Overview

overview

10

Static

static

10

c1a88a72ab...b9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    114s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/09/2026, 09:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c1a88a72aba059921996aeb01acfe409fabfe4cf0f4a09d8280c4eb9ffce75b9.exe
  • Size 7.6MB
  • Sample260902-lc8fmsyekf
  • SHA256 c1a88a72aba059921996aeb01acfe409fabfe4cf0f4a09d8280c4eb9ffce75b9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoverylunampersistencespywarestealertrojan

Malware Config

Signatures

  • Family: Lunam

    Lunam is a Windows trojan written in Visual Basic.

    trojanlunam
  • Detects Lunam 29 IoCs
  • Executes dropped EXE 53 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Drops file in System32 directory 54 IoCs
  • Drops file in Program Files directory 59 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of SetWindowsHookEx 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c1a88a72aba059921996aeb01acfe409fabfe4cf0f4a09d8280c4eb9ffce75b9.exe
    "C:\Users\Admin\AppData\Local\Temp\c1a88a72aba059921996aeb01acfe409fabfe4cf0f4a09d8280c4eb9ffce75b9.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1192
  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.exe
    "c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1704
  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.exe
    "c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4596
  • C:\WINDOWS\system32\Taskmgr.exe
    C:\WINDOWS\system32\taskmgr.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:628
  • \??\c:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.exe
    "c:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5008
  • \??\c:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.exe
    "c:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3112
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3488
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1316
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3236
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4940
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4648
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2456
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2928
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3868
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4516
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4072
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4768
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1264
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1832
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3268
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2492
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4324
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2784
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1880
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3840
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1680
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5308
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5312
  • \??\c:\Users\Admin\AppData\Roaming\DenyUse\UnblockStart.exe
    c:\Users\Admin\AppData\Roaming\DenyUse\UnblockStart.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5888
  • \??\c:\Users\Admin\AppData\Roaming\MeasureStop\GetApprove.exe
    c:\Users\Admin\AppData\Roaming\MeasureStop\GetApprove.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5896
  • \??\c:\Users\Admin\AppData\Roaming\MeasureStop\UnpublishConvertTo.exe
    c:\Users\Admin\AppData\Roaming\MeasureStop\UnpublishConvertTo.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5956
  • \??\c:\Users\Admin\AppData\Roaming\BlockProtect\SkipEnter.exe
    c:\Users\Admin\AppData\Roaming\BlockProtect\SkipEnter.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5980
  • \??\c:\Users\Admin\AppData\Roaming\ReceiveAdd\ResizeSet.exe
    c:\Users\Admin\AppData\Roaming\ReceiveAdd\ResizeSet.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5680
  • \??\c:\Users\Admin\AppData\Roaming\SkipEnter\UpdateEnable.exe
    c:\Users\Admin\AppData\Roaming\SkipEnter\UpdateEnable.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5368
  • \??\c:\Users\Admin\AppData\Roaming\SkipEnter\SavePublish.exe
    c:\Users\Admin\AppData\Roaming\SkipEnter\SavePublish.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6040
  • \??\c:\Users\Admin\AppData\Roaming\UpdateWait\ExportUnblock.exe
    c:\Users\Admin\AppData\Roaming\UpdateWait\ExportUnblock.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5916
  • \??\c:\Users\Admin\AppData\Roaming\SetAssert\SyncUpdate.exe
    c:\Users\Admin\AppData\Roaming\SetAssert\SyncUpdate.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5144
  • \??\c:\Users\Admin\AppData\Roaming\TraceClear\ReceiveMeasure.exe
    c:\Users\Admin\AppData\Roaming\TraceClear\ReceiveMeasure.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6152
  • \??\c:\Users\Admin\AppData\Roaming\WriteOptimize\ResolveSwitch.exe
    c:\Users\Admin\AppData\Roaming\WriteOptimize\ResolveSwitch.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6540
  • \??\c:\Users\Admin\AppData\Roaming\WriteOptimize\SetUpdate.exe
    c:\Users\Admin\AppData\Roaming\WriteOptimize\SetUpdate.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6748
  • \??\c:\Users\Admin\Desktop\ConvertToBlock.exe
    c:\Users\Admin\Desktop\ConvertToBlock.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6772
  • \??\c:\Users\Admin\Documents\PopAssert.exe
    c:\Users\Admin\Documents\PopAssert.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6780
  • \??\c:\Users\Admin\Documents\ConvertSave.exe
    c:\Users\Admin\Documents\ConvertSave.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6908
  • \??\c:\Users\Admin\Documents\NewInstall.exe
    c:\Users\Admin\Documents\NewInstall.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6940
  • \??\c:\Users\Admin\Desktop\LockResume.exe
    c:\Users\Admin\Desktop\LockResume.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6976
  • \??\c:\Users\Admin\Documents\ExitTrace.exe
    c:\Users\Admin\Documents\ExitTrace.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6996
  • \??\c:\Users\Admin\Desktop\GetExport.exe
    c:\Users\Admin\Desktop\GetExport.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7048
  • \??\c:\Users\Admin\AppData\Roaming\RepairUpdate\ConvertToClose.exe
    c:\Users\Admin\AppData\Roaming\RepairUpdate\ConvertToClose.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7120
  • \??\c:\Users\Admin\Documents\RequestSkip.exe
    c:\Users\Admin\Documents\RequestSkip.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7160
  • \??\c:\Users\Admin\Documents\SplitUnprotect.exe
    c:\Users\Admin\Documents\SplitUnprotect.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5352
  • \??\c:\Users\Admin\Documents\StepApprove.exe
    c:\Users\Admin\Documents\StepApprove.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6576
  • \??\c:\Users\Admin\Downloads\PopCompare.exe
    c:\Users\Admin\Downloads\PopCompare.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7060
  • \??\c:\Users\Admin\Music\EnterConfirm.exe
    c:\Users\Admin\Music\EnterConfirm.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6816
  • \??\c:\Users\Admin\Downloads\SuspendNew.exe
    c:\Users\Admin\Downloads\SuspendNew.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7180
  • \??\c:\Users\Admin\Music\RestartWrite.exe
    c:\Users\Admin\Music\RestartWrite.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7216

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Click on 'Change' to select default PDF handler.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.exe
        • Size 7.8MB
        • SHA256 04bed728c1ee0059d4f4e6ceb1db88018cdca53c56f29130b03f4d31665b9be9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PDFSigQFormalRep.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.exe
        • Size 8.0MB
        • SHA256 3d58db31db94df421ee9faa39a4debfc274e6aec7b285d5832da4decce1d30c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        HomeBanner_Dark.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.exe
        • Size 7.6MB
        • SHA256 69a085cafe72034a638cf4b43aeeb5ea0e89224a1f4bb749c10b15ca8586dd3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MobileScanCard_Dark.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.exe
        • Size 7.6MB
        • SHA256 9b947e3bc7339aec1b3a8ea8f967e6d1e089fbc2164ffb79e497bf3b3725c984
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Adobe Acrobat Pro DC.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.exe
        • Size 7.7MB
        • SHA256 9cb08fb1230846aeb514f5586506efb6bbabb0b8850cbd0ca8ec7d6b5edad776
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Complex Machine.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.exe
        • Size 7.8MB
        • SHA256 9e12891d5fcbc08cd8a6420116808a6545eb84a82acc90270466007d69b02509
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Dynamic.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.exe
        • Size 7.6MB
        • SHA256 6777b8919d7663a29dc403f09d9b3c1f51323a1fc28846fe032bb5272f3517f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SignHere.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.exe
        • Size 7.6MB
        • SHA256 caaafa383d6e66ff262b0ae674ba070ae8ba6dbf6759aafc48f0fb2f78c47ebb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Words.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.exe
        • Size 7.7MB
        • SHA256 1abe595c4d4ee0f17a824b7f13f3de051f556d191569836955c18e560a39e70e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PROTTPLN.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.exe
        • Size 7.6MB
        • SHA256 8ba9bb64413153864efaf5e7ee590e916ae76db7e8270e12d656a91f38811006
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PROTTPLV.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.exe
        • Size 7.6MB
        • SHA256 36aaae72589ccbdb63635c9f000c737051f44919774dfdf970126dda1b20f5c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ResizeSet.exe
        • Path C:\Users\Admin\AppData\Roaming\ReceiveAdd\ResizeSet.exe
        • Size 7.9MB
        • SHA256 6a36037a473589dcee55693caf48d02ed643afb6324c27344b7dccafb08fd56f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UpdateEnable.exe
        • Path C:\Users\Admin\AppData\Roaming\SkipEnter\UpdateEnable.exe
        • Size 7.9MB
        • SHA256 658fe4865e01cfb27db6bc1842e70ec41796877055d86daf76f6f35d9b5fba1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AdobeID.exe
        • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.exe
        • Size 7.7MB
        • SHA256 434a8709d9e2171c6447da51f598e3418229299ccb7f18841da8cc6bd8079c7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DefaultID.exe
        • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.exe
        • Size 7.7MB
        • SHA256 5e5361a273ce44b6155493e55bc631abbd785335ea05563bd2e85d06b771979e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        HomeBanner_Light.exe
        • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.exe
        • Size 7.6MB
        • SHA256 d5f4191634edd39b536b00ac6ce0881158d0c148afc6ef4eb45dc57ddc766963
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MobileAcrobatCard_Dark.exe
        • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.exe
        • Size 8.0MB
        • SHA256 77e31928f4e34935a7d04fbd05666a444d79f9da44d384d5c3d6429135a66d07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Adobe Cloud Services.exe
        • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.exe
        • Size 7.9MB
        • SHA256 af1a43d056ccce94a3f1366a2f70c93a56ba6ae7d4943f6f6707cd407b65ecc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Bus Schedule.exe
        • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.exe
        • Size 8.5MB
        • SHA256 4f7ab2209375c5bbd8b9f687e89f8b2fc2f9e097576cebb7f1fa4fb3ea57b158
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Welcome.exe
        • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.exe
        • Size 7.7MB
        • SHA256 6831325080f3d360ac18c75eb1455402f661ccf6898d667987509f0caf36f8ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StandardBusiness.exe
        • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.exe
        • Size 7.7MB
        • SHA256 8c1bea1a7554283107f772a4ec270c48ea44629ad5335f12024448785cc7d118
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ENUtxt.exe
        • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.exe
        • Size 7.6MB
        • SHA256 c9651846eede6a119b3a26cfa5c19a69ad0c75305ff3e9788f8e527e67dc094b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SOLVSAMP.exe
        • Path \??\c:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.exe
        • Size 7.7MB
        • SHA256 b30bbfe06e3f6ffba13aca7b81a0ca9646ad4b5616eeda2012d9fb78a7f6f5c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EXCEL12.exe
        • Path \??\c:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.exe
        • Size 7.6MB
        • SHA256 b7f03b0df407ac7f96a2636a868a197c91b0455674b326db20e72f255baea913
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UnpublishConvertTo.exe
        • Path \??\c:\Users\Admin\AppData\Roaming\MeasureStop\UnpublishConvertTo.exe
        • Size 8.2MB
        • SHA256 fe4fa17fa2191d5840e8121f77b4c68cc5d3eaa1de31815af94328cf0cf3e858
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        adobe sign white paper.exe
        • Path \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\sample-files\assets\sample files\adobe sign white paper.exe
        • Size 8.0MB
        • SHA256 02298688b99dacb5bafafd49e1ee84698fb201928dd2dbad1e708c85b5f351ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        skipenter.exe
        • Path \??\c:\users\admin\appdata\roaming\blockprotect\skipenter.exe
        • Size 8.2MB
        • SHA256 99c18e82675c3e3e8e16d5abe296da0c45fb7f43b008191042a370fffbac68b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unblockstart.exe
        • Path \??\c:\users\admin\appdata\roaming\denyuse\unblockstart.exe
        • Size 7.7MB
        • SHA256 456f7710fe06905304f4025fa1bce6de572149715924d16512fcf31e55971462
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        getapprove.exe
        • Path \??\c:\users\admin\appdata\roaming\measurestop\getapprove.exe
        • Size 8.1MB
        • SHA256 d7360fdd92e550d9ce710d61b799dfaf81a62263a01ecca9c3d9a946659366a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/628-43-0x000001EFBE3E0000-0x000001EFBE3E1000-memory.dmp
        Download

        memory/628-31-0x000001EFBE3E0000-0x000001EFBE3E1000-memory.dmp
        Download

        memory/628-32-0x000001EFBE3E0000-0x000001EFBE3E1000-memory.dmp
        Download

        memory/628-30-0x000001EFBE3E0000-0x000001EFBE3E1000-memory.dmp
        Download

        memory/628-44-0x000001EFBE3E0000-0x000001EFBE3E1000-memory.dmp
        Download

        memory/628-40-0x000001EFBE3E0000-0x000001EFBE3E1000-memory.dmp
        Download

        memory/628-42-0x000001EFBE3E0000-0x000001EFBE3E1000-memory.dmp
        Download

        memory/628-41-0x000001EFBE3E0000-0x000001EFBE3E1000-memory.dmp
        Download

        memory/628-39-0x000001EFBE3E0000-0x000001EFBE3E1000-memory.dmp
        Download

        memory/628-38-0x000001EFBE3E0000-0x000001EFBE3E1000-memory.dmp
        Download