pandastealer | da506fa70f7953e840f3eba28faf557a2038e0b3d0a5105a0ebe3434ee5e9e61

Analysis

max time kernel
557s
max time network
1574s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adobe-air-51-1-1-3.exe
Size

5.9MB
MD5

34dba7939065022ad74458acbae28abd
SHA1

5f4e6e7cc0f2970068ff1c05189a8dc6881b8d33
SHA256

da506fa70f7953e840f3eba28faf557a2038e0b3d0a5105a0ebe3434ee5e9e61
SHA512

6271f67b486c7273fd391e4379f987fcce3042947909e97d05290d04469588a94bd501685f686037a400b788d6693e73f7d7799069c772b80da9556322c6cc79
SSDEEP

98304:FOB7drLD5C522D5K6O6DWT9dCrVodEdhIW5LkrNcBByeTTC3qdqH2pjin6uYRjUI:gB7drxU22DJVAbAeOIyBBNiKqMbZUI

Score

10^/10

pandastealer discovery phishing stealer

Malware Config

Signatures

Panda Stealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000500000001a469-4410.dat	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Pandastealer family
pandastealer
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Blocklisted process makes network request 2 IoCs

flow	pid	Process
13	5084	msiexec.exe
18	5084	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs

Web Service

T1102

flow	ioc
345	yandex.com
350	yandex.com
358	yandex.com
359	yandex.com
290	yandex.com
296	yandex.com
251	yandex.com
337	yandex.com
310	yandex.com
319	yandex.com
362	yandex.com
275	yandex.com
309	yandex.com
297	yandex.com
299	yandex.com
307	yandex.com
318	yandex.com
326	yandex.com
327	yandex.com
92	yandex.com
201	yandex.com
360	yandex.com
329	yandex.com
340	yandex.com
331	yandex.com
291	yandex.com
323	yandex.com
301	yandex.com
322	yandex.com
328	yandex.com
346	yandex.com
202	yandex.com
278	yandex.com
334	yandex.com
259	yandex.com
304	yandex.com
320	yandex.com
230	yandex.com
305	yandex.com
357	yandex.com
361	yandex.com
363	yandex.com
242	yandex.com
354	yandex.com
295	yandex.com
298	yandex.com
332	yandex.com
336	yandex.com
338	yandex.com
347	yandex.com
240	yandex.com
293	yandex.com
267	yandex.com
283	yandex.com
308	yandex.com
314	yandex.com
353	yandex.com
93	yandex.com
94	yandex.com
342	yandex.com
351	yandex.com
352	yandex.com
289	yandex.com
312	yandex.com

Drops file in Program Files directory 39 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe	msiexec.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe	msiexec.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\template.exe	msiexec.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\setup.swf	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\NPSWF32.dll	msiexec.exe
File created	C:\Program Files (x86)\Transformice\META-INF\AIR\application.xml	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe AIR\sentinel	msiexec.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe Root Certificate.cer	msiexec.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\airappinstaller.exe	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\WebKit.dll	msiexec.exe
File created	C:\Program Files (x86)\Transformice\icone48.png	msiexec.exe
File created	C:\Program Files (x86)\Transformice\META-INF\signatures.xml	msiexec.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe	msiexec.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\template.msi	msiexec.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\Thawte Root Certificate.cer	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\digest.s	msiexec.exe
File created	C:\Program Files (x86)\Transformice\Transformice.exe	msiexec.exe
File created	C:\Program Files (x86)\Transformice\mimetype	msiexec.exe
File created	C:\Program Files (x86)\Transformice\META-INF\AIR\hash	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll	msiexec.exe
File created	C:\Program Files (x86)\Transformice\icone128.png	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe Root Certificate.cer	msiexec.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\digest.s	msiexec.exe
File created	\??\c:\Program Files (x86)\Adobe\Flash Player\AddIns\airappinstaller\airappinstaller.exe	msiexec.exe
File created	\??\c:\Program Files (x86)\Adobe\Flash Player\AddIns\airappinstaller\digest.s	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\setup.swf	msiexec.exe
File created	C:\Program Files (x86)\Transformice\TransformiceAIR.swf	msiexec.exe
File created	C:\Program Files (x86)\Transformice\icone16.png	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.swf	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Thawte Root Certificate.cer	msiexec.exe
File created	C:\Program Files (x86)\Transformice\icone32.png	msiexec.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll	msiexec.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.swf	msiexec.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\stylesNative.swf	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\setup.msi	adobe air installer.exe
File created	C:\Program Files (x86)\.airInstallTmpFile.tmp	Adobe AIR Application Installer.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe AIR\sentinel	msiexec.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI9373.tmp	msiexec.exe
File created	\??\c:\Windows\Installer\f7773aa.msi	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\8663020007180A44EB446B23AFD487F0	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\8663020007180A44EB446B23AFD487F0\1.0.8	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\8663020007180A44EB446B23AFD487F0\1.0.8\AdobeAIR.dll	msiexec.exe
File created	\??\c:\Windows\Installer\$PatchCache$\Managed\8663020007180A44EB446B23AFD487F0\1.0.8\air.exe	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\8663020007180A44EB446B23AFD487F0\1.0.8\air.exe	msiexec.exe
File created	C:\Windows\Installer\f7773c8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7773c6.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8187.tmp	msiexec.exe
File created	\??\c:\Windows\Installer\$PatchCache$\Managed\8663020007180A44EB446B23AFD487F0\1.0.8\AdobeAIR.dll	msiexec.exe
File created	\??\c:\Windows\Installer\$PatchCache$\Managed\8663020007180A44EB446B23AFD487F0\1.0.8\air.swf	msiexec.exe
File created	\??\c:\Windows\Installer\f7773b3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7773c3.msi	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\f7773aa.msi	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\8663020007180A44EB446B23AFD487F0\1.0.8\air.swf	msiexec.exe
File created	\??\c:\Windows\Installer\$PatchCache$\Managed\8663020007180A44EB446B23AFD487F0\CacheSize.txt	msiexec.exe
File created	C:\Windows\Installer\f7773c3.msi	msiexec.exe
File created	C:\Windows\Installer\f7773c6.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3F6E.tmp	msiexec.exe
File created	\??\c:\Windows\Installer\f7773ad.ipi	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\8663020007180A44EB446B23AFD487F0\CacheSize.txt	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\f7773ad.ipi	msiexec.exe

Executes dropped EXE 7 IoCs

pid	Process
2724	Adobe AIR Installer.exe
4268	adobe air installer.exe
6944	Transformice.exe
3976	Install Transformice.exe
2824	Adobe AIR Application Installer.exe
6352	Adobe AIR Updater.exe
6668	Transformice.exe

Loads dropped DLL 30 IoCs

pid	Process
2776	adobe-air-51-1-1-3.exe
2776	adobe-air-51-1-1-3.exe
2776	adobe-air-51-1-1-3.exe
2776	adobe-air-51-1-1-3.exe
2724	Adobe AIR Installer.exe
2724	Adobe AIR Installer.exe
4268	adobe air installer.exe
6944	Transformice.exe
6944	Transformice.exe
6944	Transformice.exe
6944	Transformice.exe
3976	Install Transformice.exe
3976	Install Transformice.exe
3976	Install Transformice.exe
2824	Adobe AIR Application Installer.exe
2724	Adobe AIR Installer.exe
2724	Adobe AIR Installer.exe
2724	Adobe AIR Installer.exe
2724	Adobe AIR Installer.exe
2724	Adobe AIR Installer.exe
6352	Adobe AIR Updater.exe
6352	Adobe AIR Updater.exe
6352	Adobe AIR Updater.exe
6352	Adobe AIR Updater.exe
6352	Adobe AIR Updater.exe
2824	Adobe AIR Application Installer.exe
2824	Adobe AIR Application Installer.exe
2824	Adobe AIR Application Installer.exe
2824	Adobe AIR Application Installer.exe
6668	Transformice.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Transformice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adobe-air-51-1-1-3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adobe AIR Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adobe air installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Transformice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install Transformice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adobe AIR Application Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adobe AIR Updater.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	adobe air installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Adobe AIR Updater.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Transformice.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	adobe air installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Adobe AIR Installer.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Adobe AIR Application Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Adobe AIR Application Installer.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Adobe AIR Updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Transformice.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Adobe AIR Installer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_IMG	Adobe AIR Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\Adobe AIR Installer.exe = "1"	Adobe AIR Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	Adobe AIR Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	Adobe AIR Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	Adobe AIR Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Adobe AIR Installer.exe = "32767"	Adobe AIR Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_IMG\Adobe AIR Installer.exe = "1"	Adobe AIR Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT	Adobe AIR Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\Adobe AIR Installer.exe = "1"	Adobe AIR Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Adobe AIR Installer.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D23A06E79DA76FC73187F2CBBD3BE717\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D23A06E79DA76FC73187F2CBBD3BE717\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AIR.InstallerPackage\ = "Installer Package"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AIR.InstallerPackage\DefaultIcon\ = "c:\\PROGRA~2\\COMMON~1\\ADOBEA~1\\Versions\\1.0\\ADOBEA~1.EXE,1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE6F249802136F443B6919B0C761E42A\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D23A06E79DA76FC73187F2CBBD3BE717\Application	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D23A06E79DA76FC73187F2CBBD3BE717\ProgramShortcut	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE6F249802136F443B6919B0C761E42A\SourceList\LastUsedSource = "n;1;c:\\users\\admin\\appdata\\local\\temp\\air340b.tmp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D23A06E79DA76FC73187F2CBBD3BE717\Version = "16777216"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D23A06E79DA76FC73187F2CBBD3BE717\SourceList\PackageName = "setup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D23A06E79DA76FC73187F2CBBD3BE717\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D23A06E79DA76FC73187F2CBBD3BE717\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AIR9D0A.tmp\\Transformice\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EE6F249802136F443B6919B0C761E42A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE6F249802136F443B6919B0C761E42A\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE6F249802136F443B6919B0C761E42A\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D23A06E79DA76FC73187F2CBBD3BE717	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D23A06E79DA76FC73187F2CBBD3BE717\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D23A06E79DA76FC73187F2CBBD3BE717\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.air	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.air\ = "AIR.InstallerPackage"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE6F249802136F443B6919B0C761E42A\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE6F249802136F443B6919B0C761E42A\SourceList\Net\1 = "c:\\users\\admin\\appdata\\local\\temp\\air340b.tmp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE6F249802136F443B6919B0C761E42A\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE6F249802136F443B6919B0C761E42A\PackageCode = "BBD26563A231C6047BF676630876766C"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE6F249802136F443B6919B0C761E42A\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE6F249802136F443B6919B0C761E42A\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8663020007180A44EB446B23AFD487F0\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.air\OpenWithProgids	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D23A06E79DA76FC73187F2CBBD3BE717	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D23A06E79DA76FC73187F2CBBD3BE717\PackageCode = "D23A06E79DA76FC73187F2CBBD3BE717"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0449CE60EFC8852D9C0992133D806BBE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D23A06E79DA76FC73187F2CBBD3BE717\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D23A06E79DA76FC73187F2CBBD3BE717\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D23A06E79DA76FC73187F2CBBD3BE717\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AIR.InstallerPackage\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.air\Content Type = "application/vnd.adobe.air-application-installer-package+zip"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AIR.InstallerPackage\DefaultIcon	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8663020007180A44EB446B23AFD487F0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D23A06E79DA76FC73187F2CBBD3BE717\ProductName = "Transformice"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AIR.InstallerPackage\shell\open\command\ = "c:\\PROGRA~2\\COMMON~1\\ADOBEA~1\\Versions\\1.0\\ADOBEA~1.EXE \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EE6F249802136F443B6919B0C761E42A\Runtime	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EE6F249802136F443B6919B0C761E42A\Management	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE6F249802136F443B6919B0C761E42A\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AIR.InstallerPackage\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.air\OpenWithProgids\AIR.InstallerPackage	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE6F249802136F443B6919B0C761E42A\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE6F249802136F443B6919B0C761E42A\SourceList\PackageName = "setup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D23A06E79DA76FC73187F2CBBD3BE717\DesktopShortcut	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE6F249802136F443B6919B0C761E42A\ProductName = "Adobe AIR"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5D029AD8C14C0E24FB1378AB9489E44E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D23A06E79DA76FC73187F2CBBD3BE717\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\AIR9D0A.tmp\\Transformice\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D23A06E79DA76FC73187F2CBBD3BE717\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D23A06E79DA76FC73187F2CBBD3BE717\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AIR.InstallerPackage\shell\open\ = "Install"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE6F249802136F443B6919B0C761E42A\Version = "855703553"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE6F249802136F443B6919B0C761E42A\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8663020007180A44EB446B23AFD487F0\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8663020007180A44EB446B23AFD487F0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AIR.InstallerPackage	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE6F249802136F443B6919B0C761E42A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5D029AD8C14C0E24FB1378AB9489E44E\EE6F249802136F443B6919B0C761E42A	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8663020007180A44EB446B23AFD487F0\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0449CE60EFC8852D9C0992133D806BBE\D23A06E79DA76FC73187F2CBBD3BE717	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE6F249802136F443B6919B0C761E42A\DeploymentFlags = "3"	msiexec.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	Adobe AIR Updater.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Adobe AIR Updater.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280	Adobe AIR Updater.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183040000000100000010000000c6150925cfea5941ddc7ff2a0a5066920f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc180000000100000010000000fd960962ac6938e0d4b0769aa1a64e264b0000000100000044000000420036003600320034003000420030004600360043003800340042004400340038003500370041004200410036003000430046003500430045003400410030005f000000200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	Adobe AIR Updater.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2868	chrome.exe
2868	chrome.exe
5084	msiexec.exe
5084	msiexec.exe
5084	msiexec.exe
5084	msiexec.exe
5084	msiexec.exe
5084	msiexec.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	4268	adobe air installer.exe
Token: SeIncreaseQuotaPrivilege	4268	adobe air installer.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeSecurityPrivilege	5084	msiexec.exe
Token: SeCreateTokenPrivilege	4268	adobe air installer.exe
Token: SeAssignPrimaryTokenPrivilege	4268	adobe air installer.exe
Token: SeLockMemoryPrivilege	4268	adobe air installer.exe
Token: SeIncreaseQuotaPrivilege	4268	adobe air installer.exe
Token: SeMachineAccountPrivilege	4268	adobe air installer.exe
Token: SeTcbPrivilege	4268	adobe air installer.exe
Token: SeSecurityPrivilege	4268	adobe air installer.exe
Token: SeTakeOwnershipPrivilege	4268	adobe air installer.exe
Token: SeLoadDriverPrivilege	4268	adobe air installer.exe
Token: SeSystemProfilePrivilege	4268	adobe air installer.exe
Token: SeSystemtimePrivilege	4268	adobe air installer.exe
Token: SeProfSingleProcessPrivilege	4268	adobe air installer.exe
Token: SeIncBasePriorityPrivilege	4268	adobe air installer.exe
Token: SeCreatePagefilePrivilege	4268	adobe air installer.exe
Token: SeCreatePermanentPrivilege	4268	adobe air installer.exe
Token: SeBackupPrivilege	4268	adobe air installer.exe
Token: SeRestorePrivilege	4268	adobe air installer.exe
Token: SeShutdownPrivilege	4268	adobe air installer.exe
Token: SeDebugPrivilege	4268	adobe air installer.exe
Token: SeAuditPrivilege	4268	adobe air installer.exe
Token: SeSystemEnvironmentPrivilege	4268	adobe air installer.exe
Token: SeChangeNotifyPrivilege	4268	adobe air installer.exe
Token: SeRemoteShutdownPrivilege	4268	adobe air installer.exe
Token: SeUndockPrivilege	4268	adobe air installer.exe
Token: SeSyncAgentPrivilege	4268	adobe air installer.exe
Token: SeEnableDelegationPrivilege	4268	adobe air installer.exe
Token: SeManageVolumePrivilege	4268	adobe air installer.exe
Token: SeImpersonatePrivilege	4268	adobe air installer.exe
Token: SeCreateGlobalPrivilege	4268	adobe air installer.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2724	Adobe AIR Installer.exe
2724	Adobe AIR Installer.exe
2724	Adobe AIR Installer.exe
4268	adobe air installer.exe
2824	Adobe AIR Application Installer.exe
6352	Adobe AIR Updater.exe
6668	Transformice.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2724	2776	adobe-air-51-1-1-3.exe	30
PID 2776 wrote to memory of 2724	2776	adobe-air-51-1-1-3.exe	30
PID 2776 wrote to memory of 2724	2776	adobe-air-51-1-1-3.exe	30
PID 2776 wrote to memory of 2724	2776	adobe-air-51-1-1-3.exe	30
PID 2776 wrote to memory of 2724	2776	adobe-air-51-1-1-3.exe	30
PID 2776 wrote to memory of 2724	2776	adobe-air-51-1-1-3.exe	30
PID 2776 wrote to memory of 2724	2776	adobe-air-51-1-1-3.exe	30
PID 2868 wrote to memory of 2640	2868	chrome.exe	32
PID 2868 wrote to memory of 2640	2868	chrome.exe	32
PID 2868 wrote to memory of 2640	2868	chrome.exe	32
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 2556	2868	chrome.exe	34
PID 2868 wrote to memory of 1768	2868	chrome.exe	35
PID 2868 wrote to memory of 1768	2868	chrome.exe	35
PID 2868 wrote to memory of 1768	2868	chrome.exe	35
PID 2868 wrote to memory of 2576	2868	chrome.exe	36
PID 2868 wrote to memory of 2576	2868	chrome.exe	36
PID 2868 wrote to memory of 2576	2868	chrome.exe	36
PID 2868 wrote to memory of 2576	2868	chrome.exe	36
PID 2868 wrote to memory of 2576	2868	chrome.exe	36
PID 2868 wrote to memory of 2576	2868	chrome.exe	36
PID 2868 wrote to memory of 2576	2868	chrome.exe	36
PID 2868 wrote to memory of 2576	2868	chrome.exe	36
PID 2868 wrote to memory of 2576	2868	chrome.exe	36
PID 2868 wrote to memory of 2576	2868	chrome.exe	36
PID 2868 wrote to memory of 2576	2868	chrome.exe	36
PID 2868 wrote to memory of 2576	2868	chrome.exe	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\adobe-air-51-1-1-3.exe
"C:\Users\Admin\AppData\Local\Temp\adobe-air-51-1-1-3.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\AIR340B.tmp\Adobe AIR Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\AIR340B.tmp\Adobe AIR Installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724
- - C:\Users\Admin\appdata\local\temp\air340b.tmp\adobe air installer.exe
    "C:\Users\Admin\appdata\local\temp\air340b.tmp\adobe air installer.exe" -stdio \\.\pipe\AIR_2724_0 -ei
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4268
- - \??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe
    "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe" -installupdatecheck
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies system certificate store
    - Suspicious use of SetWindowsHookEx
    PID:6352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefb979758,0x7fefb979768,0x7fefb979778
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:2
  2⤵
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1548 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1672 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2348 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2352 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1176 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:2
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2868 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4032 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:1
  2⤵
  PID:7740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2464 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:1
  2⤵
  PID:7916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2268 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:1
  2⤵
  PID:7944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4156 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:1
  2⤵
  PID:8156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4028 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4688 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:8
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4824 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:8
  2⤵
  PID:6700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5196 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:8
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5228 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:8
  2⤵
  PID:5844
- C:\Users\Admin\Downloads\Transformice.exe
  "C:\Users\Admin\Downloads\Transformice.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6944
- - C:\Users\Admin\AppData\Local\Temp\AIR9D0A.tmp\Install Transformice.exe
    "C:\Users\Admin\AppData\Local\Temp\AIR9D0A.tmp\Install Transformice.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3976
  - - \??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe
      "Adobe AIR Application Installer.exe" "C:\Users\Admin\AppData\Local\Temp\AIR9D0A.tmp\Transformice"
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious use of SetWindowsHookEx
      PID:2824
    - - C:\Program Files (x86)\Transformice\Transformice.exe
        
        "C:\Program Files (x86)\Transformice\Transformice.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:6668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=692 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:1
  2⤵
  PID:7532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3036 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:1
  2⤵
  PID:6440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1496 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:8
  2⤵
  PID:8824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4204 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:8
  2⤵
  PID:5232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4100 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=4108 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=4152 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5000 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:1
  2⤵
  PID:6616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5020 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=4908 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=3840 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:1
  2⤵
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3688 --field-trial-handle=1400,i,4026151023864592257,15347831360764242966,131072 /prefetch:8
  2⤵
  PID:8980

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1596

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7773ae.rbs

Filesize
14KB

MD5
d9357ab2622175c4fec381771b0b6572

SHA1
d7bb91329b5b271df2a4876f78cf121c5a914bca

SHA256
0952b08626e8540d65c560d61499e940048e274bd1d85df85bdc1f428c73b256

SHA512
87b29cf6b1ef52d13d1972288fec1d27e87315db85c7c8d461c3cefe4cd95a42492fdc5d9fed3c383fa280b6457f351a50871d1baee93886ffb94532537165a5

Download Submit
C:\Config.Msi\f7773b6.rbs

Filesize
11KB

MD5
018c5d77214bdb74654c9562c2253693

SHA1
1dd62224b6e6638ca70ad7bdeb1e1065974ff3fb

SHA256
924ca521efed2cc67c493c850b88c63f87d9ec807434873cab567b1c1d22031d

SHA512
bd20a10fe90372634b75053877461672596dc7a610392dc0ae2254f5e8c46eead9dab2344852a5558d249c7a8dade2b2e2c2846935ee4a47c014684e80ccd6a3

Download Submit
C:\Config.Msi\f7773c2.rbf

Filesize
3B

MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
C:\Config.Msi\f7773c7.rbs

Filesize
9KB

MD5
4105a05f74415b512d3a0fd66f2a6a86

SHA1
186173c04176b53379dcd012712558d39e6b31c2

SHA256
4c5cf08eda91c118ed7d972f2a5dc20b454c49e92fd416abb648f72e1ebbfdc2

SHA512
fad85759cde9769e6eea9b7b22e162f8c3da7e16fbf1f0a32adfe55e2a6cf4a784e46b63fdbf110fb7104e89255c66b62568a8497e81e0cb5ac75a58fbacaac3

Download Submit
C:\Program Files (x86)\Transformice\Transformice.exe

Filesize
139KB

MD5
055a34bd625727d3e1f9fc15e2ff6c3b

SHA1
d9f23f91240c6ebdb6cb88f25b43ac68da40d6be

SHA256
a0c992369f8bf35c5856d1fd4930ac72c682bb74d8f6764466e4630b1a6a9347

SHA512
28afec89c505bc01592774e1a2eb14b4d104a13c2e351cd3c468cec7314be0af86561b8e1684765ef254f776416dd69009b9cdd1a577ce63e2ee5af4d44904ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c23cc22ec43a13c94dca497df779ba56

SHA1
911f8a3607a9d33fa7d7e47ca262e00b8c97fd36

SHA256
236e798dfd04726e3d2effe2917090630354489a801b55975144096951351f7d

SHA512
d4bc2c0ed050b6eccb1b6960403cc3b4fa05202106344c5ae6670fa17ffda7bc3c4db6ef6d40d446226802ad25ed38b500e1f7dd7182729d525e48820f22029e

Download Submit
C:\Users\Admin\AppData\Local\Adobe\AIR\logs\Install.log

Filesize
692B

MD5
06157082d814d50f7caf29d9f3fb02a2

SHA1
8c006ae4a7fc1a54a9dd0811a12cfafde61c0aa8

SHA256
57cb253ee15361a93b3475f580878cf4add3aeb892593c20cdf92349739cc96d

SHA512
977e2fc452f9054d6644573efaa79e048a53d6e701f97e619274d20b9f1cd8ec50c4d2df529e99158046e89c71d3d1208a9175c8d9be997fbb690d7819b1e72d

Download Submit
C:\Users\Admin\AppData\Local\Adobe\AIR\logs\Install.log

Filesize
1KB

MD5
9d745075fc81cc1eb5f4b932ac3f811d

SHA1
df06cbb99e36b03967b8bf6f9104def755344528

SHA256
82a1f7ccf8922efe06d41e55b987e8fd3a9ba0faed2ffdf975f1306e93360ad6

SHA512
19e3cf543a5485d259320c5d164fa554a5e4536aa587c7242c525c2fcd1c860ea348719d4415e58c5bad321e0906b324745a7b67dd9f6d25627f68472045e172

Download Submit
C:\Users\Admin\AppData\Local\Adobe\AIR\logs\Install.log

Filesize
1KB

MD5
f191553cda3e89faf3c5187110c11d62

SHA1
cdbd4c42fc4b688d53416b4a04d05994b39a1efa

SHA256
5f85264b4b7f1688dac14201507f35a9f2f46166410c6dcb2fe823971fdc607e

SHA512
23449d151c4bdcd32340f43fd2b7bc3d499b2d1063008e394c1eee49e9220b5216f0ad739d82fdf7c8eadd500b645159d656c61d35828bb65237111dfbedc1f8

Download Submit
C:\Users\Admin\AppData\Local\Adobe\AIR\logs\Install.log

Filesize
1KB

MD5
0e443d93cb60c9a817e9c2c53eda9ec0

SHA1
92efb8534675ba3b6817c7bef9ae981daf3e3a35

SHA256
60e61cdde99b79d530cb3c3a52aa75c24b8223ab45997c3295503793ba19d4d4

SHA512
e9b5d0ea281e73e95c7529fd78040df565bcd63b8b273d6cd83f5536e39516b0bc11d1eefc2ca2b64fd47651909b1ef4f2487fd6c152382c285110f985d31274

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f

Filesize
39KB

MD5
074d7c0ab0352d979572b757de8b9f0c

SHA1
ca7dd3b86c5e8a750401b8d6d773a9cc3af55b81

SHA256
46a06c3ec01cd4c5d5d8bb131febc48e3b1eeac94a47fe0718dfce6af821f83a

SHA512
00de9f645ca784322b005c73302aa573ab0665e8334533e7408326f0c84c12f3d056f39a2197d5c4bb8092f3b09dec4b79ec73de1b5d161951c5c48b9548216d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000048

Filesize
20KB

MD5
59ee96aea4061c8a38d2506c4805354c

SHA1
273902cf69f0ac50ad5c654fa14ca8ddc295b99f

SHA256
7c8672db679b72c70317a6edbf0c2311ed3653e1d911376cf232e334ec7eaf4f

SHA512
6ddc4427481f02ee4f3246384671ff8d41d856d8b0e281c651431a2377b16991c5bc3a3fafb5c1f80ccb05f9219cf201f9ec547286940584c0a671dcfbfefa3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000050

Filesize
41KB

MD5
ca9e4686e278b752e1dec522d6830b1f

SHA1
1129a37b84ee4708492f51323c90804bb0dfed64

SHA256
b36086821f07e11041fc44b05d2cafe3fb756633e72b07da453c28bd4735ed26

SHA512
600e5d6e1df68423976b1dcfa99e56cb8b8f5cd008d52482fefb086546256a9822025d75f5b286996b19ee1c7cd254f476abf4de0cf8c6205d9f7d5e49b80671

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b529ee5e74321224cb3a18eac8abaff3

SHA1
cc980a6de49f1ac0199c74826aac2758b9d12982

SHA256
6d74c8b23a4ccec2c27becb8d8f3ed6277b1639a819de45d42823992c3fca68b

SHA512
722fefb5c728866c7ba595fef0f4d5eac201976589d46acc1d4ee896e8849140cb9694a4d618417e43f8b68fbd1d1f83c5407901c945505802dd80d9c11badc3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
704f6512f3749ecdebdfe9c6fe88b9a8

SHA1
31f198411a86bc62deb718ed12a70d5528ad891e

SHA256
dca325bfa62454d1df1de5decafd19a134dbfaeb75bfe6fd87437387ec77a025

SHA512
ae34fb7e39748e4aa875d725f8922388cdd27b423b95aa888a60609fe958640604516bcf80214885d48070c288f45fa9ff54b584858d81b375e0eabfef521dc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT~RFf778759.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5783f9e5-c172-4fa5-9ceb-71a95b8c7a0c.tmp

Filesize
9KB

MD5
70229b88662d18d2bd924446af4d3d62

SHA1
14166f7cae5cdb5873bf9fa9655f298b8256e540

SHA256
c6057854ffbb2076751116b8f0c8a0102cfcd04fc86b49fd4dd2231bf89dbe54

SHA512
9e4124a3d436e209f8ab2d5d4b209bf32d7cc7c44087c50746200638f6100e802085e91ad4b124402d42e3bb013c053cb6b5949a8e20f3c2059382b286a90e5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
a8a0cbebd6f27a4e60f27c3ac642e195

SHA1
0914c78165d5aa730e06d6c9ee8e9ef2261e2da9

SHA256
6a8a9c60c4bf872a6c89f116ec583554d47cebb3fc3ec6f49f74db40a47b2ed4

SHA512
805b8eb2ae1aadf71461ad02d02a8416f10df4bf9f859aa344c669c09b5ceb1da6184186b76be377887ada0c3d7e415240adc444259aae87c95d7413b1a9f948

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
e090dd155c92425d3c922f0b4001592c

SHA1
528aded828310899e72fcfc8e41f5943fd83f490

SHA256
fc6b5735c29a3432bd1122ace57300cb6408135a11132d310a17dfa21f305f28

SHA512
e38d4a2d7d3f4dbda28800ab67f09b61b6fb6ec27eeb20aedb2d9911f4e2cc60bb9ccd7e0ad0662518223ef4f8bfd18cab1499d805be31b4113ae8004d6b025d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
52c0a276dc0436c69fc3a60dd557cf14

SHA1
d63cf574b7ea21fa84c1221629b2037ad1586a46

SHA256
5a49f68f1b2e3c9c22f4f44160dfb7c298459e0852c09543c095e3ea0ab06d09

SHA512
548069ac56293758d4e1118f9148a8866df13b41706b5daa619639316bb61e36bc244d1073f3e110840c2851f55a7a76ced3e1c887aea62419b64e353e9a334a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
62844360bd20851cd7d317d32fc87f9e

SHA1
8fcac751997c4f098890e4a869955a5b0caddc9e

SHA256
70dad039f92f203f48d5d8e64a2acca3f849f66f6b1e5c125f7d85b41110594f

SHA512
06ce53ec090e8bb72df1293f7013e0e0f9d50d130e6d24dcc615f38eb752d4d0148795cdc9f50d03f7b0ec1357e3bf196e84d23ccb139030663e24bebfe4b97a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
cf65d2647fe273c62f6127dc07b3ece6

SHA1
70c6c39d584b619016ee2bb02d7de2dad67ebf67

SHA256
dbe7b70b41ee57dd4abcd3265eb7e57573447d5231386ee6484b1e87a6c72975

SHA512
f50344573014e28b4820cf51a666760ab0e7c91ac401aa304c627fe7645d39fdffb361f646fa04c319a4b64d9b01d9512faddef7d293871bc13e1e89029361a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
690B

MD5
fdacb23ee435e2f374fd5546857320e0

SHA1
a299cc04e8ff0482d87c7c067c17db9e4c9285f2

SHA256
6443d1ba82761fee4942b95fe614ea9c23987ed411d1a48179977fc7f2b77bc7

SHA512
f49723c2ebf699bd4466e8a853cf84172468f9c466c484d0f65f3a563edb592db06b71b8f74536f36d63aabcb85d44769c8d7723dfcb8a10f07567a213d7c689

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
bb39909695c6d9a9118ab1cdcdc5a543

SHA1
59ea6fed05f0b03311f472be648e93ef71ebb4e8

SHA256
0412c325fb28c11475efde774b85f8064d80418ebde991c0f54d7cfd81e3fa19

SHA512
a7c978a11156b5213c98543c11ac1d0adf19aca466c53af97885e2b28bcfd79e62ce515b0d47ca88621d8ab3d538b6a1ed104476e6152863b40297119fe0197c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
88bf56817ee5baf400f5f04ce7045615

SHA1
ab360379ce705c275a56324b5f515688b30eb491

SHA256
0a6a09a952cc6b040e6bcab70b6e7bda69e7058f876dcdc965e537ce831ba968

SHA512
03917ef79b75266318dc4bc419e40ec0a9a18b483a1ca18ebc55c89a5d81cde130e103931bb825026342c7311cad06e525369236ea6aac3a982159f9f9f498c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4d0f9cb4a2aa83e54ec1eb3d96d0eec1

SHA1
60518805a90dafb7de02be82b1d5fb7749792ec4

SHA256
2c84237d5a7764803b44acbcab95736d8adbad6242257f6ba439a8285116bea0

SHA512
4fb212247d5b0d2e473d1685dfe879c4f090334ae4de63ac2a5458871fd914499dc78ff1c897764e2b463e3583eb71c880422f667022b1f8634ba8e084602f3e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
eb70153f0fd7c1e1518f747cf295b2a8

SHA1
2dcca3ee1a350017c3846908ca7d363b0d5ac38c

SHA256
c285e2a4503a3de574f2001f0b00c30f277b8f9d21736791ce6260bd314f337c

SHA512
8fde0990015c4dcb208c2610744b92ec9eca4982abcc4718fec534e503bf2577400934593bbbbe2450fbf3d26e47e0dadb62ef50c8f870cfde29512d3b2d751d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
727de25e178c8ec203a9068e2223556d

SHA1
f0417e86ed2120e0d2c0fc05a4e5afe5bad12fdb

SHA256
91028e38dce82afa0504fa46f05755ca9ca7bb8a5b13516e4b2bd411c9b5d58a

SHA512
d1068c8b83c0ac27172d26b0784b54105d770106eeaab2652a4f40dd8c3c2e75262b6c1f977eec48558f5ff0a052ab6965f196413b2c3d961558d189a9c10f94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
36b8866025fcc38946673d3cae54f827

SHA1
aa2b256db32e23899f59e3253d0e2cf52e377c7c

SHA256
0e4661971ecde2aabe9746f1d4b0708849c96d48328fe5b406a77b4fd8beaa1f

SHA512
ff698a757c41aba1fa198bd9b84b080bea33ff054e711e3787d109671d056ac2fd1e0b946b395d5db9f01928dbff55a8be1c9ecb14dd848babfcd3778fa5e144

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
352KB

MD5
12ec20ac835412928e87d32918e0bacc

SHA1
d155a4dd0dcdcc8ae45dec75d10e66da4532f784

SHA256
1b5e598613c9023aacfa86cefab9db94b1335c8aebd0e9abaf7936bf226747c5

SHA512
8c22b52c5e983ea9cdfe90a5373c54ed95f0fe6981098c83d012334169f8d3650caa759f3dc42db0dfc522fbf73a50f68cb0e05e0ea4a36659d8c822c59c511b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
352KB

MD5
d6b3e94974e5df5ed8b6750b91e6f577

SHA1
3ab62bd5643b9dca6f117205d31468cc6a4c0c69

SHA256
069a647edd9ba4b7e96e639e2da3a222448a6f17348520688b6ff1db30c99927

SHA512
4275eb0acdc5e2e6c5126e2725da8d837fd7164c5542d2b5d905eb6db360497d06feb9bc82ae63d837ed936049a4f76a9f248df1d981a2c6172aeaa7bb0a30d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\AIR340B.tmp\Adobe AIR\Versions\1.0\Adobe AIR.dll

Filesize
13.4MB

MD5
b10e155460556fa4667536de7bb40e43

SHA1
a17872d7ff29a307fac5b4ed98887a420f716964

SHA256
371c442e9ce81a9514d25eccbe6e9c37a7b766bc5de1a7e03e50ac77cb8ce374

SHA512
4a3d2b0ec3d3ae868c50530136da228d835234198a41aa47ef11c40843249bad29425d50967ce8205c948336d02107e69655900c071cb5b3cb0c63e57ea557d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\AIR340B.tmp\setup.swf

Filesize
512KB

MD5
ad5f7d53caef368303bebde302582d92

SHA1
9efad61bf69e80d7468236695e0a108d360ae749

SHA256
2b501bfdb378ba7130b8e4b4b2263adfb4f95887cf071ded134f4cffeee5f40d

SHA512
8a31c0009c915dbb46c054388d793c1db8fc7b5ae1df419b3f284cad1d2f8db1f2ed759dcb126868d64af8a0a94c9e479776e6da86296af4e73a0850821c49e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\AIR9D0A.tmp\.launch

Filesize
24B

MD5
71100a118618ca9623f517d7468278d1

SHA1
d0bca87f671fc06774cb667cf8bef962a0278ccc

SHA256
307a9865fd68d697675818cbd36f386102aae93b3ffc9526fa44deb0e541f2f0

SHA512
0a1f22d1e03f6af658d6c0377238c48b8a99adc1eaa3137cfd6def40f655762cca40e7b48ad2a77dd53b869b333300a7c68762da3feeee86e7c4837416679ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7448.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7573.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\Downloads\Transformice.exe

Filesize
268KB

MD5
e0d19351dd3e1d5361def38659318249

SHA1
e6824969ebea151c77080b445ac416b56dd8630d

SHA256
6f378db45311af48c29fbd47550e7c181c748c1dab76cadd1f1f1c872ad288c8

SHA512
a684739e9f9283f1ad6dea9747fe46fd2feb9fb7854d128cd34b3543109cfc7c1f9cd21890ca27e55afd88d082ba81507eb3382968ba09cd33afc8208f33ec4b

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\8663020007180A44EB446B23AFD487F0\1.0.8\AdobeAIR.dll

Filesize
8.0MB

MD5
479dfeb6bfdb8035dd2bf79cabb39e65

SHA1
e1b8a1363189abc7d3f7459bd6740682e43b30f2

SHA256
814728159d8e316eb6bc09fb1dafef911b708d1d1f51e8e866fee8e7965ce05e

SHA512
2650454e22176d31415c3be4dca4ed887bf30adf4f3655dde5d9cd538025b662ec9bf39657aff540c68aa1e4494c449099bc1a693ea2f835bd41ac51169778ca

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\8663020007180A44EB446B23AFD487F0\1.0.8\air.exe

Filesize
59KB

MD5
5e9d2fccad3b9edbc0a8ab0fe1e5e510

SHA1
4f74227b71e570f57e0bf611de8fe2b73cd3aba3

SHA256
ba7cd3c2ef37746576ea934fbbfe6ce0f659977f604cb6528e642e6d82e60ff7

SHA512
8e5ae33075564851f1534767558b1be79894858a912e5f53b00c98ad38e46bcdd17e225e32acea78b634221b506a312185ea155faaac976642c6fc8ed352f035

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\8663020007180A44EB446B23AFD487F0\1.0.8\air.swf

Filesize
352KB

MD5
8599589cb2f1cfad899f0e95c3cf2bc9

SHA1
5f749cd74d03b0d050be34eba34cfa11dabab3dc

SHA256
101140c8df33cd81af64000549872ef9e48af5913a27367e0865a4f83becc509

SHA512
216b21b7c373f083fbd4246555a94c8ade6c6d009a381d28b98a59028bc0eaf99ba937147c90184060ee3c6c6a95d9b0b249da3fb2ef16272eb881bb6e74e35d

Download Submit
C:\Windows\Installer\f7773c3.msi

Filesize
21KB

MD5
164df4c65d8e4e8d910e2a1703ca3e75

SHA1
3531024204406e602e3157ff5ca8b9e36c1111fe

SHA256
9566c1dddc1d0ad10071e9f260a05a96da4307f64a9ee59ab318aab823cfee15

SHA512
3d14ff7274ba92cee9c1c25fe08bb03b9253b2ac8e316ebd738a935bb1ec6ad17042b3dc3a8ceacc15627d91cb4ff0885e326cb8bb11a1dd5408f9a571970636

Download Submit
\??\c:\users\admin\appdata\local\temp\air340b.tmp\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe

Filesize
408KB

MD5
277739413fb03b430b50d60d679f3d97

SHA1
264da51d663ef366a19dca31faa83f2ae91c6e45

SHA256
96cf2ed23e21169633d3a78f0677fd28754c1f491d590809506dc075bb49eda3

SHA512
8429fa88b6e1eb072edaf28c79b320a6150f0579376d61c7f11a31b59a116848cff5315373a0393c238e1d19b4e4b5bd282f9de54a7749db658dda073f227cca

Download Submit
\??\c:\users\admin\appdata\local\temp\air340b.tmp\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.swf

Filesize
491KB

MD5
e9db98f0ab9334466bc94604c62e4c04

SHA1
992642151c9ef76e338509b592e29cde69383751

SHA256
c740ad52c9c1ab8d7762dd744f13742564cc1500b94d7a29bfc60311b7f22934

SHA512
7dfe2dadabeb3159a91b70280e5ca773f37d45babbe2c6a37989fc2848ffd0ec4ef9e3d8b6af69853be6adab935126b94b45216fa395c7fa0755f969c44c8c71

Download Submit
\??\c:\users\admin\appdata\local\temp\air340b.tmp\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe

Filesize
383KB

MD5
557de97331f10692a1d1a6d757587f6a

SHA1
9d12b14515b876047e42e119048a0de6f791ae7b

SHA256
ee869bed7628dc2db4dd1ece9d2dcfb084cc803a08c007d3d88b0bf3343b15cb

SHA512
8d94d98c54b457b99e2c00a99f209fecc93544b3bdb998561cc0f8dac6768e3ae93b4737e18ce51d9d9059d45fd3566be0cb67b80f067d6484d7ddfcb6670076

Download Submit
\??\c:\users\admin\appdata\local\temp\air340b.tmp\Adobe AIR\Versions\1.0\Resources\Adobe Root Certificate.cer

Filesize
1KB

MD5
bf70913ff8d6d60a47fe825330815db4

SHA1
6be8460639f5651848b2f83ab1463f5602be06c3

SHA256
944e66aa967bd390952d22426bf1dfcd379a2c87a21b942fbca79f41f0354aac

SHA512
108e3c8ec1d45de97a7efc5c6262602414bbb7a32477dd7d8aab4c9335365f2b95c52d4f708a4a7422f4d4e0877f222cd358411d7b78cebe83565954e4f465f0

Download Submit
\??\c:\users\admin\appdata\local\temp\air340b.tmp\Adobe AIR\Versions\1.0\Resources\Thawte Root Certificate.cer

Filesize
677B

MD5
7f667a71d3eb6978209a51149d83da20

SHA1
be36a4562fb2ee05dbb3d32323adf445084ed656

SHA256
6b6c1e01f590f5afc5fcf85cd0b9396884048659fc2c6d1170d68b045216c3fd

SHA512
7f7329f4f9a3fb45b8aaa8eac9191bef9db85a1bdb13ed66d1ece6a51531f216eeb736a96d8baa87e033f2b7f0b8879954bc261c4c8bd632563ba153bc07e0b0

Download Submit
\??\c:\users\admin\appdata\local\temp\air340b.tmp\Adobe AIR\Versions\1.0\Resources\airappinstaller.exe

Filesize
53KB

MD5
9cec1614a59cecacd3d31274bf00a37f

SHA1
b46af6fa2924b0c4d6e290ae0dcbc42e3d27ad1a

SHA256
e277d2a94295506fe1574cf0b4e499b204f83293b290fc1139098d55e2b7c176

SHA512
25f6c873bf406f3615bdf04aae5e66d3bd5b52bb77c7cda27a57cf5830012bcbec4cf5b0a563b868ec0fd47f1612fc4be6b6c355685db86b1da41b2bd856b64f

Download Submit
\??\c:\users\admin\appdata\local\temp\air340b.tmp\Adobe AIR\Versions\1.0\Resources\digest.s

Filesize
2KB

MD5
0f5295089e4ef5a7396007407ee21113

SHA1
e5731eaa83f4dec94fd51612beb8e72b42df8954

SHA256
4571ead5d878568c4082003d21f50a39b8687f08e8f631aa20351014373ed2b1

SHA512
49d02f3787454c9e0b77822de0f3761457eca4038fd7ba74e1c61232b5887b6f658161c7c088690641c33f4e0bad755b45886572e0cc1b468dc7d5c42f8257b3

Download Submit
\??\c:\users\admin\appdata\local\temp\air340b.tmp\Adobe AIR\Versions\1.0\Resources\stylesNative.swf

Filesize
229KB

MD5
bc2c33f2d32da05074e96ceafb8a25d1

SHA1
ab5b93ff24f10dd6446690862b34281964e70d55

SHA256
bbc0e77749778134698038ea107dd47e76e0cd849d34406eb960bf0c9f3c7a5a

SHA512
83c7676816594e5931d8a36827d492e7a52b120f23a1e3375ec0535698dbfddf955833fbf17accbe2bba05214d73eeae8ab9c0e4b3f74f796322f174f745609e

Download Submit
\??\c:\users\admin\appdata\local\temp\air340b.tmp\Adobe AIR\Versions\1.0\Resources\template.exe

Filesize
86KB

MD5
3c3024ded7007aa0d529555ac6754342

SHA1
5e3c3c583c14cc8207952bb18387e0ed852677af

SHA256
ece64eaa90de0446dbdd7fc96c36e0ed784bba0920d807cd2aeb15ea6d38d057

SHA512
38451c05dc7e65b9765dd28abe6ee8510f1e7b1f8cb683c833b601c95cb4151714a3b76581fe6841724805997db42e2e0d1f80228acf8985cd5131f64fbc9e0d

Download Submit
\??\c:\users\admin\appdata\local\temp\air340b.tmp\Adobe AIR\Versions\1.0\Resources\template.msi

Filesize
36KB

MD5
d4139b57677a2ad682938f60522e2b0f

SHA1
2ed0025422389df08373e056cd1dc6bd7295abc5

SHA256
cb2954595c2ac2c5c0ad6db3471073ea67b27e17914072f3cbf6344c97d6592d

SHA512
282db921c661601025f1c2b6e91e667ecc4f1595a85e23cd367b966df59470b910fd8e93ac4bbc1a4989f92d8245c140f8dc86036f25713951b5881acbd0c3f2

Download Submit
\??\c:\users\admin\appdata\local\temp\air340b.tmp\Adobe AIR\sentinel

Filesize
11B

MD5
a5c11ca014fe30b8085ea2e95f7196c4

SHA1
594e00fa5eaeaa9f99f7e45d92bab7dd7ca8575a

SHA256
096e4bfd9f7e1faf15058c0a0fe45e6dbd00e3e1360f21f2ca92bce16a9a919a

SHA512
9b3dd555ac1ab5e8dafcffdb6e23ebfffafecfb908c204e88a369c9c8e0fce326caa3aa2ac71be6629f018191cc379e29b1a919dc787fe29bc16c5f0ee24b26b

Download Submit
\??\c:\users\admin\appdata\local\temp\air340b.tmp\setup.msi

Filesize
48KB

MD5
5f75a11c1eb98a022e087ba7eefc2ea6

SHA1
9f46877e58f4549bcb2c4f0fd903d9fb49ecfb8a

SHA256
6f905ac0f120f11bfcf04496ae7cf6e3d0128f6cd6b08cf0cf5eab7ff9ce314b

SHA512
5f45bdffe6880197af1ae1f6ed1b1483a4595c982c39e33f89c5972658809dbd3041f0f8105206534baf129e0f5a8a51e05a4aa69b08d52edee530a2018afff8

Download Submit
\Users\Admin\AppData\Local\Temp\AIR340B.tmp\Adobe AIR Installer.exe

Filesize
383KB

MD5
6ba34f521e2de430fa5ba108e399d12e

SHA1
830ee63d8db0020201b6d0cb8d5a2ed2dd523256

SHA256
1a54ac75b4b671657c4368c6a73143e63462be076312921bc6d1e94a12426c58

SHA512
1e3826aa000abaa15d93e516b8398f31a9517d8dbbaa2ee671cfb2619af3818efe8b810e6fde3411c8b05b8c51afbd58b561c6d76e4383ac300bb7a3ce8f6401

Download Submit
\Users\Admin\AppData\Local\Temp\AIR9D0A.tmp\Install Transformice.exe

Filesize
130KB

MD5
a5da8ba949718507dfda7a816326fdbe

SHA1
3af561103bfb62fb580ab44954cd56c0aefc275f

SHA256
75eadf5339a379e93627e0a6659939d7b4f22b60849d8b906900255564ecb494

SHA512
073decc81a69fe60ee059ac086434738e702fdee078a65f1497c54d9106665687ed88b60e29ad3d750bcd1447d1ed117095941232e6c1919c2e14511befaf5c6

Download Submit
memory/6668-12679-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12677-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12676-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12675-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12674-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12673-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12672-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12671-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12670-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12669-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12668-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12667-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12666-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12665-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12664-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12663-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12662-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12661-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12660-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12659-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12658-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12657-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12656-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12654-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12653-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12652-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12651-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12649-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12648-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12647-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12646-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12645-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12644-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12643-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12642-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12640-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12639-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12638-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12636-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12635-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12633-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12631-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12630-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12629-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12628-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12627-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12626-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12624-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12622-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12621-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12620-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12619-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12678-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12680-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12681-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12682-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12683-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12655-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download
memory/6668-12623-0x000000000C6A0000-0x000000000C8A0000-memory.dmp

Filesize
2.0MB

Download