ac0ced9846290510f32ffb115d29e5329442fec01b6527a863ebf541ca8c8ed5

SHA512
7c3d69594d8d73414f3ea35443a7417fe75fed45a0ac6d07f29bebccc119375d6c50a7ca78fc0a349304ce21f71847098e7c83ba9a8b624729ca6bc4e986faad

Download Submit
C:\metafather\QtQuick\Controls\Basic\is-BQQ5J.tmp

Filesize
1KB

MD5
4d71c90a08a4d3a18dc0b35767f7af4a

SHA1
fde837f2a83aae89802add2b8ab1794a6365f1b2

SHA256
1e8b6ac222f9b63a397b410f3a0c81ed67144a2f73ec00e12ecbc433ea76205e

SHA512
8771e39c25ec839addeaabab634c5f59ab31ef313facb0a5d17f168227e40250e9bae62989732238b0723bf9f71f0efca3eaa54a197cc465641736b65969e897

Download Submit
C:\metafather\QtQuick\Controls\Basic\is-THCKI.tmp

Filesize
1KB

MD5
f914277d5c188d8211f2ef366e0fc41e

SHA1
d42d3a981e565ba78fa8fdfb23d5e4ff4e72ac48

SHA256
a20e12d2e657e69060ec6b823bd111c4689e45553be5bdea2c492fe6f0200499

SHA512
3631940ecbee29f7223e72776f5ee6b4ae6f7156749ea2be54cac554027d2ce556699b02416550c5a199cdba3375d00488cd8548c1d5d4dfb8f5533e5e7c407e

Download Submit
C:\metafather\QtQuick\Controls\designer\is-CRB5I.tmp

Filesize
559B

MD5
268ca4343417ef1bbec6111772662306

SHA1
5180059a57f944bdcd2d55639289ac14bcfc2ba4

SHA256
f8d2bf5bc61e2575380c2be7e6516bc0426200025ba333c744d1f212108ffe4f

SHA512
c83bbb2807a98255dc3388c4b531c25d4984c77deb71f964f963ad84651fdf52f1ac1213318bf1476da3fc575b86607692657df739ff5218d661b02cab3cc63a

Download Submit
C:\metafather\QtQuick\Controls\designer\is-DTSGK.tmp

Filesize
494B

MD5
6fd2055c93332727a0f0a80fbd0a6c9a

SHA1
099d4cf01e806280f72afd8e2f2502ae256a82d2

SHA256
f09e9acf39237df1404d0bdb520ef0df2d35d9586f519e91416b9c02228252ed

SHA512
c839ae74896cb6c0edcaabfd5319bc9af22db94204ab6a025a1488aeb3b0326152e5fc96c3950dc9cda6a493089a4154b188944ca4b367b27fcaaabadcbc14ee

Download Submit
C:\metafather\imageformats\qgif.dll

Filesize
47KB

MD5
9f010bb66af6d24b272f301ccb737dfb

SHA1
9129a628429a2d7d8f67ea76cb7ea619a6476a19

SHA256
a0661e1e252b4a70be13d6ce3e714d75950cdafee97469bdd8ba74fe9b8ab7f2

SHA512
f8537fbdded13f90fd18e99d8f416838451a61aa310188728ba4cf93f35321a0684c9618340cbc47a6c916421f8321a8838a3a05bda0435d9eba6e024afdf79e

Download Submit
C:\metafather\imageformats\qicns.dll

Filesize
54KB

MD5
e1b1d7178810b166dc0c3a92ff0ef7dd

SHA1
3cadd77afb3850596dd9dc220f2cf5a31659c61f

SHA256
f1542a21b08f2d8ab6caa38e050079e2dd48f0e91dd05dd2757547346956f547

SHA512
c0abfedf3fee20dd70a36dcbe14a4a66dbbeaf10f23e1acdea39fcef55653ade97fdbfc0e9556b40ff258d3e574c089a185aefd103a71f15e396507d008f4b19

Download Submit
C:\metafather\imageformats\qico.dll

Filesize
46KB

MD5
808f5090ec66bf283ce47b5f7d9a3b8f

SHA1
21495090157c5502c39199cf288988b372220a66

SHA256
80021819a796f8775addcee29d9b96a507cb4a5181f5d4b50eb560914f3cf93c

SHA512
b09f9a3a52d0aab24b85e045276e7d3ecd2c930c28fa89ff8255981382fb389f14741bbf48f61b2b94df8f892c5056a81d324b24878f273d0d51ac312560d675

Download Submit
C:\metafather\imageformats\qjpeg.dll

Filesize
457KB

MD5
1175b0f5bac4d0a4e7a3881c9299f3d0

SHA1
0134e7ec9aaecf96ce4f68384bfc3746ed710553

SHA256
3ebc99ca2cf94c1cfb91151a70c05f412f5d7120817bfed57888f974660893c8

SHA512
394ebd37d2191709d8626b1ba0f2ae892f894a054e019e0c210307514b63eafd8669948512de2b989ceecac76b4e2fa6a4916bdac430367a001ece9394e6289f

Download Submit
C:\metafather\imageformats\qpdf.dll

Filesize
41KB

MD5
f011f90b7b67105d3d52d02fa2173608

SHA1
f5a9039da97f6c0ac3b8e739093e831aa0ed600c

SHA256
d5ba6f977c59c5e975f320d5a394636d13f1fbbad726b99510f97ce3c5312f8f

SHA512
54f45e3ae2ad02bddde3624a7d5b2622603a69c64bee6be23dd2cdccb84bc867aeed42e19ef6607e065ead87fbf916c36d9e3445c70a080ce57d11f46e205160

Download Submit
C:\metafather\imageformats\qsvg.dll

Filesize
39KB

MD5
829e8b2126fd8c6afbe67e4bfefad3ff

SHA1
922bf4f761643120232dbff81dbbf06e60a9b943

SHA256
2c70c2b536f1460bac6bc84010afc148318ba8617ee1dd99d116220ed72cccbe

SHA512
09de18cfd5024c51d8be30cdbf7c765c97146ab0c6a47b7bf580933a288b2733e3fe092359e86303d28a5016bdcd7e9d3fae249d7f589daf880fbef418d3a3e0

Download Submit
C:\metafather\imageformats\qtga.dll

Filesize
38KB

MD5
a926ddcd5a066f75edb54acb0efdf7e1

SHA1
9b1d07559e79dec4f6166d258cfc05d10a55e016

SHA256
96d2374579883d7c109c381e63658a3f910400dbb20b468b3f3f08c1e01ea7c0

SHA512
e3d2adcfe4025a0b9271a650a7fff30d27f17947f4231e80bfe1596629d6353561c49f391604c5d22bac2fca71d7ad792e49423c148a5eb358f3b17c3ec49e22

Download Submit
C:\metafather\imageformats\qtiff.dll

Filesize
416KB

MD5
fa9506ff5ed6edf30b2c1fbc9460cea5

SHA1
efee4310addb2894faa788329bc1d752660db9c6

SHA256
63102886099355197c2335b2eb3296e2d861693881c7d1388b956a619f882b8a

SHA512
1a8c326c7b6e7c36a417fe078c35681b12409cb173871bda63457bcaad72f81a109e51de41006a0cb163694350bb8b23259467fcdbc15ab07e2ba9fb460b82c8

Download Submit
C:\metafather\imageformats\qwbmp.dll

Filesize
37KB

MD5
a69296372745eece0423f8990c3637c3

SHA1
aea0d39edd611e24c3220084bcf7892dfb01659c

SHA256
fdd42f98607a399cb3ed04d0afb3b5851e1e9c007337359347bf4eec5490bc23

SHA512
f8c6dd61bbdc3d90ede4ebca9859bfc62c2a96df37300f73c5a5e490bd6326bf8f6962ee1d8e4ea619cedfdbb0f3df20994eceb07e5ff2de2c934a09c919ef90

Download Submit
C:\metafather\imageformats\qwebp.dll

Filesize
526KB

MD5
631c47a38294bb290e4b1193761fee13

SHA1
198bc5624750005c6c71cb4aebeb9b171af89882

SHA256
21965c35f45ca575f51d506fff1ee08ed94afbc78e50e6c68cca82a58ff4424a

SHA512
3749c953f42ac86cf2321853d770467bade607f4b5ed7fe64a460ee49fda142da70b9e4e44bae6fe789d063e98a4481f0ae09fb81bc455fdadcc0f2e9406572b

Download Submit
C:\metafather\metafather.exe

Filesize
9.2MB

MD5
f415740d604545e1af11ed6253c525b6

SHA1
5a95b53f5d87870a5c8d4876b8c3e0299449e74f

SHA256
02b48e7c3b466e1ed23169a2470867734080d37973eec917d27a8362f349a51e

SHA512
224d79925c9fdde4f1457b1e26c88d962e5852ced60aa42d31aa2332cb63a618aa4d7d2c8fbaa7aeff7a5f0e6d1e4dc67b7ef2b14b557d35787174062ec51c77

Download Submit
C:\metafather\msvcp140.dll

Filesize
611KB

MD5
eb1b46c4b900e4c83066760a737986cd

SHA1
90444980a36e79c043e6f037841822a9ef89af9d

SHA256
29206a9a3abb8962593312edc6fb5aaa76a86fae8f24c1e1718707001b8df3dd

SHA512
2bb5ada10764e4ea527e1f8e706ceba8f3fd25704f494e1b900b8c9a24a954a1ee069ebcff8899d0e1bec92af2025e0a58b4b7745f72b1313ba27b93b26be5e0

Download Submit
C:\metafather\msvcp140_1.dll

Filesize
31KB

MD5
21305ffc06926dcb1dc04a43d484c4d9

SHA1
9facc00573dbfd8b3f5f11ae567b18f2d91f307a

SHA256
be63e698f13243b0f1ac572e46952b2c635b7b25971a9b144be8c974767920cc

SHA512
2d7df89bc462c1612222cdd573538a5f96cd75b61352c17efbf4e733fe292d37734a1bc77e1edee22c33003ceb7e74e220cf765d05d6e4d955434806789dac1c

Download Submit
C:\metafather\msvcp140_2.dll

Filesize
181KB

MD5
5338e18979b5dbc62235aab52307b820

SHA1
39f1e5d294ae25adbda517f07ed536040591e50b

SHA256
046739d24a8253914ea8048e2c136cbba668e62fe5284cc0ff5db5f350b9da2c

SHA512
a9728e82f7f212d5d1d57849f0c84dbed1bf1a1cd7a373d1bbe4af276e20c9225282685fa75e28fe2918f4f293d1c1d2564acede4d5a03c99522ec3d0e4afea4

Download Submit
C:\metafather\platforms\qdirect2d.dll

Filesize
883KB

MD5
2dc372bec7d15f0e0e6e45930865a7c0

SHA1
cf70323914d0f246c3953855dbe2e8a5ff51e4fc

SHA256
1fbfa3632fd292ccb3ab72566d934dfafc3d99308115c60ff7441aa5e905cd84

SHA512
d313178dc461f401ad849f2ee5c2b103e81d62742105df89170bf3ec8da100da704515bd668c93617083880a0915e1b2a0e76ed8aff6a6516be705e18932406e

Download Submit
C:\metafather\platforms\qminimal.dll

Filesize
59KB

MD5
39cda152c2e91cf68797532e20728edf

SHA1
1faddd162945a11eae48adde1573d11f815c45dd

SHA256
423baeb9e7a0e30503872b35a8bd6ddbbef526ce338cfade0b97bd203dc3aa20

SHA512
f0652d4317e66f5cdd771ed9dea70b4d6a1fc6ad310b382583026796a6d9310e4bbff87f7de3015944d53334e54153a6e8657be60d310a17cf494cf1e6fafda0

Download Submit
C:\metafather\platforms\qoffscreen.dll

Filesize
104KB

MD5
a8fabb422bb99f2630c00142e0fe9340

SHA1
8bafecf96209f62e312d6e58c438e162d18fd0b9

SHA256
e0ff0a8dc40db206b67c787a2a45ebf87a0896df033ca5dd2c9c7ae5c0ac3f2d

SHA512
463ca9daeba6b71695ac0440a44351d2bd4a229ef3612d164a1a4b91b00d2f58ed87c6040b3f22d80f88b8b79699ce384275ada6b4839684cfc2919c5e4c6d24

Download Submit
C:\metafather\platforms\qwindows.dll

Filesize
869KB

MD5
53f38c75f9d01240263822e260b657e6

SHA1
b66edb4fe49138d9dda7d102d7ac0177576914fe

SHA256
99e5c6cd5e38b4bafa1a07a6455f2dbe73569c644f617e0e56d36e281fdc0ec5

SHA512
5ec6091e39aedf6b7ac483bbadaed4c11ae58e77a9ab83ff3c8f5eae9eca13b28f31f54726cfb4972551a06f7cef3730ccc3f9c6875ba519695add6f2b118afc

Download Submit
C:\metafather\qml\QtQuick\Controls\Universal\is-31M4U.tmp

Filesize
1KB

MD5
63340c8fcb71734ce4bbac29a86821b5

SHA1
0cfd02b3e95fa482cbd4bd83b0f2d9214acc9709

SHA256
78b5fc58e6d881d16351e92d32b8cadea6b14fbf8c20c1bc7e56d02946467ae8

SHA512
fe035bb77a32d0fe9d4983d90c65d4c2600a019ac20743dbec409f29ffbfbecd8bca2d15abfffb2e71b77e3c105e248627a176942cdf9d7b98ed9113e6f73ba0

Download Submit
C:\metafather\qml\QtQuick\Controls\Windows\is-P7DKG.tmp

Filesize
215B

MD5
2006d4b7d0da455aa4c7414653c0018a

SHA1
6685b8360b97799aa4d6b18789bf84a343e9e891

SHA256
a96c7bf5832767bdc9d91e2290a3920aec3abfbf2e3814bce38b49483f16f84a

SHA512
703804e6fab0cf44317b7292c547a1348e2e7395e4b71367c32c3b097bcfb3344d3296179bf4ba33a4c752ae58a3873af57d8cdef35a34564205356bb4e6fd84

Download Submit
C:\metafather\styles\qwindowsvistastyle.dll

Filesize
140KB

MD5
9c94a93cb23cc5f966daa9b4ebe7a5ee

SHA1
1a041a939941f44a59dac51146a268580325d147

SHA256
c4afa5f240f7902122308489072d7dbe40616ad0f24c6b280f873b813fc617c3

SHA512
b0362da5fb71df6c3901e7167e610627184118581e5eb1eddcbba6fe8a77e77e71c049f7efa3cf037bbdd9e84ce441256c55e35a08d4586d134919f5ec9e41d3

Download Submit
C:\metafather\translations\en.qm

Filesize
16B

MD5
bcebcf42735c6849bdecbb77451021dd

SHA1
4884fd9af6890647b7af1aefa57f38cca49ad899

SHA256
9959b510b15d18937848ad13007e30459d2e993c67e564badbfc18f935695c85

SHA512
f951b511ffb1a6b94b1bcae9df26b41b2ff829560583d7c83e70279d1b5304bde299b3679d863cad6bb79d0beda524fc195b7f054ecf11d2090037526b451b78

Download Submit
C:\metafather\vcruntime140.dll

Filesize
83KB

MD5
64ec2398a224c7512b7ba0eb01649216

SHA1
55d0d809163a6ea5d4b2faa30bd349e0d7cc7add

SHA256
ccaf274c1bf46ba951f4160add121160d6749c281b4fd3a6fb69e13ea0bd0b7c

SHA512
11c0d7476aabee6a75246eaec1ed97a27b2c5e737ebe3c19b719bb1094a9062d516b9865ecf3619e4bbe1e42105ca3d7c24ba82bc9842759fd21d355cc603d41

Download Submit
C:\metafather\vcruntime140_1.dll

Filesize
43KB

MD5
770184b0a38debfa6194f71d7673ea2a

SHA1
355f23b92222ceabac1a038098c844044e2f5402

SHA256
09c0876a9422c6fdb1796d61198a2ed0494b2190cfe63ebc04450f3ded2c3a57

SHA512
a6046800a211fba34e20aab5c9e6eae15145baa151e4d96d2ce04eb566c1fc3b5316d26bf8ea424b26ca82551aa824941b300fa9c5aa5e6ce0bd1b9f0733e348

Download Submit
C:\metafather\windows\platform-tools\metafatheradb.exe

Filesize
5.7MB

MD5
f6e68c4cc8cc3288fd5a411f54d8cae2

SHA1
9ce3c09bda67e746d385593f3385228790815923

SHA256
fd488a4e13d4c71acce69e209164398a056fba5a559b7f00c1351390604e5b98

SHA512
dc66258eb4d8558d578744c2e1124732f48b48333ba67ef3a24ccfa608f1cc619c4f443f61dd15c4264594b9a97305150afbe169226757357aac382241e6f392

Download Submit
\??\c:\metafather\Qt6Pdf.dll

Filesize
5.2MB

MD5
763cf70cac7749755f7ee6e8b70d2a23

SHA1
5fe601721736d64b330ec1967e8202937d03bafa

SHA256
3f1ce00d76de8f798d0a413651d06c6e46e495f03f6ba6b900e9d40b61971bbc

SHA512
027f96044a774fc4df5f86fc7f60991db5a8e485b4b95daad2bf26043274819ff8767f178fa683c72a170da91456dde35f49f3fea5985c186def133bdee184f1

Download Submit
\??\c:\metafather\Qt6QuickWidgets.dll

Filesize
114KB

MD5
3dbbb9d069f5fb11f568b31dc301def8

SHA1
9c47c888c7e81421879c2b6463ab9a1c679ed10e

SHA256
f6fadd0037b2946aedb105af884fbf0053441d089918d0e9b37ebb7901d307de

SHA512
e4ac35fedf144a3ddc70ee8992b3ef7a729d393ce458daa78d8f55352cebcd4a433fe92b2b097fcf59b1ada0ed87d19fd3009580ed890cab19a4c8c6fc0b6adf

Download Submit
memory/216-583-0x00000000035F0000-0x0000000003606000-memory.dmp

Filesize
88KB

Download
memory/216-4952-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/216-6-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/216-12-0x00000000035F0000-0x0000000003606000-memory.dmp

Filesize
88KB

Download
memory/216-578-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/216-4791-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/216-4787-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/1984-4999-0x0000020043DC0000-0x0000020043DD0000-memory.dmp

Filesize
64KB

Download
memory/1984-5026-0x0000020047BF0000-0x0000020047BF1000-memory.dmp

Filesize
4KB

Download
memory/1984-5050-0x0000020043340000-0x0000020043350000-memory.dmp

Filesize
64KB

Download
memory/1984-4941-0x00007FF980D40000-0x00007FF981368000-memory.dmp

Filesize
6.2MB

Download
memory/1984-4940-0x00007FF981370000-0x00007FF9818B1000-memory.dmp

Filesize
5.3MB

Download
memory/1984-4975-0x0000020045060000-0x00000200454A2000-memory.dmp

Filesize
4.3MB

Download
memory/1984-4977-0x00000200454B0000-0x00000200456B2000-memory.dmp

Filesize
2.0MB

Download
memory/1984-4992-0x0000020042DF0000-0x0000020042E00000-memory.dmp

Filesize
64KB

Download
memory/1984-4991-0x0000020042DE0000-0x0000020042DF0000-memory.dmp

Filesize
64KB

Download
memory/1984-4994-0x0000020042E10000-0x0000020042E20000-memory.dmp

Filesize
64KB

Download
memory/1984-4993-0x0000020042E00000-0x0000020042E10000-memory.dmp

Filesize
64KB

Download
memory/1984-4995-0x0000020043D80000-0x0000020043D90000-memory.dmp

Filesize
64KB

Download
memory/1984-4996-0x0000020043D90000-0x0000020043DA0000-memory.dmp

Filesize
64KB

Download
memory/1984-4998-0x0000020043DB0000-0x0000020043DC0000-memory.dmp

Filesize
64KB

Download
memory/1984-4997-0x0000020043DA0000-0x0000020043DB0000-memory.dmp

Filesize
64KB

Download
memory/1984-5054-0x00000200433C0000-0x00000200433D0000-memory.dmp

Filesize
64KB

Download
memory/1984-5055-0x00000200433D0000-0x00000200433E0000-memory.dmp

Filesize
64KB

Download
memory/1984-5023-0x0000020047BF0000-0x0000020047BF1000-memory.dmp

Filesize
4KB

Download
memory/1984-5024-0x0000020047BF0000-0x0000020047BF1000-memory.dmp

Filesize
4KB

Download
memory/1984-5056-0x00000200433E0000-0x00000200433F0000-memory.dmp

Filesize
64KB

Download
memory/1984-5025-0x0000020047BF0000-0x0000020047BF1000-memory.dmp

Filesize
4KB

Download
memory/1984-5031-0x0000020047C10000-0x0000020047C11000-memory.dmp

Filesize
4KB

Download
memory/1984-5032-0x0000020047C10000-0x0000020047C11000-memory.dmp

Filesize
4KB

Download
memory/1984-5033-0x0000020047C10000-0x0000020047C11000-memory.dmp

Filesize
4KB

Download
memory/1984-5034-0x0000020047C10000-0x0000020047C11000-memory.dmp

Filesize
4KB

Download
memory/1984-5035-0x0000020047C10000-0x0000020047C11000-memory.dmp

Filesize
4KB

Download
memory/1984-5040-0x0000020047C50000-0x0000020047C60000-memory.dmp

Filesize
64KB

Download
memory/1984-5039-0x0000020047C40000-0x0000020047C50000-memory.dmp

Filesize
64KB

Download
memory/1984-5041-0x0000020047C60000-0x0000020047C70000-memory.dmp

Filesize
64KB

Download
memory/1984-5043-0x0000020047C80000-0x0000020047C90000-memory.dmp

Filesize
64KB

Download
memory/1984-5044-0x0000020047C90000-0x0000020047CA0000-memory.dmp

Filesize
64KB

Download
memory/1984-5045-0x0000020046960000-0x0000020046970000-memory.dmp

Filesize
64KB

Download
memory/1984-5047-0x0000020046980000-0x0000020046990000-memory.dmp

Filesize
64KB

Download
memory/1984-5052-0x0000020043360000-0x0000020043370000-memory.dmp

Filesize
64KB

Download
memory/1984-5058-0x0000020043440000-0x0000020043450000-memory.dmp

Filesize
64KB

Download
memory/1984-5057-0x00000200433F0000-0x0000020043400000-memory.dmp

Filesize
64KB

Download
memory/4604-573-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/4604-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/4604-4953-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/4604-0-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download