Overview

overview

10

Static

static

10

f11243d2cf...49.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    104s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/09/2026, 19:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    f11243d2cfab14f3c3364c25be79326daa10b201b1776226fbfb58c16c61a549.exe
  • Size 6.0MB
  • Sample260901-xrhdjsam2s
  • SHA256 f11243d2cfab14f3c3364c25be79326daa10b201b1776226fbfb58c16c61a549
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoverylunampersistencespywarestealertrojan

Malware Config

Signatures

  • Family: Lunam

    Lunam is a Windows trojan written in Visual Basic.

    trojanlunam
  • Detects Lunam 29 IoCs
  • Executes dropped EXE 58 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Drops file in System32 directory 59 IoCs
  • Drops file in Program Files directory 60 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 59 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 59 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f11243d2cfab14f3c3364c25be79326daa10b201b1776226fbfb58c16c61a549.exe
    "C:\Users\Admin\AppData\Local\Temp\f11243d2cfab14f3c3364c25be79326daa10b201b1776226fbfb58c16c61a549.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:768
  • \??\c:\Program Files\CopyMeasure.exe
    "c:\Program Files\CopyMeasure.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1660
  • \??\c:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.exe
    "c:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4780
  • \??\c:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.exe
    "c:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:696
  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.exe
    "c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4664
  • \??\c:\Program Files\ApproveUnlock.exe
    "c:\Program Files\ApproveUnlock.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3024
  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.exe
    "c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4660
  • C:\WINDOWS\system32\Taskmgr.exe
    C:\WINDOWS\system32\taskmgr.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3456
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4944
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2192
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2808
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3116
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1816
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1496
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4380
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4584
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1812
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3848
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1896
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3516
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2268
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2672
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4504
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3132
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5168
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5352
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5360
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5376
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5448
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5472
  • \??\c:\Users\Admin\AppData\Roaming\CloseOptimize\ConnectUse.exe
    c:\Users\Admin\AppData\Roaming\CloseOptimize\ConnectUse.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3812
  • \??\c:\Users\Admin\AppData\Roaming\ConnectBlock\UpdateRestart.exe
    c:\Users\Admin\AppData\Roaming\ConnectBlock\UpdateRestart.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5484
  • \??\c:\Users\Admin\AppData\Roaming\ConnectBlock\PushImport.exe
    c:\Users\Admin\AppData\Roaming\ConnectBlock\PushImport.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3048
  • \??\c:\Users\Admin\AppData\Roaming\DismountSave\ExportSave.exe
    c:\Users\Admin\AppData\Roaming\DismountSave\ExportSave.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3008
  • \??\c:\Users\Admin\AppData\Roaming\DismountSave\RevokeLimit.exe
    c:\Users\Admin\AppData\Roaming\DismountSave\RevokeLimit.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5824
  • \??\c:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].exe
    "c:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5856
  • \??\c:\Users\Admin\AppData\Roaming\EditLock\ResumeExport.exe
    c:\Users\Admin\AppData\Roaming\EditLock\ResumeExport.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5588
  • \??\c:\Users\Admin\AppData\Roaming\CloseWait\DebugWatch.exe
    c:\Users\Admin\AppData\Roaming\CloseWait\DebugWatch.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6400
  • \??\c:\Users\Admin\AppData\Roaming\EditLock\UpdateCompress.exe
    c:\Users\Admin\AppData\Roaming\EditLock\UpdateCompress.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6408
  • \??\c:\Users\Admin\AppData\Roaming\CloseOptimize\ResetPop.exe
    c:\Users\Admin\AppData\Roaming\CloseOptimize\ResetPop.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6416
  • \??\c:\Users\Admin\AppData\Roaming\UndoComplete\RestartUnlock.exe
    c:\Users\Admin\AppData\Roaming\UndoComplete\RestartUnlock.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6576
  • \??\c:\Users\Admin\AppData\Roaming\PingApprove\BackupUnregister.exe
    c:\Users\Admin\AppData\Roaming\PingApprove\BackupUnregister.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6584
  • \??\c:\Users\Admin\AppData\Roaming\UndoComplete\TestSelect.exe
    c:\Users\Admin\AppData\Roaming\UndoComplete\TestSelect.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6592
  • \??\c:\Users\Admin\AppData\Roaming\MountResize\DismountRevoke.exe
    c:\Users\Admin\AppData\Roaming\MountResize\DismountRevoke.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6648
  • \??\c:\Users\Admin\AppData\Roaming\MountResize\LimitUnregister.exe
    c:\Users\Admin\AppData\Roaming\MountResize\LimitUnregister.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6700
  • \??\c:\Users\Admin\AppData\Roaming\UnlockCheckpoint.exe
    c:\Users\Admin\AppData\Roaming\UnlockCheckpoint.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6820
  • \??\c:\Users\Admin\Documents\BackupUpdate.exe
    c:\Users\Admin\Documents\BackupUpdate.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7240
  • \??\c:\Users\Admin\Documents\ResumeAssert.exe
    c:\Users\Admin\Documents\ResumeAssert.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7248
  • \??\c:\Users\Admin\Documents\DenyPop.exe
    c:\Users\Admin\Documents\DenyPop.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7260
  • \??\c:\Users\Admin\Documents\CompressStart.exe
    c:\Users\Admin\Documents\CompressStart.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7304
  • \??\c:\Users\Admin\Documents\ConvertFromOpen.exe
    c:\Users\Admin\Documents\ConvertFromOpen.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7396
  • \??\c:\Users\Admin\Documents\EnableAssert.exe
    c:\Users\Admin\Documents\EnableAssert.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7420
  • \??\c:\Users\Admin\Documents\InitializeExit.exe
    c:\Users\Admin\Documents\InitializeExit.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7448
  • \??\c:\Users\Admin\Documents\RemoveResolve.exe
    c:\Users\Admin\Documents\RemoveResolve.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7496
  • \??\c:\Users\Admin\Documents\InstallConvertFrom.exe
    c:\Users\Admin\Documents\InstallConvertFrom.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7528
  • \??\c:\Users\Admin\Documents\MountStart.exe
    c:\Users\Admin\Documents\MountStart.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7540
  • \??\c:\Users\Admin\Desktop\InstallSkip.exe
    c:\Users\Admin\Desktop\InstallSkip.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7548
  • \??\c:\Users\Admin\Documents\FindRestart.exe
    c:\Users\Admin\Documents\FindRestart.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7568
  • \??\c:\Users\Admin\Documents\ProtectRemove.exe
    c:\Users\Admin\Documents\ProtectRemove.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7576
  • \??\c:\Users\Admin\Documents\UseSwitch.exe
    c:\Users\Admin\Documents\UseSwitch.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7588
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.exe
    c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.exe
    1⤵
      PID:4476

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          DefaultID.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.exe
          • Size 6.1MB
          • SHA256 2459510956d468dca19773e1c5060dccf8fc4a7e869767b9f649d248f2a938e4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PDFSigQFormalRep.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.exe
          • Size 6.5MB
          • SHA256 cb66907b1ecc3de64ac92de71af36e3ce75e683f2c63691b299f55d2cf5f56f5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          HomeBanner_Dark.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.exe
          • Size 6.0MB
          • SHA256 1afcc713571809de05b632f36452150a541cfae3751fdbaa57638cb93ec9fd8e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          HomeBanner_Light.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.exe
          • Size 6.0MB
          • SHA256 49aa66bf1e9818c8b63818be090d06a95c04a6bddac68d690e4acc2d9fa49466
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MobileAcrobatCard_Light.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.exe
          • Size 6.4MB
          • SHA256 d8fc84926433ee87e93fdea9164d3082a57876868aa0a5f961d09a979c07a84b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MobileScanCard_Light.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.exe
          • Size 6.1MB
          • SHA256 a47c322e48c2443cbdab598c83d2371e351fc94a12329cab84b1f79795b02cfd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Adobe Acrobat Pro DC.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.exe
          • Size 6.2MB
          • SHA256 5c63f5909841bb336307cc0e055e8d365f0e25ba76dba49a331dfdc094d18dcb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Adobe Cloud Services.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.exe
          • Size 6.3MB
          • SHA256 5f9096b6ac0e1ba9045a911d26b11a8c9bab1b87250816b0c9874d9c402ff18d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Welcome.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.exe
          • Size 6.1MB
          • SHA256 da634a83ae7236f927d95479d61b05fedd0781c67147151c854314a8f5304681
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StandardBusiness.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.exe
          • Size 6.1MB
          • SHA256 131e1d19f849be1436489e05a67790ec29e6d217157ca36b77aa988ce616b748
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CopyMeasure.exe
          • Path C:\Program Files\CopyMeasure.exe
          • Size 6.4MB
          • SHA256 c51e21cc537e4946c074c8524bc08113b06588414834b93e4a0212b10beb97e9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PROTTPLN.exe
          • Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.exe
          • Size 6.1MB
          • SHA256 693aa796cd266328a75b530d081e593dbd94d02d0a7370f312d561061c155985
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SOLVSAMP.exe
          • Path C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.exe
          • Size 6.2MB
          • SHA256 58edc951e9c064cab041f5d3b25ed32e0844346520e3068b7395692715e8631b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EXCEL12.exe
          • Path C:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.exe
          • Size 6.0MB
          • SHA256 694ad83b2fd0de71f2461559b4ecf983607302dda965eb668efa5f90bf22a11a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ConnectUse.exe
          • Path C:\Users\Admin\AppData\Roaming\CloseOptimize\ConnectUse.exe
          • Size 6.4MB
          • SHA256 6928786924584937a9bce0903024007f51e10d35ed29ac1a453a6b342875b3b9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          1494870C-9912-C184-4CC9-B401-A53F4D8DE290.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.exe
          • Size 6.2MB
          • SHA256 2b049ae793355f9e8448ad701b0160517d2a9a62e16b0c7af0cfa46184777c06
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AdobeID.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.exe
          • Size 6.1MB
          • SHA256 3d7ad4ee8184611bb76e0bdf3257ae21ad228077e7cd0ff79b0f9ddfce7d4087
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Bus Schedule.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.exe
          • Size 6.9MB
          • SHA256 fe92f84e2ce7ff3d9a71f02f65c0009484b9c2b87327594031ef52f259221fed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Complex Machine.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.exe
          • Size 6.2MB
          • SHA256 291262b9ca53683ee1b84319383f7e1d5ea91469d6fdd5bc4811d35031e21c1b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Dynamic.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.exe
          • Size 6.1MB
          • SHA256 b2ea3d247047e8318a188d523ff9719b1795197ca78b57738cf539ab35ce0161
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SignHere.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.exe
          • Size 6.1MB
          • SHA256 8c09b4341aac42fe4251d75dfad51dc5264b7fad77dca742c9dce1adb93c4c0e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Words.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.exe
          • Size 6.2MB
          • SHA256 0364e0d8ab92eb46b351003f474724e28300652b9c20ff7307fc65401344ee52
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ENUtxt.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.exe
          • Size 6.1MB
          • SHA256 fa15eea7e8ead0f2d0b812946836382d42540754ea6080d6718c14ac049b1c0a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ApproveUnlock.exe
          • Path \??\c:\Program Files\ApproveUnlock.exe
          • Size 6.5MB
          • SHA256 991bfe79626e2ce4e3de58d427294c9ed25eb2d372cde15bbc39d9913e625b92
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PROTTPLV.exe
          • Path \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.exe
          • Size 6.1MB
          • SHA256 579b2975301d267cda4710e8ef68deef1a2878de4362a6f396794228b95ddae4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PushImport.exe
          • Path \??\c:\Users\Admin\AppData\Roaming\ConnectBlock\PushImport.exe
          • Size 6.2MB
          • SHA256 3691e70b2b59e6ada13b65fd38b19a5e6212d346f3d50c41cde4f74cc3a31a3c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UpdateRestart.exe
          • Path \??\c:\Users\Admin\AppData\Roaming\ConnectBlock\UpdateRestart.exe
          • Size 6.3MB
          • SHA256 1a2b6e2438bcd91366c502b15d8d68013dfb9da0e39344afddc8520602ff6a3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ExportSave.exe
          • Path \??\c:\Users\Admin\AppData\Roaming\DismountSave\ExportSave.exe
          • Size 6.6MB
          • SHA256 c8ca0810962fbc64eb5bd5a9b0bd8f421f610ac54968a1f91c5ecc70b6c01b58
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          adobe sign white paper.exe
          • Path \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\sample-files\assets\sample files\adobe sign white paper.exe
          • Size 6.4MB
          • SHA256 3029de0f724e7eb69f1a008a62734c4a1ff9947976a23a266a72c3f730a65c73
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3456-42-0x000001FEC23B0000-0x000001FEC23B1000-memory.dmp
          Download

          memory/3456-36-0x000001FEC23B0000-0x000001FEC23B1000-memory.dmp
          Download

          memory/3456-43-0x000001FEC23B0000-0x000001FEC23B1000-memory.dmp
          Download

          memory/3456-45-0x000001FEC23B0000-0x000001FEC23B1000-memory.dmp
          Download

          memory/3456-48-0x000001FEC23B0000-0x000001FEC23B1000-memory.dmp
          Download

          memory/3456-46-0x000001FEC23B0000-0x000001FEC23B1000-memory.dmp
          Download

          memory/3456-47-0x000001FEC23B0000-0x000001FEC23B1000-memory.dmp
          Download

          memory/3456-38-0x000001FEC23B0000-0x000001FEC23B1000-memory.dmp
          Download

          memory/3456-37-0x000001FEC23B0000-0x000001FEC23B1000-memory.dmp
          Download

          memory/3456-44-0x000001FEC23B0000-0x000001FEC23B1000-memory.dmp
          Download