ea849ef7f34fac2b48a89dca3e4c6a5a44b474dacb8d9866193943f8c92a71ee

Analysis

max time kernel
105s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FUCK.exe
Size 2.3MB
Sample260730-t7eqtadj7v
SHA256 ea849ef7f34fac2b48a89dca3e4c6a5a44b474dacb8d9866193943f8c92a71ee
MD5 aab456459fab3116892a1ed4b526b3db
SHA1 cf99561dea1f552a7b23a8b855bc361ba5824464
SHA512 7b10983be5004aba6a71c4e588a8e044a2d02846fc276c459c508d06302ac15d1108e571edb9ee25fa7909bad364eacf7ea058d01e8c7e54e8f23a1973720651
SSDEEP 49152:t3z11C2O6MtGKiK6bmviJ+2tQjG6P9WcafwL5KyR8mX0oNRX6o1K+ijq:tR1+kKjf2tZ611afwKyR8KHNRXfQ3jq
TLSH
T1E7B5334467F19614C2E6EABC8AA2FF0515BDFCD3C244DB1F0EA70C7A1B3B2291D15A46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (1121) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\FarlandPlayer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FUCK.exe"	FUCK.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	FUCK.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	FUCK.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	FUCK.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3912	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
2816	FUCK.exe
2816	FUCK.exe
2816	FUCK.exe
2816	FUCK.exe
2816	FUCK.exe
2816	FUCK.exe
1300	FUCK.exe
1300	FUCK.exe
1300	FUCK.exe
1300	FUCK.exe
1300	FUCK.exe
1300	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
2816	FUCK.exe
1300	FUCK.exe
1300	FUCK.exe
1300	FUCK.exe
1300	FUCK.exe
1300	FUCK.exe
1300	FUCK.exe
2816	FUCK.exe
2816	FUCK.exe
2816	FUCK.exe
2816	FUCK.exe
2816	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
2816	FUCK.exe
1300	FUCK.exe
2816	FUCK.exe
2816	FUCK.exe
2816	FUCK.exe
2816	FUCK.exe
2816	FUCK.exe
1300	FUCK.exe
1300	FUCK.exe
1300	FUCK.exe
1300	FUCK.exe
1300	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
3912	FUCK.exe
2816	FUCK.exe
1300	FUCK.exe
2816	FUCK.exe
2816	FUCK.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3912	FUCK.exe
Token: SeDebugPrivilege	2816	FUCK.exe
Token: SeDebugPrivilege	1300	FUCK.exe
Token: SeShutdownPrivilege	2232	unregmp2.exe
Token: SeCreatePagefilePrivilege	2232	unregmp2.exe
Token: SeShutdownPrivilege	6120	wmplayer.exe
Token: SeCreatePagefilePrivilege	6120	wmplayer.exe
Token: SeShutdownPrivilege	4540	wmplayer.exe
Token: SeCreatePagefilePrivilege	4540	wmplayer.exe
Token: SeShutdownPrivilege	960	wmplayer.exe
Token: SeCreatePagefilePrivilege	960	wmplayer.exe
Token: SeShutdownPrivilege	5868	wmplayer.exe
Token: SeCreatePagefilePrivilege	5868	wmplayer.exe
Token: SeShutdownPrivilege	5428	wmplayer.exe
Token: SeCreatePagefilePrivilege	5428	wmplayer.exe
Token: SeShutdownPrivilege	2516	wmplayer.exe
Token: SeCreatePagefilePrivilege	2516	wmplayer.exe
Token: SeShutdownPrivilege	3920	wmplayer.exe
Token: SeCreatePagefilePrivilege	3920	wmplayer.exe
Token: SeShutdownPrivilege	2776	wmplayer.exe
Token: SeCreatePagefilePrivilege	2776	wmplayer.exe
Token: SeShutdownPrivilege	6020	wmplayer.exe
Token: SeCreatePagefilePrivilege	6020	wmplayer.exe
Token: SeShutdownPrivilege	1712	wmplayer.exe
Token: SeCreatePagefilePrivilege	1712	wmplayer.exe
Token: SeShutdownPrivilege	2860	wmplayer.exe
Token: SeCreatePagefilePrivilege	2860	wmplayer.exe
Token: SeShutdownPrivilege	3044	wmplayer.exe
Token: SeCreatePagefilePrivilege	3044	wmplayer.exe
Token: SeShutdownPrivilege	1488	wmplayer.exe
Token: SeCreatePagefilePrivilege	1488	wmplayer.exe
Token: SeShutdownPrivilege	5292	wmplayer.exe
Token: SeCreatePagefilePrivilege	5292	wmplayer.exe
Token: SeShutdownPrivilege	2844	wmplayer.exe
Token: SeCreatePagefilePrivilege	2844	wmplayer.exe
Token: SeShutdownPrivilege	4512	wmplayer.exe
Token: SeCreatePagefilePrivilege	4512	wmplayer.exe
Token: SeShutdownPrivilege	2812	wmplayer.exe
Token: SeCreatePagefilePrivilege	2812	wmplayer.exe
Token: SeShutdownPrivilege	5940	wmplayer.exe
Token: SeCreatePagefilePrivilege	5940	wmplayer.exe
Token: SeShutdownPrivilege	4392	wmplayer.exe
Token: SeCreatePagefilePrivilege	4392	wmplayer.exe
Token: SeShutdownPrivilege	3816	wmplayer.exe
Token: SeCreatePagefilePrivilege	3816	wmplayer.exe
Token: SeShutdownPrivilege	5900	wmplayer.exe
Token: SeCreatePagefilePrivilege	5900	wmplayer.exe
Token: SeShutdownPrivilege	5732	wmplayer.exe
Token: SeCreatePagefilePrivilege	5732	wmplayer.exe
Token: SeShutdownPrivilege	3616	wmplayer.exe
Token: SeCreatePagefilePrivilege	3616	wmplayer.exe
Token: SeShutdownPrivilege	2004	wmplayer.exe
Token: SeCreatePagefilePrivilege	2004	wmplayer.exe
Token: SeShutdownPrivilege	4552	wmplayer.exe
Token: SeCreatePagefilePrivilege	4552	wmplayer.exe
Token: SeShutdownPrivilege	5208	wmplayer.exe
Token: SeCreatePagefilePrivilege	5208	wmplayer.exe
Token: SeShutdownPrivilege	4656	wmplayer.exe
Token: SeCreatePagefilePrivilege	4656	wmplayer.exe
Token: SeShutdownPrivilege	5316	wmplayer.exe
Token: SeCreatePagefilePrivilege	5316	wmplayer.exe
Token: SeShutdownPrivilege	1380	wmplayer.exe
Token: SeCreatePagefilePrivilege	1380	wmplayer.exe
Token: SeShutdownPrivilege	3560	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1488	wmplayer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 2816	3912	FUCK.exe	90
PID 3912 wrote to memory of 3920	3912	FUCK.exe	93
PID 2816 wrote to memory of 4652	2816	FUCK.exe	94
PID 4652 wrote to memory of 2828	4652	wmplayer.exe	95
PID 2828 wrote to memory of 2232	2828	unregmp2.exe	96
PID 1300 wrote to memory of 4956	1300	FUCK.exe	97
PID 3912 wrote to memory of 1828	3912	FUCK.exe	98
PID 2816 wrote to memory of 3532	2816	FUCK.exe	99
PID 1300 wrote to memory of 5132	1300	FUCK.exe	100
PID 3912 wrote to memory of 476	3912	FUCK.exe	121
PID 2816 wrote to memory of 3756	2816	FUCK.exe	102
PID 1300 wrote to memory of 2656	1300	FUCK.exe	103
PID 3912 wrote to memory of 1972	3912	FUCK.exe	104
PID 2816 wrote to memory of 6136	2816	FUCK.exe	105
PID 1300 wrote to memory of 3228	1300	FUCK.exe	106
PID 3912 wrote to memory of 2016	3912	FUCK.exe	108
PID 1300 wrote to memory of 5520	1300	FUCK.exe	109
PID 2816 wrote to memory of 6120	2816	FUCK.exe	110
PID 3912 wrote to memory of 1184	3912	FUCK.exe	111
PID 1300 wrote to memory of 2844	1300	FUCK.exe	114
PID 2816 wrote to memory of 4540	2816	FUCK.exe	115
PID 3912 wrote to memory of 3016	3912	FUCK.exe	116
PID 1300 wrote to memory of 2032	1300	FUCK.exe	117
PID 3912 wrote to memory of 960	3912	FUCK.exe	119
PID 2816 wrote to memory of 200	2816	FUCK.exe	120
PID 1300 wrote to memory of 1988	1300	FUCK.exe	122
PID 3912 wrote to memory of 5868	3912	FUCK.exe	123
PID 2816 wrote to memory of 1868	2816	FUCK.exe	124
PID 1300 wrote to memory of 5428	1300	FUCK.exe	125
PID 3912 wrote to memory of 5944	3912	FUCK.exe	126
PID 2816 wrote to memory of 4964	2816	FUCK.exe	127
PID 3912 wrote to memory of 2516	3912	FUCK.exe	128
PID 2816 wrote to memory of 1800	2816	FUCK.exe	129
PID 1300 wrote to memory of 4916	1300	FUCK.exe	130
PID 2816 wrote to memory of 3920	2816	FUCK.exe	131
PID 1300 wrote to memory of 2432	1300	FUCK.exe	132
PID 3912 wrote to memory of 5892	3912	FUCK.exe	133
PID 1300 wrote to memory of 2776	1300	FUCK.exe	134
PID 3912 wrote to memory of 1756	3912	FUCK.exe	135
PID 2816 wrote to memory of 4952	2816	FUCK.exe	136
PID 3912 wrote to memory of 6020	3912	FUCK.exe	137
PID 2816 wrote to memory of 5924	2816	FUCK.exe	138
PID 1300 wrote to memory of 3440	1300	FUCK.exe	139
PID 2816 wrote to memory of 1712	2816	FUCK.exe	140
PID 1300 wrote to memory of 5144	1300	FUCK.exe	141
PID 3912 wrote to memory of 3848	3912	FUCK.exe	142
PID 1300 wrote to memory of 2860	1300	FUCK.exe	143
PID 3912 wrote to memory of 3028	3912	FUCK.exe	144
PID 2816 wrote to memory of 6060	2816	FUCK.exe	145
PID 3912 wrote to memory of 4820	3912	FUCK.exe	146
PID 2816 wrote to memory of 3044	2816	FUCK.exe	147
PID 1300 wrote to memory of 1492	1300	FUCK.exe	148
PID 3912 wrote to memory of 2044	3912	FUCK.exe	149
PID 2816 wrote to memory of 1324	2816	FUCK.exe	150
PID 1300 wrote to memory of 1488	1300	FUCK.exe	151
PID 3912 wrote to memory of 4568	3912	FUCK.exe	152
PID 1300 wrote to memory of 5292	1300	FUCK.exe	153
PID 2816 wrote to memory of 3120	2816	FUCK.exe	154
PID 3912 wrote to memory of 1868	3912	FUCK.exe	155
PID 1300 wrote to memory of 2844	1300	FUCK.exe	156
PID 2816 wrote to memory of 2492	2816	FUCK.exe	157
PID 3912 wrote to memory of 4700	3912	FUCK.exe	158
PID 1300 wrote to memory of 4512	1300	FUCK.exe	159
PID 2816 wrote to memory of 1704	2816	FUCK.exe	160

C:\Users\Admin\AppData\Local\Temp\FUCK.exe
"C:\Users\Admin\AppData\Local\Temp\FUCK.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Users\Admin\AppData\Local\Temp\FUCK.exe
  "C:\Users\Admin\AppData\Local\Temp\FUCK.exe"
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Windows\SysWOW64\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\Windows\system32\unregmp2.exe
        
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        5⤵
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:2232
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:3532
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3756
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6136
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6120
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:200
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1868
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4964
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1800
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3920
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4952
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5924
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:6060
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:1324
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3120
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2492
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:1704
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4576
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1904
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5608
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1804
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3736
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:1228
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2676
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3068
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5236
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3044
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4568
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:3328
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:672
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4812
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4500
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:5212
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:6000
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:1960
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:6092
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4492
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:5600
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:2516
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:3728
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:6088
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:2432
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4692
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4392
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:2148
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:5308
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:5280
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:2736
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4056
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3920
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1828
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:476
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1972
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2016
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1184
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3016
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:960
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5868
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5944
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:5892
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1756
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6020
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3848
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3028
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4820
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2044
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4568
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1868
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4700
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1524
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4268
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3312
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2640
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5532
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4244
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3924
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3528
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4092
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5600
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1164
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3388
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1460
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4584
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2248
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:5892
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:856
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:5580
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4180
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:6136
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2100
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3232
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1304
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3900
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1984
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3496
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:5908
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2984
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2988
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4160
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2132
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3028
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:704

C:\Users\Admin\AppData\Local\Temp\FUCK.exe
C:\Users\Admin\AppData\Local\Temp\FUCK.exe
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4956
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5132
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2656
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3228
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:5520
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2844
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2032
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1988
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5428
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4916
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2432
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3440
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:5144
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1492
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1488
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5292
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4512
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5940
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4392
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3816
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5900
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5732
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3616
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2004
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4552
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5208
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4656
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5316
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1380
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3560
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2848
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:5132
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1652
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:5564
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:200
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:5684
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4344
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4820
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4420
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3892
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3668
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3044
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1272
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2508
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:252
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4592
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1336
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:2332

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

windowsdesktop-runtime-8.0.15-win-x64.msi.encrypted

Path C:\ProgramData\Package Cache\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}v64.60.31203\windowsdesktop-runtime-8.0.15-win-x64.msi.encrypted
Size 29.1MB
SHA256 7267b55a3cbd35f6bae8b69da9922f52c2f53e9b1e1415b2a6e04d88bd5d1ecc
MD5 8148ed41d289d9db68992d15d090cb7b
SHA1 8cc05be06337994e9dd2e0d250c384bac7e768fa
SHA512 cb4ff385da1edfa21bba089f993f51d525d8bbdad216f6472da32b7a4b80d8ece5319b713b05a25111774b64581c9bc9fc9e836e9ad664336abef1ec6b0efe93
SSDEEP 786432:JQ8TuLWrY3REPCwnqZ2Qs7vcyfZ3FyiCLOcN:JZaqrY3KPrn5vVf50t60
TLSH
T19A6733AC5FB06903D731E91AB50FCE93E22E54F18B168D95851E04F1D8BBDA806CF94B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet-hostfxr-6.0.27-win-x64.msi.encrypted

Path C:\ProgramData\Package Cache\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}v48.108.8828\dotnet-hostfxr-6.0.27-win-x64.msi.encrypted
Size 804KB
SHA256 8e283251048655d5f44e49312302811f8f72368158eae77a233a91ef60e8e08c
MD5 9c1901ac7bad4d7100b48ed387c03e76
SHA1 2cdd4012d49a371bdcbe139482e65ecf95fcb8df
SHA512 9b63b68387bf67eb4a2440b1500b63b263d1eb2f7eebf8e95b55a7efa72f2d6c4a727e786321df8c9867184ae7d41e75e02285b54acf3ed57315a1c455f371dd
SSDEEP 24576:eT1Fjhfx1HeUuogRi8kfH3rSK2AAVtVEoDuPZ/m/59Pm:eXtJ1+UuoCmf32Ao/Ebu/59e
TLSH
T1AA05339BA3C8DC392610E2D19B535870A9425387D02FE635A6507799A3CDC9BECCBCC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet-hostfxr-6.0.27-win-x64.msi.encrypted.encrypted

Path C:\ProgramData\Package Cache\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}v48.108.8828\dotnet-hostfxr-6.0.27-win-x64.msi.encrypted.encrypted
Size 804KB
SHA256 0ae19ea94b47c53672f48a3e855c40cbf6d89b23a3f8fc43e4fe911aeba8eabd
MD5 e2c5baba5e8baa29e0930dc177d6dcd6
SHA1 502bfab26cc04f6239e30d846173836c084394eb
SHA512 893f4f8d1a5471548472901e88b13111f0470c9227880fba330cbb4bd10e95905f9bcb6420cd82f217b1a68d0c6466a2546bbb2f735d1f0db6dfe2c3e5a03236
SSDEEP 24576:BNRIn3YHgYkgn7CwchxVnGgNCSEupsVUD7jGogb:BNRIn3af2hxVA4sUDGR
TLSH
T16005336F973D026C4FE8B841737B0911E12E59144BD9AEA0D23B57ECF4D13B2AEA5C20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_runtimeAdditional_x86.msi.encrypted

Path C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.encrypted
Size 140KB
SHA256 4c75d82c3894d93eea810d9721f2bb8ed18b522be6e0845865f6e3756a07a51b
MD5 7eefd22822cbd0e11c6d00044d0a330c
SHA1 d0272f3036b1838f8ad6d697136cf3653a86fcc1
SHA512 ef49b21503eb74d41bb613335240781b7ec494319ead8fea927f1784d8113a78c91e07b17e9fed43c4699dd8b594936d012ddc17aeb6f9c41e366e619c4fd9d0
SSDEEP 3072:g9XYgfVB3ogUzsXqFekP8KteJ0aab+qvAHGq0A7zRblwDqc1z58s:O73Es6DkKftFattZCqc1zL
TLSH
T112E31331FF878D28B2DCBDC054AA02566F54D2DEE47FAE00B428756609949E0DCB7B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_runtimeAdditional_x86.msi.encrypted.encrypted

Path C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.encrypted.encrypted
Size 140KB
SHA256 9f658feca5eda62dc93849a58d7b45a9b51f5fe958f498670b062f904d8bf355
MD5 1b901eecdc6797ffb86a20e9d7309d4a
SHA1 29ce1284dc3a7882fefc2d313a961279b4f0b733
SHA512 8b701c1a9b9075a56ed4b5d9a0fef2b8a5903ea9fb6bbfda408b1fddd9fbcf00464a3c9e7b891aa093da5147e63daa11dd0b8ce46445fe61462f098066ffcee9
SSDEEP 3072:o30k+IAySuhoZmVUkRrromCro10hmLDZipr+iY3g9UWvqPPx0Y:JkbBOmSeQmCroyclyr+iuSqPPx0Y
TLSH
T1EFE323C4B956554E3EB58F4DF4E46BBA0BA844B2AB3E3531BDFA84E4290D07030A59F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet-runtime-8.0.15-win-x64.msi.encrypted

Path C:\ProgramData\Package Cache\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}v64.60.31149\dotnet-runtime-8.0.15-win-x64.msi.encrypted
Size 26.3MB
SHA256 da84978a45e0ab9bdb467fbaee5dd63315cf0cff98f06e5faf3f69a6093754c8
MD5 4fee12a0a4659dd1d3280d8c0e36910e
SHA1 a4fc73844a2d6e64b832764fa89bf3100c4a5562
SHA512 f5247e03d6a2b781cc019cfb5aac1a4666b999b0d318de47e23c8a8dd7038624046764dead8648110162bd8c73fd05695d18bb7e86662187780e8e6bc2c9df0e
SSDEEP 786432:j4wwcQ5rEDVc2xARfClJlhPlE8L4T3TFPvxhL:jFKrEDVjRJ728L4T3TFPvxhL
TLSH
T15A57336FE972F1843584E705F8D908BE421081E9CFB1B2B4FAB3E48FC59C9525136B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\metadata.encrypted
Size 16B
SHA256 d4e07470d3cebaedf3995d0152b945f7959ee76052728b7a3ce52c3a6af4fb21
MD5 3b8d29762501ea6f2aeb93c5dc3e9415
SHA1 6d3277b411a730d3d426626a00643e28819bd28d
SHA512 6b95076e74f9f5743b0fb26a75143d89ab3492c88fcc25370d09b024bd348108c8fe435de9df46892457d6ad791669c5c338a55f9be0751c9bfe4b4c5b479a1d
MD5 SHA1 SHA512

Submit Download

CURRENT.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT.encrypted
Size 32B
SHA256 90ba5125f9afb1e7154dc233c116c35159d12f77d62afaeb0ada47e538415f08
MD5 59b59166c19be5b8bd9acb86d2e34e9e
SHA1 7f2063d75da7a94b3b671ba4907fea78b79391fd
SHA512 aa70b983d01e8f297075c1decabfd40b78ba59f7cf47c13520a4e847364552c4cbc76edcf8e2ac9862949d1cd0be8670e24086db878f605264bd56e2ecfb8011
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\MANIFEST-000001.encrypted
Size 48B
SHA256 5f11fe8c1bbace77a7dcbb5465b3c7f7cdea4917b0f12addef3ec95f50820fb1
MD5 42997ea214b5e3e8766369bd988ad94c
SHA1 8b36c05135f726ef9ab59ab10acdc708684efaec
SHA512 792007b3029eb76bd7074d79e96af62bed6b2ef4e8c53699bf3c514da537dff0da07c394218f1d12fe58e1f9705d767bede8260ec37e435b2674c0ac3b37ddca
MD5 SHA1 SHA512

Submit Download

data_0.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0.encrypted
Size 8KB
SHA256 39ed32c033dc236810ebb133af64564b0a5e0f32ccd3c7566cb453ccde0cce70
MD5 19a8453480aa0e862aaa6d772dcb115f
SHA1 a500346c70be3377e9473b5f2d2b2bd9d3bf340e
SHA512 4f88fa6513c8f4dd957889fbcaa979a396da4836a216675d89ac5fee9159be5e4034db532a483c8fdc4cfee6fc2ac1fb7a8023e0e5d6371ac7c6ba9c6c6d1989
SSDEEP 192:PWbJfXXs1zHjmcY8ch2qSsqKaFH7Sr66JjNeFreor1Tn:PWtXX8zH6cY8cgMqTF8xeFJrJ
TLSH
T12E02AFD9AF1BDD8865768190EC648E27598B3041C7FECE7097286FBC80197E10A8C2C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1.encrypted
Size 264KB
SHA256 6c443b3dbee46c203501361bd15ec1b667c7c917e97c5bd5509a59483107a382
MD5 20ae649dca995b84549f6f691e786730
SHA1 1016591ea76fa04c59342dbc29442cad1efa1bcd
SHA512 66bc7056df841e090a517326d17db9f630f0598040b15e1e2ddec040252f18288c9f6c0420642d4f6e048c83abe1daef71bf63547b6ad2750c9dcc1b9b299253
SSDEEP 6144:a9dS5r2O1Q7OW8H/hJM12JCPG+Z5eOpMRjMXN:a7S5rrQL8fPjgPGE0TM9
TLSH
T1C94423AF734EEED2A57AEA8C5D871481019362CFD95893E1B15563FBF486C3C842F850
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_2.encrypted
Size 8KB
SHA256 2294e2841f2d8f1c2f60b1bb0568f99bf701675e20b961e29e817f441782397e
MD5 3716ff61a9d31daba307a2bbc4744338
SHA1 b00ebbc8aa3eaffe33ce7562ab09b03f56a12786
SHA512 bf0278d1c54cd67de6308dce9a6c1143bf8a5c3c133a54923403eeea11d187c200a9540e048fadce085cfe3eaf7d2600b5dbc2e7ae203a05b1e7e32d8047eb89
SSDEEP 192:NDhDRX9SQDAv4X94aMEputi6v+vEZquD/jx35WzhBL71EcFiCenEC0xxn:NDh19SQkdEpD6vGEpXWzzlhJnl
TLSH
T18C02B06E842AD142B68DE506840435D69745ECAFCC49D9578919F338FF17BE1AB80788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3.encrypted
Size 8KB
SHA256 667fa5f66ef290f8fd76957263107d31b6b4485ff8ca88eec7bc3b8ce8b0382d
MD5 cc36ddbb435d13f8d274fa8a6e83d11e
SHA1 a184fa6224b366bed9e7c2c7e54cb828658a3670
SHA512 c6aff7e7bf2f2c2ba3d43748dbb10bef6b172af776689676acb5a57b6b9680e5937b2b092d5fe63cf8da57446262e8526f7bf28f28c591c32ba764cf3dd0de43
SSDEEP 192:UBM41YSLnBnpooHJlv1KfSmggDR6H02AI8gpz+v7DXoi96:UBM4TBnVpgSmgQkFa56
TLSH
T11B02BFCE2259176F0EAEA709CDBC432C3C67E37119ACCD51F91489536EAC2958C9D05F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 640KB
SHA256 109284ad29802190713daf8725fb6d4c028afd8b37307ee548fb98c30a3ab5c7
MD5 aeadf3c97fa82bc1dd3f83f3917c6df1
SHA1 2062557f188936155edd0c4c96c416dc7e000a3f
SHA512 3d92ae608da37dffb4fcd3cf5ad53c315cbb82400e17e01c97e8e0ef8392068d5e5e4e5ce14916b67f05fa2538479050ccfd681f17eadf4e11b81c059a880445
SSDEEP 768:rf0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr3UzfEwPRzitFrzAqUmNKX09oJImp:rNpZlt5xYCutFCJGAKt2hZ
TLSH
T197D43137D560A088DF3C35B1E2EC5F0CBD62A10B12E012461F74A67A7A633DD9E1B5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

farland.mp4

Path C:\Users\Admin\AppData\Local\Temp\farland.mp4
Size 2.3MB
SHA256 856ef6d91215ce1ecba31f3995063914eee341428b4ca8ad3350eae6f98027d8
MD5 18263a0da7ef770725a4cbe1f840b45b
SHA1 5654a55545334e4f806f43df62d776fdd7266dd6
SHA512 7557695b62a86744a62398dd2955bcf250f6a3cd6122d681038d21f143fc6c81c43f6ce7e8c417d3c2476a461fbba993eb48f16bbe1358b6da01b15c777d2844
SSDEEP 49152:83z11C2O6MtGKiK6bmviJ+2tQjG6P9WcafwL5KyR8mX0oNRX6o1K+ijqG:8R1+kKjf2tZ611afwKyR8KHNRXfQ3jqG
TLSH
T14BB5334467F29610C2E6EABC4AA2FF0915BDFCE2C344DB1F0EA30D765B3B2295C15A45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 7ac3adfabe64518b5d27d19d31398e6617931172270fbf506004ce8551c0cc7c
MD5 ecee7836755000e968046727759fa406
SHA1 2d6e61e9be1cc4062125f678e4fb76986bf563e6
SHA512 7abc837511ef87ac02c69f221d88232c1f81925c4c4977bc3d2bc75cc1ab427fe37ba085c1d965fe26e206744cc17875dbb1d600a94c1c5e05313377d2ca0789
TLSH
T14E217B574A09E4B4CD6287A369CC4A2773B6A7CE5364D025B38EE06E890113E633D17D
MD5 SHA1 SHA512 TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 afeadbf17396559e7c5d9c6b2de94307918ac54d7bfe83377ac905662a9c2bf6
MD5 5903e6ac3becc30259a705bf474ff3ac
SHA1 f970d64767142ae73dfc72db9cd6394076c8d756
SHA512 e6ad572c490ef7ef38ad801a0edc7580f1fa614d529448e33a12570bf4705f0e00d65c92869a1f80a736d8d482c37a69d6fb1022acb933a55ad11d750f8fa20b
TLSH
T114217C574A0AE4B5CD6287B369CC8A2773B6A7CE5354D025B38EF02E890513E233D17D
MD5 SHA1 SHA512 TLSH

Submit Download