Resubmissions

03-06-2024 03:27

240603-dz99raah93 10

03-06-2024 03:24

240603-dycbbshd9y 3

Analysis

  • max time kernel
    153s
  • max time network
    161s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03-06-2024 03:27

General

  • Target

    ver3_appfile.rar

  • Size

    6.9MB

  • MD5

    70a4b0088163ebb0805eeff9bc766658

  • SHA1

    746e8f51637b5861858ef453de04964b4eb23246

  • SHA256

    5104e10875fb2a5e76fff9e552e9007d7be2049546dc8ce7443e2c62de4981ae

  • SHA512

    a0c8be17811298ddb333d4f030b8dc6a12de7f24893d94cacfaac68324baeb68a8e75874ead938ff4dedb6b2ff9b01b85168b005475c5bc87bb4ec4bdb630b28

  • SSDEEP

    98304:nQAcZjsI/pfneEb+NJ5xiMAe74hCXjIXNwpjL2qTFZHc/G3KeM/jl7EuCh8fJAHD:QXZYunlbw5jqByN6k/kVmkA/r

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

C2

https://t.me/ta904ek

https://steamcommunity.com/profiles/76561199695752269

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0

Extracted

Family

risepro

C2

147.45.47.126:58709

Signatures

  • Detect Vidar Stealer 3 IoCs
  • Modifies firewall policy service 2 TTPs 1 IoCs
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Stealc

    Stealc is an infostealer written in C++.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Creates new service(s) 2 TTPs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 9 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 10 IoCs
  • Launches sc.exe 7 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 11 IoCs
  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\ver3_appfile.rar
    1⤵
    • Modifies registry class
    PID:904
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4948
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\ver3_appfile.rar"
      2⤵
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5048
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO8B386718\Licenses.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:4144
  • C:\Users\Admin\Desktop\setup.exe
    "C:\Users\Admin\Desktop\setup.exe"
    1⤵
    • Modifies firewall policy service
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Users\Admin\Documents\SimpleAdobe\NzjJpMXfe14P3baNyxsXyTUx.exe
      C:\Users\Admin\Documents\SimpleAdobe\NzjJpMXfe14P3baNyxsXyTUx.exe
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      PID:4100
    • C:\Users\Admin\Documents\SimpleAdobe\Xx2D6IgQzBJ0ZETDk5hEl5QS.exe
      C:\Users\Admin\Documents\SimpleAdobe\Xx2D6IgQzBJ0ZETDk5hEl5QS.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2388
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:2664
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
          • Checks processor information in registry
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          PID:2864
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FBKKJEBFIDAE" & exit
            4⤵
              PID:2892
              • C:\Windows\SysWOW64\timeout.exe
                timeout /t 10
                5⤵
                • Delays execution with timeout.exe
                PID:792
        • C:\Users\Admin\Documents\SimpleAdobe\wVoRMWBFODCtkHQXZMz8GMxH.exe
          C:\Users\Admin\Documents\SimpleAdobe\wVoRMWBFODCtkHQXZMz8GMxH.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          PID:2060
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            3⤵
            • Accesses Microsoft Outlook profiles
            • Adds Run key to start application
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            PID:1916
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bdca866007fb255201297d2a15a49513 HR" /sc HOURLY /rl HIGHEST
              4⤵
              • Creates scheduled task(s)
              PID:3272
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bdca866007fb255201297d2a15a49513 LG" /sc ONLOGON /rl HIGHEST
              4⤵
              • Creates scheduled task(s)
              PID:4112
            • C:\Users\Admin\AppData\Local\Temp\spanXpFABKkomuB8\id0_AiWvSzPvcV9TAfc4.exe
              "C:\Users\Admin\AppData\Local\Temp\spanXpFABKkomuB8\id0_AiWvSzPvcV9TAfc4.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:1428
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                5⤵
                  PID:4004
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7 HR" /sc HOURLY /rl HIGHEST
                4⤵
                • Creates scheduled task(s)
                PID:2832
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7 LG" /sc ONLOGON /rl HIGHEST
                4⤵
                • Creates scheduled task(s)
                PID:3916
              • C:\Users\Admin\AppData\Local\Temp\spanXpFABKkomuB8\8v6qFvtxDMjYSrwFzq14.exe
                "C:\Users\Admin\AppData\Local\Temp\spanXpFABKkomuB8\8v6qFvtxDMjYSrwFzq14.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:244
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  5⤵
                    PID:4640
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 244 -s 272
                    5⤵
                    • Program crash
                    PID:1676
            • C:\Users\Admin\Documents\SimpleAdobe\XhLOBWkLCJ4mXqqmqvPmgvKU.exe
              C:\Users\Admin\Documents\SimpleAdobe\XhLOBWkLCJ4mXqqmqvPmgvKU.exe
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:3992
              • C:\Users\Admin\AppData\Local\Temp\kat3A50.tmp
                C:\Users\Admin\AppData\Local\Temp\kat3A50.tmp
                3⤵
                • Executes dropped EXE
                PID:5000
            • C:\Users\Admin\Documents\SimpleAdobe\LWAWtgQO7oK3JkCDCe4ECsdt.exe
              C:\Users\Admin\Documents\SimpleAdobe\LWAWtgQO7oK3JkCDCe4ECsdt.exe
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:32
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AFCFHJJECA.exe"
                3⤵
                  PID:4900
                  • C:\Users\Admin\AppData\Local\Temp\AFCFHJJECA.exe
                    "C:\Users\Admin\AppData\Local\Temp\AFCFHJJECA.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:4880
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 2600
                  3⤵
                  • Program crash
                  PID:3312
              • C:\Users\Admin\Documents\SimpleAdobe\hsik4NFJyThoU1cxJH3l6DyE.exe
                C:\Users\Admin\Documents\SimpleAdobe\hsik4NFJyThoU1cxJH3l6DyE.exe
                2⤵
                • Executes dropped EXE
                PID:1556
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 776
                  3⤵
                  • Program crash
                  PID:2104
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 784
                  3⤵
                  • Program crash
                  PID:1840
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 828
                  3⤵
                  • Program crash
                  PID:1652
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 836
                  3⤵
                  • Program crash
                  PID:2044
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 1040
                  3⤵
                  • Program crash
                  PID:1164
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 1088
                  3⤵
                  • Program crash
                  PID:2552
              • C:\Users\Admin\Documents\SimpleAdobe\Y98YtlmQVuGs8v1kdC3Qyxpe.exe
                C:\Users\Admin\Documents\SimpleAdobe\Y98YtlmQVuGs8v1kdC3Qyxpe.exe
                2⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3808
                • C:\Users\Admin\AppData\Local\Temp\is-QM9SN.tmp\Y98YtlmQVuGs8v1kdC3Qyxpe.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-QM9SN.tmp\Y98YtlmQVuGs8v1kdC3Qyxpe.tmp" /SL5="$302A0,6933569,54272,C:\Users\Admin\Documents\SimpleAdobe\Y98YtlmQVuGs8v1kdC3Qyxpe.exe"
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:1732
                  • C:\Users\Admin\AppData\Local\Voice Changer Emerald\voicechangeremerald32.exe
                    "C:\Users\Admin\AppData\Local\Voice Changer Emerald\voicechangeremerald32.exe" -i
                    4⤵
                    • Executes dropped EXE
                    PID:3904
                  • C:\Users\Admin\AppData\Local\Voice Changer Emerald\voicechangeremerald32.exe
                    "C:\Users\Admin\AppData\Local\Voice Changer Emerald\voicechangeremerald32.exe" -s
                    4⤵
                    • Executes dropped EXE
                    PID:1984
              • C:\Users\Admin\Documents\SimpleAdobe\ROBTlIx6wjhROQxD05g83Ai1.exe
                C:\Users\Admin\Documents\SimpleAdobe\ROBTlIx6wjhROQxD05g83Ai1.exe
                2⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4852
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3116
              • C:\Users\Admin\Documents\SimpleAdobe\V7j2Dej_jPL12Mt2H63Tu8bb.exe
                C:\Users\Admin\Documents\SimpleAdobe\V7j2Dej_jPL12Mt2H63Tu8bb.exe
                2⤵
                • Executes dropped EXE
                PID:2128
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\nporqqac\
                  3⤵
                    PID:3636
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\zcvggpqq.exe" C:\Windows\SysWOW64\nporqqac\
                    3⤵
                      PID:4520
                    • C:\Windows\SysWOW64\sc.exe
                      "C:\Windows\System32\sc.exe" create nporqqac binPath= "C:\Windows\SysWOW64\nporqqac\zcvggpqq.exe /d\"C:\Users\Admin\Documents\SimpleAdobe\V7j2Dej_jPL12Mt2H63Tu8bb.exe\"" type= own start= auto DisplayName= "wifi support"
                      3⤵
                      • Launches sc.exe
                      PID:1532
                    • C:\Windows\SysWOW64\sc.exe
                      "C:\Windows\System32\sc.exe" description nporqqac "wifi internet conection"
                      3⤵
                      • Launches sc.exe
                      PID:848
                    • C:\Windows\SysWOW64\sc.exe
                      "C:\Windows\System32\sc.exe" start nporqqac
                      3⤵
                      • Launches sc.exe
                      PID:4692
                    • C:\Windows\SysWOW64\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                      3⤵
                      • Modifies Windows Firewall
                      PID:4288
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 708
                      3⤵
                      • Program crash
                      PID:1012
                  • C:\Users\Admin\Documents\SimpleAdobe\gqjOtQ16O6ejaRb7ZmREvpDP.exe
                    C:\Users\Admin\Documents\SimpleAdobe\gqjOtQ16O6ejaRb7ZmREvpDP.exe
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3352
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                      3⤵
                        PID:2220
                    • C:\Users\Admin\Documents\SimpleAdobe\9SwcVTcvOT5ROJx0vo3bjv2w.exe
                      C:\Users\Admin\Documents\SimpleAdobe\9SwcVTcvOT5ROJx0vo3bjv2w.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5004
                      • C:\Windows\system32\powercfg.exe
                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2388
                      • C:\Windows\system32\powercfg.exe
                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2656
                      • C:\Windows\system32\powercfg.exe
                        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1108
                      • C:\Windows\system32\powercfg.exe
                        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1532
                      • C:\Windows\system32\sc.exe
                        C:\Windows\system32\sc.exe delete "RULTVSKP"
                        3⤵
                        • Launches sc.exe
                        PID:2552
                      • C:\Windows\system32\sc.exe
                        C:\Windows\system32\sc.exe create "RULTVSKP" binpath= "C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe" start= "auto"
                        3⤵
                        • Launches sc.exe
                        PID:3312
                      • C:\Windows\system32\sc.exe
                        C:\Windows\system32\sc.exe stop eventlog
                        3⤵
                        • Launches sc.exe
                        PID:2436
                      • C:\Windows\system32\sc.exe
                        C:\Windows\system32\sc.exe start "RULTVSKP"
                        3⤵
                        • Launches sc.exe
                        PID:3140
                    • C:\Users\Admin\Documents\SimpleAdobe\BlhNqiVLepgPy9fEK0HA_mHn.exe
                      C:\Users\Admin\Documents\SimpleAdobe\BlhNqiVLepgPy9fEK0HA_mHn.exe
                      2⤵
                      • Executes dropped EXE
                      • Accesses Microsoft Outlook profiles
                      • Adds Run key to start application
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Checks processor information in registry
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of SetWindowsHookEx
                      • outlook_office_path
                      • outlook_win_path
                      PID:1520
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
                        3⤵
                        • Creates scheduled task(s)
                        PID:4512
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
                        3⤵
                        • Creates scheduled task(s)
                        PID:2680
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1700
                        3⤵
                        • Program crash
                        PID:1996
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                    1⤵
                      PID:4544
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                      1⤵
                        PID:1952
                      • C:\Users\Admin\Desktop\setup.exe
                        "C:\Users\Admin\Desktop\setup.exe"
                        1⤵
                        • Executes dropped EXE
                        PID:1476
                      • C:\Users\Admin\Desktop\setup.exe
                        "C:\Users\Admin\Desktop\setup.exe"
                        1⤵
                        • Executes dropped EXE
                        PID:1736
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                        1⤵
                          PID:4916
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1556 -ip 1556
                          1⤵
                            PID:1132
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1556 -ip 1556
                            1⤵
                              PID:4704
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1556 -ip 1556
                              1⤵
                                PID:3008
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1556 -ip 1556
                                1⤵
                                  PID:1228
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1556 -ip 1556
                                  1⤵
                                    PID:1420
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1556 -ip 1556
                                    1⤵
                                      PID:2292
                                    • C:\Windows\SysWOW64\nporqqac\zcvggpqq.exe
                                      C:\Windows\SysWOW64\nporqqac\zcvggpqq.exe /d"C:\Users\Admin\Documents\SimpleAdobe\V7j2Dej_jPL12Mt2H63Tu8bb.exe"
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:1904
                                      • C:\Windows\SysWOW64\svchost.exe
                                        svchost.exe
                                        2⤵
                                        • Sets service image path in registry
                                        • Drops file in System32 directory
                                        • Modifies data under HKEY_USERS
                                        PID:2876
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 544
                                        2⤵
                                        • Program crash
                                        PID:2572
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1904 -ip 1904
                                      1⤵
                                        PID:2840
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2128 -ip 2128
                                        1⤵
                                          PID:3836
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                          1⤵
                                            PID:1092
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 32 -ip 32
                                            1⤵
                                              PID:2216
                                            • C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe
                                              C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2956
                                              • C:\Windows\system32\powercfg.exe
                                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                2⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1488
                                              • C:\Windows\system32\powercfg.exe
                                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                2⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2324
                                              • C:\Windows\system32\powercfg.exe
                                                C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                2⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1840
                                              • C:\Windows\system32\powercfg.exe
                                                C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                2⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4276
                                              • C:\Windows\system32\conhost.exe
                                                C:\Windows\system32\conhost.exe
                                                2⤵
                                                  PID:4808
                                                • C:\Windows\system32\svchost.exe
                                                  svchost.exe
                                                  2⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1652
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 244 -ip 244
                                                1⤵
                                                  PID:4048
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1520 -ip 1520
                                                  1⤵
                                                    PID:1688

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\ProgramData\Are.docx

                                                    Filesize

                                                    11KB

                                                    MD5

                                                    a33e5b189842c5867f46566bdbf7a095

                                                    SHA1

                                                    e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                    SHA256

                                                    5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                    SHA512

                                                    f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                  • C:\ProgramData\FBKKJEBFIDAE\BKKJKF

                                                    Filesize

                                                    20KB

                                                    MD5

                                                    a603e09d617fea7517059b4924b1df93

                                                    SHA1

                                                    31d66e1496e0229c6a312f8be05da3f813b3fa9e

                                                    SHA256

                                                    ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

                                                    SHA512

                                                    eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

                                                  • C:\ProgramData\FBKKJEBFIDAE\FBKKJE

                                                    Filesize

                                                    160KB

                                                    MD5

                                                    f310cf1ff562ae14449e0167a3e1fe46

                                                    SHA1

                                                    85c58afa9049467031c6c2b17f5c12ca73bb2788

                                                    SHA256

                                                    e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

                                                    SHA512

                                                    1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

                                                  • C:\ProgramData\FBKKJEBFIDAE\IIJDBG

                                                    Filesize

                                                    20KB

                                                    MD5

                                                    22be08f683bcc01d7a9799bbd2c10041

                                                    SHA1

                                                    2efb6041cf3d6e67970135e592569c76fc4c41de

                                                    SHA256

                                                    451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457

                                                    SHA512

                                                    0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

                                                  • C:\ProgramData\FBKKJEBFIDAE\IIJDBG

                                                    Filesize

                                                    116KB

                                                    MD5

                                                    4e2922249bf476fb3067795f2fa5e794

                                                    SHA1

                                                    d2db6b2759d9e650ae031eb62247d457ccaa57d2

                                                    SHA256

                                                    c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1

                                                    SHA512

                                                    8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da

                                                  • C:\ProgramData\FBKKJEBFIDAE\IIJDBG

                                                    Filesize

                                                    46KB

                                                    MD5

                                                    14ccc9293153deacbb9a20ee8f6ff1b7

                                                    SHA1

                                                    46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

                                                    SHA256

                                                    3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

                                                    SHA512

                                                    916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

                                                  • C:\ProgramData\GHIDGDHCGCBAKFHIIIIIIDGHJD

                                                    Filesize

                                                    5.0MB

                                                    MD5

                                                    0d2ca23431733e26358b8db704674561

                                                    SHA1

                                                    8b000c5e7224f6d526e1aedf04a925c53aa547f3

                                                    SHA256

                                                    01f35d0a7fec1753913c309dc22b25d0724be4e93c3e9e6d45f428f85741db6b

                                                    SHA512

                                                    1547f9b52ad8ba43b685a97e1e340c3bf2d107ce2d2b4b7d8111ef9986d6abb5bce9ede04200782661955bb1d740d4720e35309ebff5dce5b5a1e413b8e39690

                                                  • C:\ProgramData\mozglue.dll

                                                    Filesize

                                                    593KB

                                                    MD5

                                                    c8fd9be83bc728cc04beffafc2907fe9

                                                    SHA1

                                                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                    SHA256

                                                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                    SHA512

                                                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                  • C:\ProgramData\nss3.dll

                                                    Filesize

                                                    2.0MB

                                                    MD5

                                                    1cc453cdf74f31e4d913ff9c10acdde2

                                                    SHA1

                                                    6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                    SHA256

                                                    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                    SHA512

                                                    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I6I473PF\advdlc[1].htm

                                                    Filesize

                                                    1B

                                                    MD5

                                                    cfcd208495d565ef66e7dff9f98764da

                                                    SHA1

                                                    b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                    SHA256

                                                    5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                    SHA512

                                                    31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                  • C:\Users\Admin\AppData\Local\Temp\7zO8B386718\Licenses.txt

                                                    Filesize

                                                    131KB

                                                    MD5

                                                    bfe80d65cc4a7f039156a5d7bb258f58

                                                    SHA1

                                                    d4b9c2fb2dba70e5208ee3eb84cdb55a74858fdc

                                                    SHA256

                                                    a8b01bfc0898b04d2027af87d0594bc901cf97766ae1101272463750217ab6d7

                                                    SHA512

                                                    c0bce0daa8932f60db2c13a5b1f1cef329da56eb0e51d8ee617dc12ca0e8b2867f50deefb6ebe6205da3ec947342793f7134a21bad77854fd80b5d1f79fb838c

                                                  • C:\Users\Admin\AppData\Local\Temp\AFCFHJJECA.exe

                                                    Filesize

                                                    533KB

                                                    MD5

                                                    6c93fc68e2f01c20fb81af24470b790c

                                                    SHA1

                                                    d5927b38a32e30afcf5a658612a8266476fc4ad8

                                                    SHA256

                                                    64a71b664d76641b35dac312161cb356b3b3b5f0b45c9d88c8afa547b4902580

                                                    SHA512

                                                    355e9677121ef17cf8c398f0c17399776d206c62014080a2c62682e1152ea0729dcc6e233358dcd6bae009b07e3db936d4b18eb37d6e7ebc2fe9cf8d827c4ade

                                                  • C:\Users\Admin\AppData\Local\Temp\is-MLMS6.tmp\_isetup\_iscrypt.dll

                                                    Filesize

                                                    2KB

                                                    MD5

                                                    a69559718ab506675e907fe49deb71e9

                                                    SHA1

                                                    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                                    SHA256

                                                    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                                    SHA512

                                                    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                                  • C:\Users\Admin\AppData\Local\Temp\is-MLMS6.tmp\_isetup\_isdecmp.dll

                                                    Filesize

                                                    13KB

                                                    MD5

                                                    a813d18268affd4763dde940246dc7e5

                                                    SHA1

                                                    c7366e1fd925c17cc6068001bd38eaef5b42852f

                                                    SHA256

                                                    e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

                                                    SHA512

                                                    b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

                                                  • C:\Users\Admin\AppData\Local\Temp\is-QM9SN.tmp\Y98YtlmQVuGs8v1kdC3Qyxpe.tmp

                                                    Filesize

                                                    680KB

                                                    MD5

                                                    06dd00456e1bab28b909bc85f775c9f7

                                                    SHA1

                                                    e00b1f204870633d3ffa407414a975a0e346e44f

                                                    SHA256

                                                    5909886a7138fbfd08006f1c51d58d011596cfa434c6a69db1b0915ba3c4b715

                                                    SHA512

                                                    72cd0f25864185d863922a50a965fe71c9d618f50ca5d02f7fdf942ff365423765def91f8c39cd58fd355b0e67618037ee6ca23359769a5fd1d2fc1aaa63f203

                                                  • C:\Users\Admin\AppData\Local\Temp\kat3A50.tmp

                                                    Filesize

                                                    861KB

                                                    MD5

                                                    66064dbdb70a5eb15ebf3bf65aba254b

                                                    SHA1

                                                    0284fd320f99f62aca800fb1251eff4c31ec4ed7

                                                    SHA256

                                                    6a94dbda2dd1edcff2331061d65e1baf09d4861cc7ba590c5ec754f3ac96a795

                                                    SHA512

                                                    b05c6c09ae7372c381fba591c3cb13a69a2451b9d38da1a95aac89413d7438083475d06796acb5440cd6ec65b030c9fa6cbdaa0d2fe91a926bae6499c360f17f

                                                  • C:\Users\Admin\AppData\Local\Temp\spanUChDS0KGgUWQ\02zdBXl47cvzcookies.sqlite

                                                    Filesize

                                                    96KB

                                                    MD5

                                                    40f3eb83cc9d4cdb0ad82bd5ff2fb824

                                                    SHA1

                                                    d6582ba879235049134fa9a351ca8f0f785d8835

                                                    SHA256

                                                    cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

                                                    SHA512

                                                    cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

                                                  • C:\Users\Admin\AppData\Local\Temp\spanXpFABKkomuB8\8v6qFvtxDMjYSrwFzq14.exe

                                                    Filesize

                                                    1.2MB

                                                    MD5

                                                    a09ef83719952de3da58e3af375af664

                                                    SHA1

                                                    8cb249125770b65dd0f8e4bc575a9ed9fd64e1dd

                                                    SHA256

                                                    97767dcc0522540da20c9f3e68de20f75779e326697e1c0e201be9ff57154484

                                                    SHA512

                                                    0de74d2b7dac3af23680d89da186f495f4eaa3722b7966132e5f2c9cbe7d0f0f80da1c90c0a695fe82c917ad7190fb3696d257d7d3841b4cd7276b2034594fd9

                                                  • C:\Users\Admin\AppData\Local\Temp\spanXpFABKkomuB8\97npohmu3VGfWeb Data

                                                    Filesize

                                                    112KB

                                                    MD5

                                                    87210e9e528a4ddb09c6b671937c79c6

                                                    SHA1

                                                    3c75314714619f5b55e25769e0985d497f0062f2

                                                    SHA256

                                                    eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

                                                    SHA512

                                                    f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

                                                  • C:\Users\Admin\AppData\Local\Temp\spanXpFABKkomuB8\Ktbw4FbLzGbGLogin Data For Account

                                                    Filesize

                                                    40KB

                                                    MD5

                                                    a182561a527f929489bf4b8f74f65cd7

                                                    SHA1

                                                    8cd6866594759711ea1836e86a5b7ca64ee8911f

                                                    SHA256

                                                    42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                                    SHA512

                                                    9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                                  • C:\Users\Admin\AppData\Local\Temp\spanXpFABKkomuB8\Y3EREaqwKqRoWeb Data

                                                    Filesize

                                                    114KB

                                                    MD5

                                                    ea3bbda11253a0ddfa0bd6d750a7c9fc

                                                    SHA1

                                                    6b920bcafd8036b42657e50c84a1da2cea4d1307

                                                    SHA256

                                                    0a2bfcd7ad484f317f01b03ed4475015a2182137cb3daf7cd5717a9f8d081f89

                                                    SHA512

                                                    d885aeb00d919689b020bbf541d548578fa415150c2a7a160603a7d397bdb4238fa518eb076bdbbc3401325e517334a5da361e894939954d9bc29560d5d13268

                                                  • C:\Users\Admin\AppData\Local\Temp\zcvggpqq.exe

                                                    Filesize

                                                    12.3MB

                                                    MD5

                                                    bdacc54a02727dba5588bb1c2d631c25

                                                    SHA1

                                                    a5a82f3b774a9c0776df37a225193fd8dd9ceed8

                                                    SHA256

                                                    5de7a2fcae871c3d7e6d9d35562f23f81eabd4205ded2dac89707a015dc2b39c

                                                    SHA512

                                                    3335854a10b17b2ce774d7a546a3c632a555313cb9282204402036123d30ece8b50e3d3ae20547efe58fe1e533c008f85d3369e23932f46696205567502d1135

                                                  • C:\Users\Admin\AppData\Local\Voice Changer Emerald\voicechangeremerald32.exe

                                                    Filesize

                                                    4.6MB

                                                    MD5

                                                    7020c8baef852cc0a619ea546a49fe70

                                                    SHA1

                                                    fcbba6aab37475386b16bb7e493d5c9715adc99d

                                                    SHA256

                                                    c19caf93bdcb0fda3b7b0c208b7eebff5b40498d8d1d007319498ee46a4b718a

                                                    SHA512

                                                    719543e4aa43493ada34ee0eb52f410a1d90ebab6d32f6b2795ef6ed3ef0c6959af6b2fb6b5ef9225731bbc4439d97643e3c7c511d79665e2ce2e8c7b2955ce6

                                                  • C:\Users\Admin\Documents\SimpleAdobe\9SwcVTcvOT5ROJx0vo3bjv2w.exe

                                                    Filesize

                                                    10.9MB

                                                    MD5

                                                    d43ac79abe604caffefe6313617079a3

                                                    SHA1

                                                    b3587d3fa524761b207f812e11dd807062892335

                                                    SHA256

                                                    8b750884259dd004300a84505be782d05fca2e487a66484765a4a1e357b7c399

                                                    SHA512

                                                    bb22c73ed01ff97b73feb68ae2611b70ef002d1829035f58a4ba84c5a217db368aae8bdc02cdec59c1121922a207c662aa5f0a93377537da42657dd787587082

                                                  • C:\Users\Admin\Documents\SimpleAdobe\BlhNqiVLepgPy9fEK0HA_mHn.exe

                                                    Filesize

                                                    1.3MB

                                                    MD5

                                                    70cf651103140496ab688fb4daf76ed4

                                                    SHA1

                                                    8e3e48cb882712324b3d41b96233c54eb1ce2a9c

                                                    SHA256

                                                    74d3fcb85d66abb5a5fdb33b247853fde894616e78d3c81740cdba2f691de620

                                                    SHA512

                                                    922d14cccef105d42d6991d0af47b2e270dbe25a8db4dbe73d7ada27700d371117b1be31bd144b21ca2fe13cec5e3196773fe8f3571a7b4fd47fdb94097f6329

                                                  • C:\Users\Admin\Documents\SimpleAdobe\Hw0o7s8747mtLaVEkQbUpTOC.exe

                                                    Filesize

                                                    458KB

                                                    MD5

                                                    f9b709da326e7e959322ab4be3ec1ff6

                                                    SHA1

                                                    91af2af1771bb2a90299addb521fcdb4f96e7fe4

                                                    SHA256

                                                    54933a25618a8e3611cd8ef65d67025101e663af599c671433de3da700555abf

                                                    SHA512

                                                    77b3529a84c80572b8189d602177beed13aa9e286354f382d6d413f908917848529ae2b7cc5c59811ad5cbaaa7e4e8562ded3762e37707f9fe82eaceccb481ec

                                                  • C:\Users\Admin\Documents\SimpleAdobe\LWAWtgQO7oK3JkCDCe4ECsdt.exe

                                                    Filesize

                                                    341KB

                                                    MD5

                                                    f1290cdcb9831cc2d03f262e7c85c291

                                                    SHA1

                                                    b67ca54592b3429970bc4854c494b11a6aaff355

                                                    SHA256

                                                    87ffe74979caa152c330b03640a19a56674de154d0b97f7c6355a24cc1a083db

                                                    SHA512

                                                    c30789205499f93543a64f388c54271e6bdb8bd205127c2d215625899736e4391fc6f269cdfe2590dc664dea34593506cd2087c4afca91053ca3b915fb9a364d

                                                  • C:\Users\Admin\Documents\SimpleAdobe\NzjJpMXfe14P3baNyxsXyTUx.exe

                                                    Filesize

                                                    421KB

                                                    MD5

                                                    1fc71d8e8cb831924bdc7f36a9df1741

                                                    SHA1

                                                    8b1023a5314ad55d221e10fe13c3d2ec93506a6c

                                                    SHA256

                                                    609ef2b560381e8385a71a4a961afc94a1e1d19352414a591cd05217e9314625

                                                    SHA512

                                                    46e5e2e57cb46a96c5645555809713ff9e1a560d2ad7731117ef487d389319f97a339c3427385a313883a45c2b8d17ce9eec5ca2094efa3d432dd03d0ca3bb28

                                                  • C:\Users\Admin\Documents\SimpleAdobe\ROBTlIx6wjhROQxD05g83Ai1.exe

                                                    Filesize

                                                    2.8MB

                                                    MD5

                                                    3d996391791111e82e3300e1baa6ddb7

                                                    SHA1

                                                    65136e285aad65e6cec95755714415aa5a1fdf4c

                                                    SHA256

                                                    1cf3753e2489cce7cfe5cb87dfd9825eab65104064f212245ce101728e205997

                                                    SHA512

                                                    1d8eeebba17a3eaa98c2ba78bf7cf2ac4fef80d8aeacbd1208211a23509aa54cbbeba80b41af6198a78ac2c1a57f9c85c5a123cd2fb01f4ded160b72482ed662

                                                  • C:\Users\Admin\Documents\SimpleAdobe\ROBTlIx6wjhROQxD05g83Ai1.exe

                                                    Filesize

                                                    2.8MB

                                                    MD5

                                                    64e769e16f853835dd768a9b65626407

                                                    SHA1

                                                    87c0e29f2335809e3e70aaee47187db3ee8ceece

                                                    SHA256

                                                    5ece0d233ac404577a0ae14c8195299d239e4bbf3cb004b56cdeddf77de94733

                                                    SHA512

                                                    f275730523bbf75d6f96bef1255be756fd84ae570d0d5aae7f29a513da15b2d7f9b1b057912accb15be5de27e80067b2e83a07b4e78968cb412c2f0ffdd35879

                                                  • C:\Users\Admin\Documents\SimpleAdobe\V7j2Dej_jPL12Mt2H63Tu8bb.exe

                                                    Filesize

                                                    311KB

                                                    MD5

                                                    25f75c4de10c970fd05472f8e6c3f337

                                                    SHA1

                                                    c4acca6845ab4822d42df4f95ce9c2525d8d36eb

                                                    SHA256

                                                    8334202c2f64dbe7fd4664b683f7f9d37f5d978c5c8ad9f818688da89facb260

                                                    SHA512

                                                    32cc118562076123b04c50cc8a256d0999afb104f03c51656699e3ef10ebaee49886a2d52fdcca182f1be617f2c750b7e900a63d0fbc24de239786c2c6abb252

                                                  • C:\Users\Admin\Documents\SimpleAdobe\XhLOBWkLCJ4mXqqmqvPmgvKU.exe

                                                    Filesize

                                                    2.4MB

                                                    MD5

                                                    1d058d70a5bad9318284682c1082dd5b

                                                    SHA1

                                                    cc1651b963a58077c1d9d1835ed2ebf0f5b52264

                                                    SHA256

                                                    62f860c0e2920c2075a8d4b9f59831bdf604178ac47c07606aef442e383be71e

                                                    SHA512

                                                    33aef18dd115ea76483c04239ed8506a625dd9ae680447259751763dc0e1cfb092b3e3d68a1ecd191285fb3c874d89fa47c2a8623a25532d92c26462c912e4ad

                                                  • C:\Users\Admin\Documents\SimpleAdobe\Xx2D6IgQzBJ0ZETDk5hEl5QS.exe

                                                    Filesize

                                                    407KB

                                                    MD5

                                                    76fd1a9b1926651dfe6018923baddfa8

                                                    SHA1

                                                    7d3692aaef8d17f92401a0b017a40474f506b878

                                                    SHA256

                                                    0197c8ed495aaf563da67faa3dbfb867ff7f233dd46119b8277dd496b949b31a

                                                    SHA512

                                                    00e96dcc211dc6741d599bfaf7c6e61b0997deb322b02ac40ae377c1e3ce7dc3465094a9c779e2d185577a8e82e5fc09443f8eea7e7856c0a3ea7152420d8023

                                                  • C:\Users\Admin\Documents\SimpleAdobe\Y98YtlmQVuGs8v1kdC3Qyxpe.exe

                                                    Filesize

                                                    6.9MB

                                                    MD5

                                                    c7ff30384e7ffb8be4327c5312cb2855

                                                    SHA1

                                                    2994383b61ea2f27351dea5ce6bfa34a018934c7

                                                    SHA256

                                                    c807a4675cfbd5759b882a5b9029790fdd161f6ac7474da025c1d4ac32225b0a

                                                    SHA512

                                                    2135fedce19cc2d0d0ed113a70ce95699d79a73a8028251a54c582cf01587e6468ae854442459c90897e37a64eb6ec716f54dfa4f060ddec4c3c5c455288a408

                                                  • C:\Users\Admin\Documents\SimpleAdobe\gqjOtQ16O6ejaRb7ZmREvpDP.exe

                                                    Filesize

                                                    4.7MB

                                                    MD5

                                                    d30b4e6a8b3695768578bb117e6a7041

                                                    SHA1

                                                    338677fc74ae5df4b994bc617d5330fe6dd56548

                                                    SHA256

                                                    c3e0d087fe9ab70b22ab39ab2d2c561cd071f84af7eca5f542ede7004abf7331

                                                    SHA512

                                                    4763604e44a87ba01bb7b299e7a1ef1079e8d32cfb904246d25a6b8eaecc6bb049b4b2773b39e16603aaf033e45422165072b6daebdc636f8d3c9ea20e5ed675

                                                  • C:\Users\Admin\Documents\SimpleAdobe\hsik4NFJyThoU1cxJH3l6DyE.exe

                                                    Filesize

                                                    366KB

                                                    MD5

                                                    ba1078a938632c3219edc00cc855625a

                                                    SHA1

                                                    6bdf4afc5e6f7cc018cad4a48efdbc0c11bcdcaa

                                                    SHA256

                                                    6c0e3c79a60f451bf58f99799d9f308fa567d0f823e9845521be9ccf63d624e3

                                                    SHA512

                                                    5c0d88ee30db5744267edaee37a1f2226a3e4b09a76dfefe6739b6cdbd95fb8d3a6f7279636b513fdb13e7b085b42a0143d4888e382453aa2965b639c7f48366

                                                  • C:\Users\Admin\Documents\SimpleAdobe\wVoRMWBFODCtkHQXZMz8GMxH.exe

                                                    Filesize

                                                    4.7MB

                                                    MD5

                                                    639da9bf4729f01a695ee1aefd9976ff

                                                    SHA1

                                                    9cad9b5a39c29870af0386a7f712bdeddb34aa65

                                                    SHA256

                                                    4f309c8b91bbe04a501c49876ce7e17d351662554019fb0683c49e8fa0d2b9b4

                                                    SHA512

                                                    e0fda7a59a4bd273241a717e8ef6bb38ef6a798a78db4a012182cf0fd74999fac8861cdb2e43ed621bb3e9e4bfea311cd55d2b78c1f9da4374946ccafc1900ab

                                                  • C:\Windows\System32\GroupPolicy\gpt.ini

                                                    Filesize

                                                    127B

                                                    MD5

                                                    8ef9853d1881c5fe4d681bfb31282a01

                                                    SHA1

                                                    a05609065520e4b4e553784c566430ad9736f19f

                                                    SHA256

                                                    9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                    SHA512

                                                    5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                  • memory/1476-36-0x00007FF6C6E30000-0x00007FF6C75A7000-memory.dmp

                                                    Filesize

                                                    7.5MB

                                                  • memory/1520-224-0x00000000002C0000-0x00000000007F2000-memory.dmp

                                                    Filesize

                                                    5.2MB

                                                  • memory/1520-1001-0x00000000002C0000-0x00000000007F2000-memory.dmp

                                                    Filesize

                                                    5.2MB

                                                  • memory/1520-209-0x00000000002C0000-0x00000000007F2000-memory.dmp

                                                    Filesize

                                                    5.2MB

                                                  • memory/1736-145-0x00007FF6C6E30000-0x00007FF6C75A7000-memory.dmp

                                                    Filesize

                                                    7.5MB

                                                  • memory/1984-505-0x0000000000400000-0x000000000089C000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/2060-234-0x0000000000DD0000-0x0000000001282000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/2060-241-0x0000000005E20000-0x0000000006082000-memory.dmp

                                                    Filesize

                                                    2.4MB

                                                  • memory/2060-260-0x00000000071B0000-0x00000000073D8000-memory.dmp

                                                    Filesize

                                                    2.2MB

                                                  • memory/2336-24-0x00007FF6C6E30000-0x00007FF6C75A7000-memory.dmp

                                                    Filesize

                                                    7.5MB

                                                  • memory/2388-226-0x0000000001660000-0x0000000001661000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2388-198-0x0000000001660000-0x0000000001661000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2864-229-0x0000000000400000-0x0000000000649000-memory.dmp

                                                    Filesize

                                                    2.3MB

                                                  • memory/2864-227-0x0000000000400000-0x0000000000649000-memory.dmp

                                                    Filesize

                                                    2.3MB

                                                  • memory/2864-225-0x0000000000400000-0x0000000000649000-memory.dmp

                                                    Filesize

                                                    2.3MB

                                                  • memory/3116-584-0x0000000008580000-0x0000000008592000-memory.dmp

                                                    Filesize

                                                    72KB

                                                  • memory/3116-511-0x0000000005E00000-0x00000000063A6000-memory.dmp

                                                    Filesize

                                                    5.6MB

                                                  • memory/3116-510-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                    Filesize

                                                    816KB

                                                  • memory/3116-512-0x0000000005850000-0x00000000058E2000-memory.dmp

                                                    Filesize

                                                    584KB

                                                  • memory/3116-701-0x0000000009F10000-0x000000000A0D2000-memory.dmp

                                                    Filesize

                                                    1.8MB

                                                  • memory/3116-702-0x000000000A610000-0x000000000AB3C000-memory.dmp

                                                    Filesize

                                                    5.2MB

                                                  • memory/3116-691-0x0000000008960000-0x000000000897E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/3116-689-0x0000000009240000-0x00000000092B6000-memory.dmp

                                                    Filesize

                                                    472KB

                                                  • memory/3116-532-0x0000000005810000-0x000000000581A000-memory.dmp

                                                    Filesize

                                                    40KB

                                                  • memory/3116-663-0x00000000088D0000-0x0000000008936000-memory.dmp

                                                    Filesize

                                                    408KB

                                                  • memory/3116-586-0x0000000008750000-0x000000000879C000-memory.dmp

                                                    Filesize

                                                    304KB

                                                  • memory/3116-585-0x00000000085E0000-0x000000000861C000-memory.dmp

                                                    Filesize

                                                    240KB

                                                  • memory/3116-583-0x0000000008640000-0x000000000874A000-memory.dmp

                                                    Filesize

                                                    1.0MB

                                                  • memory/3116-582-0x00000000089A0000-0x0000000008FB8000-memory.dmp

                                                    Filesize

                                                    6.1MB

                                                  • memory/3352-237-0x0000000000070000-0x0000000000524000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/3352-258-0x00000000050B0000-0x0000000005310000-memory.dmp

                                                    Filesize

                                                    2.4MB

                                                  • memory/3352-363-0x0000000006440000-0x0000000006666000-memory.dmp

                                                    Filesize

                                                    2.1MB

                                                  • memory/3808-214-0x0000000000400000-0x0000000000414000-memory.dmp

                                                    Filesize

                                                    80KB

                                                  • memory/3904-442-0x0000000000400000-0x000000000089C000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/3904-374-0x0000000000400000-0x000000000089C000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/4852-343-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-302-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-331-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-257-0x0000000005150000-0x00000000052B0000-memory.dmp

                                                    Filesize

                                                    1.4MB

                                                  • memory/4852-333-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-335-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-337-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-315-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-309-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-341-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-319-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-321-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-339-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-240-0x0000000004FD0000-0x000000000514A000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                  • memory/4852-313-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-303-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-305-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-307-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-311-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-317-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-329-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-327-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-259-0x0000000004EE0000-0x0000000004EFC000-memory.dmp

                                                    Filesize

                                                    112KB

                                                  • memory/4852-325-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-323-0x0000000004EE0000-0x0000000004EF5000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4852-238-0x0000000004F10000-0x0000000004FAC000-memory.dmp

                                                    Filesize

                                                    624KB

                                                  • memory/4852-233-0x0000000000280000-0x0000000000546000-memory.dmp

                                                    Filesize

                                                    2.8MB