Overview

overview

7

Static

static

3

9525e8a755...f8.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    107s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/08/2026, 15:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9525e8a7552e21c5cc63a556dee07646e1b9e058a83ac72514e032306f41f2f8.exe
  • Size 5.9MB
  • Sample260826-s7vxcsfp3s
  • SHA256 9525e8a7552e21c5cc63a556dee07646e1b9e058a83ac72514e032306f41f2f8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 56 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Drops file in System32 directory 57 IoCs
  • Drops file in Program Files directory 61 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 57 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9525e8a7552e21c5cc63a556dee07646e1b9e058a83ac72514e032306f41f2f8.exe
    "C:\Users\Admin\AppData\Local\Temp\9525e8a7552e21c5cc63a556dee07646e1b9e058a83ac72514e032306f41f2f8.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3696
  • C:\WINDOWS\system32\Taskmgr.exe
    C:\WINDOWS\system32\taskmgr.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4660
  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.exe
    "c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4252
  • \??\c:\Program Files\InvokeHide.exe
    "c:\Program Files\InvokeHide.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4272
  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.exe
    "c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3308
  • \??\c:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.exe
    "c:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:220
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2604
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4704
  • \??\c:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.exe
    "c:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1936
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4480
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1724
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4160
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1112
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4184
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3436
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4608
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4640
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2428
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4732
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:652
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4796
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3296
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3664
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4596
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4976
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1672
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5176
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5296
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5328
  • \??\c:\Users\Admin\AppData\Roaming\AddUndo\InstallPop.exe
    c:\Users\Admin\AppData\Roaming\AddUndo\InstallPop.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3764
  • \??\c:\Users\Admin\AppData\Roaming\DisableJoin.exe
    c:\Users\Admin\AppData\Roaming\DisableJoin.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4956
  • \??\c:\Users\Admin\AppData\Roaming\EditClose\ResolveConnect.exe
    c:\Users\Admin\AppData\Roaming\EditClose\ResolveConnect.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5784
  • \??\c:\Users\Admin\AppData\Roaming\DisconnectDeny\PingConfirm.exe
    c:\Users\Admin\AppData\Roaming\DisconnectDeny\PingConfirm.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6116
  • \??\c:\Users\Admin\AppData\Roaming\InitializeReceive\GetClear.exe
    c:\Users\Admin\AppData\Roaming\InitializeReceive\GetClear.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6076
  • \??\c:\Users\Admin\AppData\Roaming\InvokeImport\GroupClose.exe
    c:\Users\Admin\AppData\Roaming\InvokeImport\GroupClose.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4380
  • \??\c:\Users\Admin\AppData\Roaming\InvokeImport\ReadRename.exe
    c:\Users\Admin\AppData\Roaming\InvokeImport\ReadRename.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6100
  • \??\c:\Users\Admin\AppData\Roaming\GetWrite\GrantPop.exe
    c:\Users\Admin\AppData\Roaming\GetWrite\GrantPop.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6152
  • \??\c:\Users\Admin\AppData\Roaming\DebugRename.exe
    c:\Users\Admin\AppData\Roaming\DebugRename.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6952
  • \??\c:\Users\Admin\AppData\Roaming\GrantLock\OpenReceive.exe
    c:\Users\Admin\AppData\Roaming\GrantLock\OpenReceive.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7116
  • \??\c:\Users\Admin\AppData\Roaming\GetWrite\UnblockMerge.exe
    c:\Users\Admin\AppData\Roaming\GetWrite\UnblockMerge.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6164
  • \??\c:\Users\Admin\Documents\SubmitSelect.exe
    c:\Users\Admin\Documents\SubmitSelect.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6180
  • \??\c:\Users\Admin\AppData\Roaming\UndoWrite.exe
    c:\Users\Admin\AppData\Roaming\UndoWrite.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6916
  • \??\c:\Users\Admin\Documents\CloseStop.exe
    c:\Users\Admin\Documents\CloseStop.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7156
  • \??\c:\Users\Admin\AppData\Roaming\ResolveDismount\ClearInvoke.exe
    c:\Users\Admin\AppData\Roaming\ResolveDismount\ClearInvoke.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7180
  • \??\c:\Users\Admin\AppData\Roaming\ResizeSplit\RemoveConvertFrom.exe
    c:\Users\Admin\AppData\Roaming\ResizeSplit\RemoveConvertFrom.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7172
  • \??\c:\Users\Admin\AppData\Roaming\RestartOpen\DisconnectRestore.exe
    c:\Users\Admin\AppData\Roaming\RestartOpen\DisconnectRestore.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7188
  • \??\c:\Users\Admin\Documents\InitializeEnter.exe
    c:\Users\Admin\Documents\InitializeEnter.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7252
  • \??\c:\Users\Admin\AppData\Roaming\ResolveDismount\ReadWatch.exe
    c:\Users\Admin\AppData\Roaming\ResolveDismount\ReadWatch.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7272
  • \??\c:\Users\Admin\AppData\Roaming\RegisterRepair\WaitJoin.exe
    c:\Users\Admin\AppData\Roaming\RegisterRepair\WaitJoin.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7324
  • \??\c:\Users\Admin\Downloads\MoveInitialize.exe
    c:\Users\Admin\Downloads\MoveInitialize.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7332
  • \??\c:\Users\Admin\Desktop\WaitPublish.exe
    c:\Users\Admin\Desktop\WaitPublish.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7364
  • \??\c:\Users\Admin\AppData\Roaming\ResolveDismount\ConvertFromSearch.exe
    c:\Users\Admin\AppData\Roaming\ResolveDismount\ConvertFromSearch.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7372
  • \??\c:\Users\Admin\AppData\Roaming\ResolveDismount\RegisterWait.exe
    c:\Users\Admin\AppData\Roaming\ResolveDismount\RegisterWait.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7384
  • \??\c:\Users\Admin\Downloads\CompleteUnblock.exe
    c:\Users\Admin\Downloads\CompleteUnblock.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7392
  • \??\c:\Users\Admin\Desktop\OptimizeSave.exe
    c:\Users\Admin\Desktop\OptimizeSave.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7400
  • \??\c:\Users\Admin\Documents\RequestDeny.exe
    c:\Users\Admin\Documents\RequestDeny.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7408
  • \??\c:\Users\Admin\AppData\Roaming\UnregisterMerge\UseSkip.exe
    c:\Users\Admin\AppData\Roaming\UnregisterMerge\UseSkip.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7436
  • \??\c:\Users\Admin\Documents\BlockAdd.exe
    c:\Users\Admin\Documents\BlockAdd.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7972
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.exe
    c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.exe
    1⤵
      PID:3964

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          1
          T1012

          System Information Discovery

          1
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          1494870C-9912-C184-4CC9-B401-A53F4D8DE290.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.exe
          • Size 6.1MB
          • SHA256 6413034dc1136ed87e059d9d99b5140e241196ac4aefd44f1ce825f40680f4ea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MobileAcrobatCard_Dark.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.exe
          • Size 6.3MB
          • SHA256 ce943f994d169881f195f28b637280eccb6249b5a431929444a1611161c298a8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MobileScanCard_Light.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.exe
          • Size 6.0MB
          • SHA256 3f09c19aaf20e95639349e25cc645de076241e825d10558dd53716c6247c8c93
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ENUtxt.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.exe
          • Size 5.9MB
          • SHA256 d4cd6d55c21053450b71397ea4b0bcb10f2257ab48d36126b34da4c1ff254a99
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PROTTPLN.exe
          • Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.exe
          • Size 6.0MB
          • SHA256 e7508e82a32375e7622181338dccfe8c6d8de113e3001bc904034e4792959285
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PROTTPLV.exe
          • Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.exe
          • Size 6.0MB
          • SHA256 f12e47c06c140d9961eb259fb359c8a3adb14a5776a0a2d625e5b7cb664b8ee5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PingConfirm.exe
          • Path C:\Users\Admin\AppData\Roaming\DisconnectDeny\PingConfirm.exe
          • Size 6.1MB
          • SHA256 482d1cacc47fd01efd73ca0e0967f60eb817604d753a05c3517b5436ded7377c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GetClear.exe
          • Path C:\Users\Admin\AppData\Roaming\InitializeReceive\GetClear.exe
          • Size 6.3MB
          • SHA256 fe4b37cf9923d8e0a4883c2ea9141f0280e7aeeb653682a2ea6e92a694d8fca3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AdobeID.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.exe
          • Size 6.0MB
          • SHA256 31a4e5c81b24f6f5774038d6f1ebcc7e2953351cbee52fc0082b73d57d64df4b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DefaultID.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.exe
          • Size 6.0MB
          • SHA256 42f49d030ea7b0877811d19fe19d23a3875e600774a0d4f2de5e839c5264644c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PDFSigQFormalRep.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.exe
          • Size 6.4MB
          • SHA256 58891608466cdfad1ec63607c8a891318eaeef1bb1a103f328f7b384f788002e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          HomeBanner_Dark.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.exe
          • Size 5.9MB
          • SHA256 af9d723a1bc412fe7129b6f6f74a4a08e67e951a7a0b774f6fb9f021f79160cc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Adobe Cloud Services.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.exe
          • Size 6.2MB
          • SHA256 2bb1e6988f9a93ed7aa33edafd6aef388912bcb5b77f7a4a6b491ed722a35287
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Adobe Sign White Paper.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.exe
          • Size 6.3MB
          • SHA256 efc124fcf1158d96da6a94e8a022afbde5cfca261d97ce86aa90b17c657350b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Bus Schedule.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.exe
          • Size 6.8MB
          • SHA256 6a28c42f8ea39ebd1acdb83e520e788f930ce8c2f0a4027bfb3a18ca6a4aa4aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Welcome.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.exe
          • Size 6.0MB
          • SHA256 f143cabf9c49fd325082810efaf3ff63f7006542a3619082769b6423df3d34ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SignHere.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.exe
          • Size 6.0MB
          • SHA256 d2280a0372be5652f4a6c4846c54aa9f0c21420da5d319139312afea60b6c1c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StandardBusiness.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.exe
          • Size 6.0MB
          • SHA256 9b5a7b1d2d7de6b0d8cd2eff3a0d7ae1825244a2b9ebf4c00c8bcc1927ce8375
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Words.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.exe
          • Size 6.0MB
          • SHA256 911f95fae3e5edfe66443f523ac971492a2d7fd9745b8ac9cd00423f9e874a6f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          InvokeHide.exe
          • Path \??\c:\Program Files\InvokeHide.exe
          • Size 6.9MB
          • SHA256 7d10090472aa2cc91f2dcf892900dc2c5cc1c7a933d335a773fb6767f3d801ec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SOLVSAMP.exe
          • Path \??\c:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.exe
          • Size 6.1MB
          • SHA256 942c4681c0475ccfd952126d59fa0c9bc8c20347834644e2bff26c7c71ecd2fc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EXCEL12.exe
          • Path \??\c:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.exe
          • Size 5.9MB
          • SHA256 c72a767de79b26e4a5eb07100a881231a3bf9600565119b6b121ffc66de2f294
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          InstallPop.exe
          • Path \??\c:\Users\Admin\AppData\Roaming\AddUndo\InstallPop.exe
          • Size 6.4MB
          • SHA256 fa1fabd1d357cad875019ba380eb3cc22242e2305e78f4382a91ce600bff038d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DisableJoin.exe
          • Path \??\c:\Users\Admin\AppData\Roaming\DisableJoin.exe
          • Size 6.2MB
          • SHA256 2c88b224f43ee6b63c8ed217a07160b86b65b6ace46f5665aa745b3dc3d0e4b4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ResolveConnect.exe
          • Path \??\c:\Users\Admin\AppData\Roaming\EditClose\ResolveConnect.exe
          • Size 6.9MB
          • SHA256 8114ca7c77fc985638030852472477ba7e14d02e3a7b5eafba380f62e6fae34d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dynamic.exe
          • Path \??\c:\program files (x86)\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\dynamic.exe
          • Size 6.0MB
          • SHA256 caf1cb4580819ae25217318451a5adc2d61547e086c9e3c1b7ac56c8072cbba4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          homebanner_light.exe
          • Path \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\themeless\homebanner_light.exe
          • Size 5.9MB
          • SHA256 b39848d17a92c52546fd86169ee44af29197418bfd5c840fa1af71cd127e0733
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          adobe acrobat pro dc.exe
          • Path \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\sample-files\assets\sample files\adobe acrobat pro dc.exe
          • Size 6.1MB
          • SHA256 f2f45f6a86a19b0a037248a195582780a6d23aee8ba85a6ac527f4a99c3da34a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          complex machine.exe
          • Path \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\sample-files\assets\sample files\complex machine.exe
          • Size 6.1MB
          • SHA256 c73365150ff120ae5168fb72e0cd26bedc024e925932e433516c9a156a2609d5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/4660-42-0x000001A44DB40000-0x000001A44DB41000-memory.dmp
          Download

          memory/4660-29-0x000001A44DB40000-0x000001A44DB41000-memory.dmp
          Download

          memory/4660-43-0x000001A44DB40000-0x000001A44DB41000-memory.dmp
          Download

          memory/4660-30-0x000001A44DB40000-0x000001A44DB41000-memory.dmp
          Download

          memory/4660-31-0x000001A44DB40000-0x000001A44DB41000-memory.dmp
          Download

          memory/4660-41-0x000001A44DB40000-0x000001A44DB41000-memory.dmp
          Download

          memory/4660-40-0x000001A44DB40000-0x000001A44DB41000-memory.dmp
          Download

          memory/4660-39-0x000001A44DB40000-0x000001A44DB41000-memory.dmp
          Download

          memory/4660-38-0x000001A44DB40000-0x000001A44DB41000-memory.dmp
          Download

          memory/4660-37-0x000001A44DB40000-0x000001A44DB41000-memory.dmp
          Download