Overview

overview

10

Static

static

5

13160edab7...b4.pdf

windows10-2004_x64

10

Resubmissions

20-03-2022 09:45

220320-lref4sbghm 10

20-03-2022 08:52

220320-ks5t1sbca7 10

20-03-2022 07:17

220320-h4fyxsaee6 10

20-03-2022 06:45

220320-hjkrdaabg5 10

Analysis

  • max time kernel
    1087s
  • max time network
    996s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    20-03-2022 06:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    13160edab74cc2dd34653920d4bf56e487fea2fd6adf8249e0be9215ced902b4.pdf

  • Size

    2.6MB

  • MD5

    7f6060451f81564336bd5d9e5c95797a

  • SHA1

    70c756af084d013e703d5e1c0f561eea6cb2f781

  • SHA256

    13160edab74cc2dd34653920d4bf56e487fea2fd6adf8249e0be9215ced902b4

  • SHA512

    c5263836ef7264e48e4166042827340244fe430b490ad41acde7fef378757731e7d3fecfe05c5d75695d32dcba7a13db86bea36366c5f4fb1e0ea3e321032abf

Score
10/10
adobeevasionpersistencephishingtrojan

Malware Config

Signatures

  • Detected adobe phishing page
    phishingadobe
  • Registers COM server for autorun 1 TTPs
    persistence
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Executes dropped EXE 46 IoCs
  • Sets file execution options in registry 2 TTPs
    persistence
  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 11 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 6 IoCs
  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Modifies Internet Explorer settings 1 TTPs 51 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\13160edab74cc2dd34653920d4bf56e487fea2fd6adf8249e0be9215ced902b4.pdf"
    1⤵
    • Checks processor information in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3576
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4112
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5ABFE37BF684E85BCB9D5ED1B15B1711 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        3⤵
          PID:1424
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9BFB1567C3C2A7B1529CBB709383CF49 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9BFB1567C3C2A7B1529CBB709383CF49 --renderer-client-id=2 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job /prefetch:1
          3⤵
            PID:4568
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3E25385D120CF7627794754462FC4A55 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
            3⤵
              PID:3676
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=41C6B6BE425795177C01E0D5C02F029A --mojo-platform-channel-handle=2420 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
              3⤵
                PID:4676
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3BFF5D418EB395518B90ED1CC13591AF --mojo-platform-channel-handle=2020 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                3⤵
                  PID:220
                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B61435C499BE3D0267FB9B6DE8A45803 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B61435C499BE3D0267FB9B6DE8A45803 --renderer-client-id=8 --mojo-platform-channel-handle=2740 --allow-no-sandbox-job /prefetch:1
                  3⤵
                    PID:1800
                • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
                  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:19.0 /MODE:3
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:4228
                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
                    3⤵
                      PID:1292
                    • C:\ProgramData\Adobe\ARM\S\21487\AdobeARMHelper.exe
                      "C:\ProgramData\Adobe\ARM\S\21487\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\21487" /MODE:3 /PRODUCT:Reader /VERSION:19.0 /LANG:ENU
                      3⤵
                      • Executes dropped EXE
                      • Checks computer location settings
                      • Checks whether UAC is enabled
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4112
                      • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
                        "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\21487" /MODE:3 /PRODUCT:Reader /VERSION:19.0 /LANG:ENU
                        4⤵
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:4000
                • C:\Windows\System32\CompPkgSrv.exe
                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                  1⤵
                    PID:5108
                  • C:\Windows\system32\rundll32.exe
                    C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
                    1⤵
                      PID:1940
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
                      1⤵
                        PID:4960
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                        1⤵
                          PID:1720
                        • C:\Windows\system32\msiexec.exe
                          C:\Windows\system32\msiexec.exe /V
                          1⤵
                          • Enumerates connected drives
                          • Drops file in Program Files directory
                          • Drops file in Windows directory
                          • Modifies Internet Explorer settings
                          • Modifies data under HKEY_USERS
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2672
                          • C:\Windows\syswow64\MsiExec.exe
                            C:\Windows\syswow64\MsiExec.exe -Embedding 15E4BAE317021BA585F11AD14D6105BD
                            2⤵
                            • Loads dropped DLL
                            PID:3644
                          • C:\Windows\syswow64\MsiExec.exe
                            C:\Windows\syswow64\MsiExec.exe -Embedding F7372EE87186C8EB347D449B8F9988D1 E Global\MSI0000
                            2⤵
                            • Loads dropped DLL
                            PID:4636
                          • C:\Windows\syswow64\MsiExec.exe
                            C:\Windows\syswow64\MsiExec.exe -Embedding 6AC2BADE1FB8DBE56985820B99161ABF
                            2⤵
                            • Loads dropped DLL
                            • Drops file in System32 directory
                            PID:972
                          • C:\Windows\syswow64\MsiExec.exe
                            C:\Windows\syswow64\MsiExec.exe -Embedding B3C95700B135895510CBB37D62FDE2E7 E Global\MSI0000
                            2⤵
                            • Loads dropped DLL
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5252
                          • C:\Windows\Installer\MSIF92B.tmp
                            "C:\Windows\Installer\MSIF92B.tmp" /b 2 120 0
                            2⤵
                            • Executes dropped EXE
                            PID:5308
                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe" 19.010.20098 19.010.20069.0
                            2⤵
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            PID:5808
                          • C:\Windows\syswow64\MsiExec.exe
                            C:\Windows\syswow64\MsiExec.exe -Embedding CB3CE494F076C14E1CC960E685DD53EA
                            2⤵
                              PID:4896
                            • C:\Windows\syswow64\MsiExec.exe
                              C:\Windows\syswow64\MsiExec.exe -Embedding 67C8869C39D75A6AC6445BD959CC2916 E Global\MSI0000
                              2⤵
                                PID:5740
                              • C:\Windows\syswow64\MsiExec.exe
                                C:\Windows\syswow64\MsiExec.exe -Embedding 4DF940AAEA41B3657F2348B7E9B67F3A
                                2⤵
                                • Drops file in System32 directory
                                PID:5580
                              • C:\Windows\syswow64\MsiExec.exe
                                C:\Windows\syswow64\MsiExec.exe -Embedding 47C5DA15FB92B2D0B41371B51124501B E Global\MSI0000
                                2⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                PID:5872
                              • C:\Windows\Installer\MSI79E3.tmp
                                "C:\Windows\Installer\MSI79E3.tmp" /b 2 120 0
                                2⤵
                                • Executes dropped EXE
                                PID:1540
                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe" 21.011.20039 19.010.20098.0
                                2⤵
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                PID:5944
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
                                  --postMsg
                                  3⤵
                                  • Executes dropped EXE
                                  PID:968
                            • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
                              "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:1412
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\13160edab74cc2dd34653920d4bf56e487fea2fd6adf8249e0be9215ced902b4.pdf
                              1⤵
                              • Adds Run key to start application
                              • Enumerates system info in registry
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                              • Suspicious use of FindShellTrayWindow
                              PID:2128
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffea6e546f8,0x7ffea6e54708,0x7ffea6e54718
                                2⤵
                                  PID:1720
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2372,14719037669122231749,562943162357005259,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2400 /prefetch:2
                                  2⤵
                                    PID:1952
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2372,14719037669122231749,562943162357005259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:3
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2856
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2372,14719037669122231749,562943162357005259,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3316 /prefetch:8
                                    2⤵
                                      PID:4012
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2372,14719037669122231749,562943162357005259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
                                      2⤵
                                        PID:4748
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2372,14719037669122231749,562943162357005259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
                                        2⤵
                                          PID:2704
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2372,14719037669122231749,562943162357005259,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
                                          2⤵
                                            PID:4304
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2372,14719037669122231749,562943162357005259,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5808 /prefetch:6
                                            2⤵
                                              PID:2400
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2372,14719037669122231749,562943162357005259,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
                                              2⤵
                                                PID:4572
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2372,14719037669122231749,562943162357005259,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
                                                2⤵
                                                  PID:1060
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2372,14719037669122231749,562943162357005259,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
                                                  2⤵
                                                    PID:1684
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2372,14719037669122231749,562943162357005259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
                                                    2⤵
                                                      PID:4480
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                                                      2⤵
                                                        PID:640
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff7c52e5460,0x7ff7c52e5470,0x7ff7c52e5480
                                                          3⤵
                                                            PID:4932
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2372,14719037669122231749,562943162357005259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4972
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2372,14719037669122231749,562943162357005259,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
                                                          2⤵
                                                            PID:5068
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2372,14719037669122231749,562943162357005259,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2300 /prefetch:8
                                                            2⤵
                                                              PID:5972
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2372,14719037669122231749,562943162357005259,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7012 /prefetch:8
                                                              2⤵
                                                                PID:5284
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2372,14719037669122231749,562943162357005259,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4328 /prefetch:2
                                                                2⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:5632
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2372,14719037669122231749,562943162357005259,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
                                                                2⤵
                                                                  PID:1196
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                1⤵
                                                                  PID:2212
                                                                • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
                                                                  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  PID:3276
                                                                • C:\Windows\system32\compattelrunner.exe
                                                                  C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
                                                                  1⤵
                                                                  • Modifies data under HKEY_USERS
                                                                  PID:5556
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\13160edab74cc2dd34653920d4bf56e487fea2fd6adf8249e0be9215ced902b4.pdf"
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Checks processor information in registry
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:5728
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 1268
                                                                    2⤵
                                                                    • Program crash
                                                                    PID:5800
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 1268
                                                                    2⤵
                                                                    • Program crash
                                                                    PID:5112
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5728 -ip 5728
                                                                  1⤵
                                                                    PID:1480
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5728 -ip 5728
                                                                    1⤵
                                                                      PID:4896
                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\13160edab74cc2dd34653920d4bf56e487fea2fd6adf8249e0be9215ced902b4.pdf"
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Checks processor information in registry
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:5160
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 1216
                                                                        2⤵
                                                                        • Program crash
                                                                        PID:4496
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 1216
                                                                        2⤵
                                                                        • Program crash
                                                                        PID:5668
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5160 -ip 5160
                                                                      1⤵
                                                                        PID:768
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5160 -ip 5160
                                                                        1⤵
                                                                          PID:5436
                                                                        • C:\Windows\system32\OpenWith.exe
                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                          1⤵
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:6096
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\13160edab74cc2dd34653920d4bf56e487fea2fd6adf8249e0be9215ced902b4.pdf"
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          • Checks computer location settings
                                                                          • Loads dropped DLL
                                                                          • Checks whether UAC is enabled
                                                                          • Checks processor information in registry
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:6064
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            PID:5400
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=250751F6C6B9DED553D169418838EA46 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20091 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=250751F6C6B9DED553D169418838EA46 --renderer-client-id=2 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job /prefetch:1
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • Checks computer location settings
                                                                              PID:1496
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20091 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20091 Chrome/64.0.3282.119" --service-request-channel-token=24069C98CE11AE5CE446928193C1B3A8 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              PID:5116
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20091 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20091 Chrome/64.0.3282.119" --service-request-channel-token=01C2AAC82F6BAA1725FFB845F67CA9AF --mojo-platform-channel-handle=2156 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              PID:2080
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20091 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20091 Chrome/64.0.3282.119" --service-request-channel-token=8808ED7D67F1C4C562FE03D4869A1BBA --mojo-platform-channel-handle=2044 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              PID:5616
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20091 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20091 Chrome/64.0.3282.119" --service-request-channel-token=6B6189FAB5F9B3D7CB471B6BD7A6F811 --mojo-platform-channel-handle=2168 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              PID:5148
                                                                          • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
                                                                            "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:19.0 /MODE:3
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Checks whether UAC is enabled
                                                                            • Modifies system certificate store
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1920
                                                                          • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
                                                                            "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:19.0 /MODE:1
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Checks computer location settings
                                                                            • Checks whether UAC is enabled
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:5096
                                                                            • C:\ProgramData\Adobe\ARM\S\22663\AdobeARMHelper.exe
                                                                              "C:\ProgramData\Adobe\ARM\S\22663\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\22663" /MODE:1 /PRODUCT:Reader /VERSION:19.0 /LANG:ENU
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • Checks computer location settings
                                                                              • Checks whether UAC is enabled
                                                                              PID:5784
                                                                              • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
                                                                                "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\22663" /MODE:1 /PRODUCT:Reader /VERSION:19.0 /LANG:ENU
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                • Checks whether UAC is enabled
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:6068
                                                                        • C:\Windows\System32\svchost.exe
                                                                          C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                          1⤵
                                                                            PID:3368
                                                                          • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
                                                                            "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            PID:4352
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
                                                                            1⤵
                                                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                            PID:404
                                                                          • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
                                                                            "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            PID:64
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\13160edab74cc2dd34653920d4bf56e487fea2fd6adf8249e0be9215ced902b4.pdf"
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            • Checks computer location settings
                                                                            • Checks whether UAC is enabled
                                                                            • Checks processor information in registry
                                                                            • Modifies Internet Explorer settings
                                                                            • Modifies registry class
                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:220
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe" --backgroundcolor=16514043
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • Checks computer location settings
                                                                              PID:1420
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe" --type=gpu-process --field-trial-handle=1660,12063591047195102136,5081558183742236300,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/21.11.20039 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=OAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAABQAAABAAAAAAAAAAAAAAAAYAAAAQAAAAAAAAAAEAAAAFAAAAEAAAAAAAAAABAAAABgAAAA== --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --mojo-platform-channel-handle=1656 --allow-no-sandbox-job /prefetch:2
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                PID:5292
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1660,12063591047195102136,5081558183742236300,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=utility --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/21.11.20039 Chrome/80.0.0.0" --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --allow-no-sandbox-job /prefetch:8
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                PID:2076
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1660,12063591047195102136,5081558183742236300,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/21.11.20039 Chrome/80.0.0.0" --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --allow-no-sandbox-job /prefetch:8
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                PID:852
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe" --type=gpu-process --field-trial-handle=1660,12063591047195102136,5081558183742236300,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/21.11.20039 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=OAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAABQAAABAAAAAAAAAAAAAAAAYAAAAQAAAAAAAAAAEAAAAFAAAAEAAAAAAAAAABAAAABgAAAA== --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --mojo-platform-channel-handle=2216 --allow-no-sandbox-job /prefetch:2
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                PID:6052
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --touch-events=enabled --field-trial-handle=1660,12063591047195102136,5081558183742236300,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/21.11.20039 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2236 --allow-no-sandbox-job /prefetch:1
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                • Checks computer location settings
                                                                                PID:1664
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe" --type=gpu-process --field-trial-handle=1660,12063591047195102136,5081558183742236300,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/21.11.20039 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=OAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAABQAAABAAAAAAAAAAAAAAAAYAAAAQAAAAAAAAAAEAAAAFAAAAEAAAAAAAAAABAAAABgAAAA== --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --mojo-platform-channel-handle=2400 --allow-no-sandbox-job /prefetch:2
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                PID:5116
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --touch-events=enabled --field-trial-handle=1660,12063591047195102136,5081558183742236300,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/21.11.20039 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --mojo-platform-channel-handle=2672 --allow-no-sandbox-job /prefetch:1
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                • Checks computer location settings
                                                                                PID:5588
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --touch-events=enabled --field-trial-handle=1660,12063591047195102136,5081558183742236300,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/21.11.20039 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --mojo-platform-channel-handle=2924 --allow-no-sandbox-job /prefetch:1
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                • Checks computer location settings
                                                                                PID:752
                                                                            • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
                                                                              "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:21.0 /MODE:3
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • Checks whether UAC is enabled
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:4460
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.adobe.com/go/epdfrdr1_12_0_0?DTProd=Reader&DTServLvl=SignedOut
                                                                              2⤵
                                                                              • Adds Run key to start application
                                                                              • Enumerates system info in registry
                                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              PID:3872
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0xf8,0x134,0x7ffea6e546f8,0x7ffea6e54708,0x7ffea6e54718
                                                                                3⤵
                                                                                  PID:5852
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,6945263717261484548,510390088077420299,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
                                                                                  3⤵
                                                                                    PID:2284
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,6945263717261484548,510390088077420299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
                                                                                    3⤵
                                                                                      PID:4960
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,6945263717261484548,510390088077420299,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3256 /prefetch:8
                                                                                      3⤵
                                                                                        PID:3444
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6945263717261484548,510390088077420299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
                                                                                        3⤵
                                                                                          PID:4208
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6945263717261484548,510390088077420299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
                                                                                          3⤵
                                                                                            PID:1936
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2156,6945263717261484548,510390088077420299,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2812 /prefetch:8
                                                                                            3⤵
                                                                                              PID:5564
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6945263717261484548,510390088077420299,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
                                                                                              3⤵
                                                                                                PID:5544
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 3940
                                                                                              2⤵
                                                                                              • Program crash
                                                                                              PID:4780
                                                                                          • C:\Windows\system32\compattelrunner.exe
                                                                                            C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
                                                                                            1⤵
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:2868
                                                                                          • C:\Windows\SysWOW64\DllHost.exe
                                                                                            C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                            1⤵
                                                                                              PID:1540
                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                              1⤵
                                                                                                PID:3452
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 220 -ip 220
                                                                                                1⤵
                                                                                                  PID:5448
                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\13160edab74cc2dd34653920d4bf56e487fea2fd6adf8249e0be9215ced902b4.pdf"
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Checks computer location settings
                                                                                                  • Checks whether UAC is enabled
                                                                                                  • Checks processor information in registry
                                                                                                  • Modifies Internet Explorer settings
                                                                                                  • Modifies registry class
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:5676
                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe" --backgroundcolor=16514043
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Checks computer location settings
                                                                                                    PID:5060
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe" --type=gpu-process --field-trial-handle=1464,3808743729470245035,9561913819311651470,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/21.11.20039 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=OAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAABQAAABAAAAAAAAAAAAAAAAYAAAAQAAAAAAAAAAEAAAAFAAAAEAAAAAAAAAABAAAABgAAAA== --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --mojo-platform-channel-handle=1472 --allow-no-sandbox-job /prefetch:2
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:5180
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1464,3808743729470245035,9561913819311651470,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=utility --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/21.11.20039 Chrome/80.0.0.0" --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --allow-no-sandbox-job /prefetch:8
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:3652
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --touch-events=enabled --field-trial-handle=1464,3808743729470245035,9561913819311651470,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/21.11.20039 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2224 --allow-no-sandbox-job /prefetch:1
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Checks computer location settings
                                                                                                      PID:4112
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1464,3808743729470245035,9561913819311651470,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/21.11.20039 Chrome/80.0.0.0" --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --allow-no-sandbox-job /prefetch:8
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:5784
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe" --type=gpu-process --field-trial-handle=1464,3808743729470245035,9561913819311651470,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/21.11.20039 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=OAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAABQAAABAAAAAAAAAAAAAAAAYAAAAQAAAAAAAAAAEAAAAFAAAAEAAAAAAAAAABAAAABgAAAA== --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --mojo-platform-channel-handle=1988 --allow-no-sandbox-job /prefetch:2
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:1596
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe" --type=gpu-process --field-trial-handle=1464,3808743729470245035,9561913819311651470,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/21.11.20039 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=OAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAABQAAABAAAAAAAAAAAAAAAAYAAAAQAAAAAAAAAAEAAAAFAAAAEAAAAAAAAAABAAAABgAAAA== --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --mojo-platform-channel-handle=2708 --allow-no-sandbox-job /prefetch:2
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:5932
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --touch-events=enabled --field-trial-handle=1464,3808743729470245035,9561913819311651470,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/21.11.20039 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --mojo-platform-channel-handle=1904 --allow-no-sandbox-job /prefetch:1
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Checks computer location settings
                                                                                                      PID:676
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --touch-events=enabled --field-trial-handle=1464,3808743729470245035,9561913819311651470,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/21.11.20039 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --mojo-platform-channel-handle=2936 --allow-no-sandbox-job /prefetch:1
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Checks computer location settings
                                                                                                      PID:2476
                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:21.0 /MODE:3
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Checks whether UAC is enabled
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:5460
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.adobe.com/go/epdfrdr1_12_0_0?DTProd=Reader&DTServLvl=SignedOut
                                                                                                    2⤵
                                                                                                    • Adds Run key to start application
                                                                                                    • Enumerates system info in registry
                                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    PID:4392
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffea6e546f8,0x7ffea6e54708,0x7ffea6e54718
                                                                                                      3⤵
                                                                                                        PID:4488
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16906854778839301856,6985739736322556653,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
                                                                                                        3⤵
                                                                                                          PID:4532
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,16906854778839301856,6985739736322556653,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
                                                                                                          3⤵
                                                                                                            PID:4528
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,16906854778839301856,6985739736322556653,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
                                                                                                            3⤵
                                                                                                              PID:4092
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16906854778839301856,6985739736322556653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
                                                                                                              3⤵
                                                                                                                PID:1372
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16906854778839301856,6985739736322556653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
                                                                                                                3⤵
                                                                                                                  PID:5824
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,16906854778839301856,6985739736322556653,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4528 /prefetch:8
                                                                                                                  3⤵
                                                                                                                    PID:1292
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16906854778839301856,6985739736322556653,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
                                                                                                                    3⤵
                                                                                                                      PID:5396
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,16906854778839301856,6985739736322556653,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5368 /prefetch:8
                                                                                                                      3⤵
                                                                                                                        PID:2784
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16906854778839301856,6985739736322556653,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
                                                                                                                        3⤵
                                                                                                                          PID:4084
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16906854778839301856,6985739736322556653,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
                                                                                                                          3⤵
                                                                                                                            PID:3032
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2128,16906854778839301856,6985739736322556653,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=3720 /prefetch:8
                                                                                                                            3⤵
                                                                                                                              PID:3400
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window /prefetch:5
                                                                                                                              3⤵
                                                                                                                              • Adds Run key to start application
                                                                                                                              • Enumerates system info in registry
                                                                                                                              PID:3460
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea6e546f8,0x7ffea6e54708,0x7ffea6e54718
                                                                                                                                4⤵
                                                                                                                                  PID:4696
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,3966670593747491524,7746076985981332673,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
                                                                                                                                  4⤵
                                                                                                                                    PID:1840
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,3966670593747491524,7746076985981332673,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
                                                                                                                                    4⤵
                                                                                                                                      PID:5852
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,3966670593747491524,7746076985981332673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
                                                                                                                                      4⤵
                                                                                                                                        PID:1948
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5676 -s 4580
                                                                                                                                    2⤵
                                                                                                                                    • Program crash
                                                                                                                                    PID:4644
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5676 -ip 5676
                                                                                                                                  1⤵
                                                                                                                                    PID:1800
                                                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                    1⤵
                                                                                                                                      PID:4760
                                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                      1⤵
                                                                                                                                        PID:2584
                                                                                                                                      • C:\Windows\system32\OpenWith.exe
                                                                                                                                        C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                        1⤵
                                                                                                                                        • Modifies registry class
                                                                                                                                        PID:1032
                                                                                                                                        • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                                          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\13160edab74cc2dd34653920d4bf56e487fea2fd6adf8249e0be9215ced902b4.pdf
                                                                                                                                          2⤵
                                                                                                                                          • Opens file in notepad (likely ransom note)
                                                                                                                                          PID:1008

                                                                                                                                      Network

                                                                                                                                      MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                      Initial Access

                                                                                                                                      Execution

                                                                                                                                      Persistence

                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                      3
                                                                                                                                      T1060

                                                                                                                                      Privilege Escalation

                                                                                                                                      Defense Evasion

                                                                                                                                      Modify Registry

                                                                                                                                      4
                                                                                                                                      T1112

                                                                                                                                      Install Root Certificate

                                                                                                                                      1
                                                                                                                                      T1130

                                                                                                                                      Credential Access

                                                                                                                                      Discovery

                                                                                                                                      Query Registry

                                                                                                                                      4
                                                                                                                                      T1012

                                                                                                                                      System Information Discovery

                                                                                                                                      6
                                                                                                                                      T1082

                                                                                                                                      Peripheral Device Discovery

                                                                                                                                      1
                                                                                                                                      T1120

                                                                                                                                      Lateral Movement

                                                                                                                                      Collection

                                                                                                                                      Exfiltration

                                                                                                                                      Command and Control

                                                                                                                                      Impact

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
                                                                                                                                        MD5

                                                                                                                                        50b17d217f07d5968b34f42311638f74

                                                                                                                                        SHA1

                                                                                                                                        de0c092e9e157288c661f3471301fc5ee1bddbb5

                                                                                                                                        SHA256

                                                                                                                                        9ad7c8083743312c9742f5844f6eff38d9273c3e363ed872ec3640303764e74c

                                                                                                                                        SHA512

                                                                                                                                        5dddf066ebaecdffda6a023704f86b53849d8ba2806b196a71eadb6e250fc77681cab009c1feec691d27aaf0049d0358ac38d17ffe4d73d7a8af5952c5a2c6fb

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
                                                                                                                                        MD5

                                                                                                                                        50b17d217f07d5968b34f42311638f74

                                                                                                                                        SHA1

                                                                                                                                        de0c092e9e157288c661f3471301fc5ee1bddbb5

                                                                                                                                        SHA256

                                                                                                                                        9ad7c8083743312c9742f5844f6eff38d9273c3e363ed872ec3640303764e74c

                                                                                                                                        SHA512

                                                                                                                                        5dddf066ebaecdffda6a023704f86b53849d8ba2806b196a71eadb6e250fc77681cab009c1feec691d27aaf0049d0358ac38d17ffe4d73d7a8af5952c5a2c6fb

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
                                                                                                                                        MD5

                                                                                                                                        fd59fc6011af0e430fdc63aa15b6de75

                                                                                                                                        SHA1

                                                                                                                                        376a72f8ca10471b391d082e09d357a8a067e432

                                                                                                                                        SHA256

                                                                                                                                        28bafddf4f7f85cca3551a3920012e59a6fc4f9334ba80b9f755b43e605f9899

                                                                                                                                        SHA512

                                                                                                                                        11df7b783292f0d08df57eac67d25e1a2dac77010c2f3794dfc6895b532787a2cd2d57b7f72be04354db12a4082ed6760e322de766d6191c7b77c5e0f739c0b4

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Cache\Arm_001824311644_139460627116910577431925542835515373518.msi
                                                                                                                                        MD5

                                                                                                                                        daef9610629678de57c4567339f6e52c

                                                                                                                                        SHA1

                                                                                                                                        3c2f60cce0d017c9f93fe0d09c80a7ca0dc63d0f

                                                                                                                                        SHA256

                                                                                                                                        9aebffc9bb8192c5ba7e51bf7b47246d53837fab2b435d71ccaeaee1cd74c701

                                                                                                                                        SHA512

                                                                                                                                        9a550ec8cb373b6ab488750aa9c679e419b8dfeddf3ccb02593c044553b5bb447516ceebc18e73db2b8c848b79f124ed6764484795b8f4a6d58d954b77f0b4a5

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
                                                                                                                                        MD5

                                                                                                                                        10a58da77ae2073d1baf4f13630ea516

                                                                                                                                        SHA1

                                                                                                                                        aed9c3190f2a2508a150b2f03568f9aa0b4f00c0

                                                                                                                                        SHA256

                                                                                                                                        cb914e1a70aa98cbaae25192df867d73605aa9ae5db4ef77c274c266c2d0b2d8

                                                                                                                                        SHA512

                                                                                                                                        a83454e609d88111463e620f0ea2f2e066ec87136716ccc5146fab432a5fba8778335d9597cbf7bdf475207962194e0f6cf9c97ad8830c4694a23f5aa0a7766d

                                                                                                                                        Download Submit
                                                                                                                                      • C:\ProgramData\Adobe\ARM\ArmReport.ini
                                                                                                                                        MD5

                                                                                                                                        714f252df34509a2ecda93d271b53c49

                                                                                                                                        SHA1

                                                                                                                                        f6eb128e9e28db9b1994d1c7191646a8a62056f6

                                                                                                                                        SHA256

                                                                                                                                        962b13b21de2a981ef3e3a5a62b3d7a687c9037d0a5f176e836fceb3cc2ecbf0

                                                                                                                                        SHA512

                                                                                                                                        1c116022d76f69fc6a990121c28b81421e7239d6e1da91727c580cf167fd3a2882db1ce777fe8179d94bb5dfa3168ed6b64c6894b4a486730fd26c1af7901308

                                                                                                                                        Download Submit
                                                                                                                                      • C:\ProgramData\Adobe\ARM\ArmReport.ini
                                                                                                                                        MD5

                                                                                                                                        714f252df34509a2ecda93d271b53c49

                                                                                                                                        SHA1

                                                                                                                                        f6eb128e9e28db9b1994d1c7191646a8a62056f6

                                                                                                                                        SHA256

                                                                                                                                        962b13b21de2a981ef3e3a5a62b3d7a687c9037d0a5f176e836fceb3cc2ecbf0

                                                                                                                                        SHA512

                                                                                                                                        1c116022d76f69fc6a990121c28b81421e7239d6e1da91727c580cf167fd3a2882db1ce777fe8179d94bb5dfa3168ed6b64c6894b4a486730fd26c1af7901308

                                                                                                                                        Download Submit
                                                                                                                                      • C:\ProgramData\Adobe\ARM\S\21487\AdobeARM.msi
                                                                                                                                        MD5

                                                                                                                                        daef9610629678de57c4567339f6e52c

                                                                                                                                        SHA1

                                                                                                                                        3c2f60cce0d017c9f93fe0d09c80a7ca0dc63d0f

                                                                                                                                        SHA256

                                                                                                                                        9aebffc9bb8192c5ba7e51bf7b47246d53837fab2b435d71ccaeaee1cd74c701

                                                                                                                                        SHA512

                                                                                                                                        9a550ec8cb373b6ab488750aa9c679e419b8dfeddf3ccb02593c044553b5bb447516ceebc18e73db2b8c848b79f124ed6764484795b8f4a6d58d954b77f0b4a5

                                                                                                                                        Download Submit
                                                                                                                                      • C:\ProgramData\Adobe\ARM\S\21487\AdobeARMHelper.exe
                                                                                                                                        MD5

                                                                                                                                        522026a14d6bc781d2a15c665e454310

                                                                                                                                        SHA1

                                                                                                                                        9451a39108326ba578793b1feb62f23a02bce916

                                                                                                                                        SHA256

                                                                                                                                        fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e

                                                                                                                                        SHA512

                                                                                                                                        4e4eb2f582c8590899a0ada6133b705d13775f60818f1ff4f9bb35e40e09d6570af4f7ac4c80b525b445a03702ca0f3a9867a93080f90697d8be668e2abe2fe7

                                                                                                                                        Download Submit
                                                                                                                                      • C:\ProgramData\Adobe\ARM\S\21487\AdobeARMHelper.exe
                                                                                                                                        MD5

                                                                                                                                        522026a14d6bc781d2a15c665e454310

                                                                                                                                        SHA1

                                                                                                                                        9451a39108326ba578793b1feb62f23a02bce916

                                                                                                                                        SHA256

                                                                                                                                        fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e

                                                                                                                                        SHA512

                                                                                                                                        4e4eb2f582c8590899a0ada6133b705d13775f60818f1ff4f9bb35e40e09d6570af4f7ac4c80b525b445a03702ca0f3a9867a93080f90697d8be668e2abe2fe7

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6
                                                                                                                                        MD5

                                                                                                                                        c26335565c570f2cb860453d63956e6e

                                                                                                                                        SHA1

                                                                                                                                        988be209f8a7922ec4419095e108cc563164da15

                                                                                                                                        SHA256

                                                                                                                                        3dbac7dfe1dc5bf3ac2c4c2b2a5b118ac8f42915adec3cdad28dc94169e9e7d5

                                                                                                                                        SHA512

                                                                                                                                        5118494f46a173a13d333c1067b0d3440a4f23314d38e0a56219a4281d52383e37bc9dbe5b2ec257e11a2e2ca4a19a5fddbaaa1948d3f4d5369c1a5ac425a18d

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
                                                                                                                                        MD5

                                                                                                                                        76b85117ac9ac54dd783415fd0adaee5

                                                                                                                                        SHA1

                                                                                                                                        7e8ea42833e0c6366f41d1b72488ce659472bdf4

                                                                                                                                        SHA256

                                                                                                                                        36a0000505b65db9810240c1fb9d3d30ef3e945cbfe532b2bfd8a0b5c323ad53

                                                                                                                                        SHA512

                                                                                                                                        40119f9e4d2021ad9bdd6563fc49fbd6501ba288fb56e78fcaac7c13d04e9ef68826ed46dbd341635d660ec2a2eeb19ed9951862f32dda6fc6589094299246e3

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC
                                                                                                                                        MD5

                                                                                                                                        45864b921432eaba312ab922c1053738

                                                                                                                                        SHA1

                                                                                                                                        0b0bdb0ac731b20b4479ccc4fc1857e508d902ce

                                                                                                                                        SHA256

                                                                                                                                        86b0deff34c9c87ffe0f02ae8585ed3c2dd72a41fe569d39532d1292af6bb50e

                                                                                                                                        SHA512

                                                                                                                                        20df99eb084fb250375fadd3f71de7ca674ad63c56ad499c5e6a2b262813c154788a52cf26b23fef251da61c0c56c58a1f67c1e270f4378ba4e0e0c3b089f499

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6
                                                                                                                                        MD5

                                                                                                                                        84a9c51d293c0a4e856529e7d1e62837

                                                                                                                                        SHA1

                                                                                                                                        a24a724e481fd95a796f26003d8a2a1aefba7844

                                                                                                                                        SHA256

                                                                                                                                        360f9377134db8768e6a0beeb63fd5a743dfcb5cef5b40305ec2f1e46f5fc425

                                                                                                                                        SHA512

                                                                                                                                        e3727ef5a8a47ecda98c53b59d999182e0f77c7788a471d7a281e1c7d06f421da6402b3bfe6511bdd4d4118b2d23008ae81ebaf4da4e2fc7c9e35e39b6ba7a06

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
                                                                                                                                        MD5

                                                                                                                                        3a3fa94c2b0afc9a050a1b75da185caf

                                                                                                                                        SHA1

                                                                                                                                        5b1bab8777c55300566036002acf09cfd78ae951

                                                                                                                                        SHA256

                                                                                                                                        ca79f8b0a7e1d7bf794b2410b4671b10a60fa0249915a06815f804a3070f863a

                                                                                                                                        SHA512

                                                                                                                                        aecb4f666b8fa1d3c0c6e78ba0c3d09abaf03154a53ba1ec8769a174a66c3e5da99fd187fce66a8a115c46d495b7c888e8eaeecaed84f229b2b21317efc76345

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC
                                                                                                                                        MD5

                                                                                                                                        afbcb4a522d4e098f8bd376b9fdc8d7d

                                                                                                                                        SHA1

                                                                                                                                        c26afa605511a80c44e6f651af8b7ec7374e8172

                                                                                                                                        SHA256

                                                                                                                                        7b7ce42ed2c912dc66337127a653c41e1742926a0c93ae6219831acbfd45a5f2

                                                                                                                                        SHA512

                                                                                                                                        19a4b8a735eb54b1edc985b75f2dfe334a9f6b654b39e307422895e2d5836054a842d2d1bf15eaafebd2112f98a8f5702067bf8f0149e40ee691f2845bbf06d3

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
                                                                                                                                        MD5

                                                                                                                                        881379da7eef4c29cc5e34da6ad2b7c0

                                                                                                                                        SHA1

                                                                                                                                        305d620623eba417ff3982c360a7580ffe3028b4

                                                                                                                                        SHA256

                                                                                                                                        a21425f45eaa37fb33b4dface4680608ca43c19967584d01464b07ad077277cb

                                                                                                                                        SHA512

                                                                                                                                        77c705f7da6475baf2dc095c2427e9d24cba93dd91beb73ec3510099d9c4883a7ba27e6328a3e1878cd555685feb066484ffec4b8eb543f52486113ac2b2ea4b

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
                                                                                                                                        MD5

                                                                                                                                        f055363ad4569cf262cc7c72e6ec12bc

                                                                                                                                        SHA1

                                                                                                                                        b6c08a7e118c705d8019b3131a85c5e7d567b1cb

                                                                                                                                        SHA256

                                                                                                                                        bfda41b5a97e40f1439502196c2332382b28b9b54007c011a8dd3c4820e67871

                                                                                                                                        SHA512

                                                                                                                                        75289eeb5fe52c9462f393d573f54330df4da2e056db2cdcde7781fe29c5954828c2e07e889ea69e80b514f0495a69ea52c0af610ba688104c38dd1aa09a124e

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
                                                                                                                                        MD5

                                                                                                                                        864c22fb9a1c0670edf01c6ed3e4fbe4

                                                                                                                                        SHA1

                                                                                                                                        bf636f8baed998a1eb4531af9e833e6d3d8df129

                                                                                                                                        SHA256

                                                                                                                                        b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0

                                                                                                                                        SHA512

                                                                                                                                        ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSI38D6.tmp
                                                                                                                                        MD5

                                                                                                                                        c23d4d5a87e08f8a822ad5a8dbd69592

                                                                                                                                        SHA1

                                                                                                                                        317df555bc309dace46ae5c5589bec53ea8f137e

                                                                                                                                        SHA256

                                                                                                                                        6d149866246e79919bde5a0b45569ea41327c32ee250f37ad8216275a641bb27

                                                                                                                                        SHA512

                                                                                                                                        fa584655ae241004af44774a1f43508e53e95028ce96b39f8b5c62742f38acdf2b1df8871b468ac70c6043ca0e7ae8241bad2db6bc4f700d78471f12bb809e6b

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSI38D6.tmp
                                                                                                                                        MD5

                                                                                                                                        c23d4d5a87e08f8a822ad5a8dbd69592

                                                                                                                                        SHA1

                                                                                                                                        317df555bc309dace46ae5c5589bec53ea8f137e

                                                                                                                                        SHA256

                                                                                                                                        6d149866246e79919bde5a0b45569ea41327c32ee250f37ad8216275a641bb27

                                                                                                                                        SHA512

                                                                                                                                        fa584655ae241004af44774a1f43508e53e95028ce96b39f8b5c62742f38acdf2b1df8871b468ac70c6043ca0e7ae8241bad2db6bc4f700d78471f12bb809e6b

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSI3A3E.tmp
                                                                                                                                        MD5

                                                                                                                                        67f23a38c85856e8a20e815c548cd424

                                                                                                                                        SHA1

                                                                                                                                        16e8959c52f983e83f688f4cce3487364b1ffd10

                                                                                                                                        SHA256

                                                                                                                                        f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

                                                                                                                                        SHA512

                                                                                                                                        41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSI3A3E.tmp
                                                                                                                                        MD5

                                                                                                                                        67f23a38c85856e8a20e815c548cd424

                                                                                                                                        SHA1

                                                                                                                                        16e8959c52f983e83f688f4cce3487364b1ffd10

                                                                                                                                        SHA256

                                                                                                                                        f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

                                                                                                                                        SHA512

                                                                                                                                        41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSI3AAC.tmp
                                                                                                                                        MD5

                                                                                                                                        67f23a38c85856e8a20e815c548cd424

                                                                                                                                        SHA1

                                                                                                                                        16e8959c52f983e83f688f4cce3487364b1ffd10

                                                                                                                                        SHA256

                                                                                                                                        f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

                                                                                                                                        SHA512

                                                                                                                                        41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSI3AAC.tmp
                                                                                                                                        MD5

                                                                                                                                        67f23a38c85856e8a20e815c548cd424

                                                                                                                                        SHA1

                                                                                                                                        16e8959c52f983e83f688f4cce3487364b1ffd10

                                                                                                                                        SHA256

                                                                                                                                        f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

                                                                                                                                        SHA512

                                                                                                                                        41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSI3B3A.tmp
                                                                                                                                        MD5

                                                                                                                                        be0b6bea2e4e12bf5d966c6f74fa79b5

                                                                                                                                        SHA1

                                                                                                                                        8468ec23f0a30065eee6913bf8eba62dd79651ec

                                                                                                                                        SHA256

                                                                                                                                        6bac226fb3b530c6d4b409dd1858e0b53735abb5344779b6dfe8859658b2e164

                                                                                                                                        SHA512

                                                                                                                                        dddb9689ad4910cc6c40f5f343bd661bae23b986156f2a56ab32832ddb727af5c767c9f21f94eec3986023bae9a4f10f8d24a9af44fa6e8e7e8610d7b686867b

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSI3B3A.tmp
                                                                                                                                        MD5

                                                                                                                                        be0b6bea2e4e12bf5d966c6f74fa79b5

                                                                                                                                        SHA1

                                                                                                                                        8468ec23f0a30065eee6913bf8eba62dd79651ec

                                                                                                                                        SHA256

                                                                                                                                        6bac226fb3b530c6d4b409dd1858e0b53735abb5344779b6dfe8859658b2e164

                                                                                                                                        SHA512

                                                                                                                                        dddb9689ad4910cc6c40f5f343bd661bae23b986156f2a56ab32832ddb727af5c767c9f21f94eec3986023bae9a4f10f8d24a9af44fa6e8e7e8610d7b686867b

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSI3B89.tmp
                                                                                                                                        MD5

                                                                                                                                        67f23a38c85856e8a20e815c548cd424

                                                                                                                                        SHA1

                                                                                                                                        16e8959c52f983e83f688f4cce3487364b1ffd10

                                                                                                                                        SHA256

                                                                                                                                        f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

                                                                                                                                        SHA512

                                                                                                                                        41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSI3B89.tmp
                                                                                                                                        MD5

                                                                                                                                        67f23a38c85856e8a20e815c548cd424

                                                                                                                                        SHA1

                                                                                                                                        16e8959c52f983e83f688f4cce3487364b1ffd10

                                                                                                                                        SHA256

                                                                                                                                        f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

                                                                                                                                        SHA512

                                                                                                                                        41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSI6E52.tmp
                                                                                                                                        MD5

                                                                                                                                        0e91605ee2395145d077adb643609085

                                                                                                                                        SHA1

                                                                                                                                        303263aa6889013ce889bd4ea0324acdf35f29f2

                                                                                                                                        SHA256

                                                                                                                                        5472237b0947d129ab6ad89b71d8e007fd5c4624e97af28cd342919ba0d5f87b

                                                                                                                                        SHA512

                                                                                                                                        3712c3645be47db804f08ef0f44465d0545cd0d435b4e6310c39966ccb85a801645adb98781b548472b2dfd532dd79520bf3ff98042a5457349f2380b52b45be

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSI6E52.tmp
                                                                                                                                        MD5

                                                                                                                                        0e91605ee2395145d077adb643609085

                                                                                                                                        SHA1

                                                                                                                                        303263aa6889013ce889bd4ea0324acdf35f29f2

                                                                                                                                        SHA256

                                                                                                                                        5472237b0947d129ab6ad89b71d8e007fd5c4624e97af28cd342919ba0d5f87b

                                                                                                                                        SHA512

                                                                                                                                        3712c3645be47db804f08ef0f44465d0545cd0d435b4e6310c39966ccb85a801645adb98781b548472b2dfd532dd79520bf3ff98042a5457349f2380b52b45be

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSI7180.tmp
                                                                                                                                        MD5

                                                                                                                                        67f23a38c85856e8a20e815c548cd424

                                                                                                                                        SHA1

                                                                                                                                        16e8959c52f983e83f688f4cce3487364b1ffd10

                                                                                                                                        SHA256

                                                                                                                                        f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

                                                                                                                                        SHA512

                                                                                                                                        41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSI7180.tmp
                                                                                                                                        MD5

                                                                                                                                        67f23a38c85856e8a20e815c548cd424

                                                                                                                                        SHA1

                                                                                                                                        16e8959c52f983e83f688f4cce3487364b1ffd10

                                                                                                                                        SHA256

                                                                                                                                        f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

                                                                                                                                        SHA512

                                                                                                                                        41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSI725B.tmp
                                                                                                                                        MD5

                                                                                                                                        67f23a38c85856e8a20e815c548cd424

                                                                                                                                        SHA1

                                                                                                                                        16e8959c52f983e83f688f4cce3487364b1ffd10

                                                                                                                                        SHA256

                                                                                                                                        f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

                                                                                                                                        SHA512

                                                                                                                                        41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSI725B.tmp
                                                                                                                                        MD5

                                                                                                                                        67f23a38c85856e8a20e815c548cd424

                                                                                                                                        SHA1

                                                                                                                                        16e8959c52f983e83f688f4cce3487364b1ffd10

                                                                                                                                        SHA256

                                                                                                                                        f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

                                                                                                                                        SHA512

                                                                                                                                        41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSI81D.tmp
                                                                                                                                        MD5

                                                                                                                                        fadffef98d0f28368b843c6e9afd9782

                                                                                                                                        SHA1

                                                                                                                                        578101fadf1034c4a928b978260b120b740cdfb9

                                                                                                                                        SHA256

                                                                                                                                        73f7e51214b775421f6679acabc51ac1d34b4271116f5f3dd3426df50d214886

                                                                                                                                        SHA512

                                                                                                                                        ba5ab56a7e5d2e54fc304d77c78a14b35b187fdd95a090d39193b3da6ab40ef1b38c3cd56b160edceded3d622c0b645376efaf3df8fc8c437f448f91587f3233

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSI81D.tmp
                                                                                                                                        MD5

                                                                                                                                        fadffef98d0f28368b843c6e9afd9782

                                                                                                                                        SHA1

                                                                                                                                        578101fadf1034c4a928b978260b120b740cdfb9

                                                                                                                                        SHA256

                                                                                                                                        73f7e51214b775421f6679acabc51ac1d34b4271116f5f3dd3426df50d214886

                                                                                                                                        SHA512

                                                                                                                                        ba5ab56a7e5d2e54fc304d77c78a14b35b187fdd95a090d39193b3da6ab40ef1b38c3cd56b160edceded3d622c0b645376efaf3df8fc8c437f448f91587f3233

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSIB32E.tmp
                                                                                                                                        MD5

                                                                                                                                        67f23a38c85856e8a20e815c548cd424

                                                                                                                                        SHA1

                                                                                                                                        16e8959c52f983e83f688f4cce3487364b1ffd10

                                                                                                                                        SHA256

                                                                                                                                        f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

                                                                                                                                        SHA512

                                                                                                                                        41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSIB32E.tmp
                                                                                                                                        MD5

                                                                                                                                        67f23a38c85856e8a20e815c548cd424

                                                                                                                                        SHA1

                                                                                                                                        16e8959c52f983e83f688f4cce3487364b1ffd10

                                                                                                                                        SHA256

                                                                                                                                        f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

                                                                                                                                        SHA512

                                                                                                                                        41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSIB38D.tmp
                                                                                                                                        MD5

                                                                                                                                        be0b6bea2e4e12bf5d966c6f74fa79b5

                                                                                                                                        SHA1

                                                                                                                                        8468ec23f0a30065eee6913bf8eba62dd79651ec

                                                                                                                                        SHA256

                                                                                                                                        6bac226fb3b530c6d4b409dd1858e0b53735abb5344779b6dfe8859658b2e164

                                                                                                                                        SHA512

                                                                                                                                        dddb9689ad4910cc6c40f5f343bd661bae23b986156f2a56ab32832ddb727af5c767c9f21f94eec3986023bae9a4f10f8d24a9af44fa6e8e7e8610d7b686867b

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSIB38D.tmp
                                                                                                                                        MD5

                                                                                                                                        be0b6bea2e4e12bf5d966c6f74fa79b5

                                                                                                                                        SHA1

                                                                                                                                        8468ec23f0a30065eee6913bf8eba62dd79651ec

                                                                                                                                        SHA256

                                                                                                                                        6bac226fb3b530c6d4b409dd1858e0b53735abb5344779b6dfe8859658b2e164

                                                                                                                                        SHA512

                                                                                                                                        dddb9689ad4910cc6c40f5f343bd661bae23b986156f2a56ab32832ddb727af5c767c9f21f94eec3986023bae9a4f10f8d24a9af44fa6e8e7e8610d7b686867b

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSIB459.tmp
                                                                                                                                        MD5

                                                                                                                                        be0b6bea2e4e12bf5d966c6f74fa79b5

                                                                                                                                        SHA1

                                                                                                                                        8468ec23f0a30065eee6913bf8eba62dd79651ec

                                                                                                                                        SHA256

                                                                                                                                        6bac226fb3b530c6d4b409dd1858e0b53735abb5344779b6dfe8859658b2e164

                                                                                                                                        SHA512

                                                                                                                                        dddb9689ad4910cc6c40f5f343bd661bae23b986156f2a56ab32832ddb727af5c767c9f21f94eec3986023bae9a4f10f8d24a9af44fa6e8e7e8610d7b686867b

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSIB459.tmp
                                                                                                                                        MD5

                                                                                                                                        be0b6bea2e4e12bf5d966c6f74fa79b5

                                                                                                                                        SHA1

                                                                                                                                        8468ec23f0a30065eee6913bf8eba62dd79651ec

                                                                                                                                        SHA256

                                                                                                                                        6bac226fb3b530c6d4b409dd1858e0b53735abb5344779b6dfe8859658b2e164

                                                                                                                                        SHA512

                                                                                                                                        dddb9689ad4910cc6c40f5f343bd661bae23b986156f2a56ab32832ddb727af5c767c9f21f94eec3986023bae9a4f10f8d24a9af44fa6e8e7e8610d7b686867b

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSIB4B8.tmp
                                                                                                                                        MD5

                                                                                                                                        67f23a38c85856e8a20e815c548cd424

                                                                                                                                        SHA1

                                                                                                                                        16e8959c52f983e83f688f4cce3487364b1ffd10

                                                                                                                                        SHA256

                                                                                                                                        f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

                                                                                                                                        SHA512

                                                                                                                                        41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSIB4B8.tmp
                                                                                                                                        MD5

                                                                                                                                        67f23a38c85856e8a20e815c548cd424

                                                                                                                                        SHA1

                                                                                                                                        16e8959c52f983e83f688f4cce3487364b1ffd10

                                                                                                                                        SHA256

                                                                                                                                        f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

                                                                                                                                        SHA512

                                                                                                                                        41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSIB6BC.tmp
                                                                                                                                        MD5

                                                                                                                                        67f23a38c85856e8a20e815c548cd424

                                                                                                                                        SHA1

                                                                                                                                        16e8959c52f983e83f688f4cce3487364b1ffd10

                                                                                                                                        SHA256

                                                                                                                                        f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

                                                                                                                                        SHA512

                                                                                                                                        41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSIB6BC.tmp
                                                                                                                                        MD5

                                                                                                                                        67f23a38c85856e8a20e815c548cd424

                                                                                                                                        SHA1

                                                                                                                                        16e8959c52f983e83f688f4cce3487364b1ffd10

                                                                                                                                        SHA256

                                                                                                                                        f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

                                                                                                                                        SHA512

                                                                                                                                        41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSID562.tmp
                                                                                                                                        MD5

                                                                                                                                        0e91605ee2395145d077adb643609085

                                                                                                                                        SHA1

                                                                                                                                        303263aa6889013ce889bd4ea0324acdf35f29f2

                                                                                                                                        SHA256

                                                                                                                                        5472237b0947d129ab6ad89b71d8e007fd5c4624e97af28cd342919ba0d5f87b

                                                                                                                                        SHA512

                                                                                                                                        3712c3645be47db804f08ef0f44465d0545cd0d435b4e6310c39966ccb85a801645adb98781b548472b2dfd532dd79520bf3ff98042a5457349f2380b52b45be

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSID562.tmp
                                                                                                                                        MD5

                                                                                                                                        0e91605ee2395145d077adb643609085

                                                                                                                                        SHA1

                                                                                                                                        303263aa6889013ce889bd4ea0324acdf35f29f2

                                                                                                                                        SHA256

                                                                                                                                        5472237b0947d129ab6ad89b71d8e007fd5c4624e97af28cd342919ba0d5f87b

                                                                                                                                        SHA512

                                                                                                                                        3712c3645be47db804f08ef0f44465d0545cd0d435b4e6310c39966ccb85a801645adb98781b548472b2dfd532dd79520bf3ff98042a5457349f2380b52b45be

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSIE87.tmp
                                                                                                                                        MD5

                                                                                                                                        4184a5369d3bd6592b1db5cd2ac465ef

                                                                                                                                        SHA1

                                                                                                                                        be848190344933e38e0d40f0d56854594f113c42

                                                                                                                                        SHA256

                                                                                                                                        5f7b6321625dbc7901a8c22fc70d1902654aef3e47499d9e243ad7c2f83a0ac5

                                                                                                                                        SHA512

                                                                                                                                        49c10020c012cf89cfe27f31e51ca844c8ae0de9c21d3f491e5cab2b737693e1e09b37b4b8aeb1745524b0adce4a19ecc7d158b6eb97bcf2ba59c13569c200b1

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSIE87.tmp
                                                                                                                                        MD5

                                                                                                                                        4184a5369d3bd6592b1db5cd2ac465ef

                                                                                                                                        SHA1

                                                                                                                                        be848190344933e38e0d40f0d56854594f113c42

                                                                                                                                        SHA256

                                                                                                                                        5f7b6321625dbc7901a8c22fc70d1902654aef3e47499d9e243ad7c2f83a0ac5

                                                                                                                                        SHA512

                                                                                                                                        49c10020c012cf89cfe27f31e51ca844c8ae0de9c21d3f491e5cab2b737693e1e09b37b4b8aeb1745524b0adce4a19ecc7d158b6eb97bcf2ba59c13569c200b1

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSIF34.tmp
                                                                                                                                        MD5

                                                                                                                                        4184a5369d3bd6592b1db5cd2ac465ef

                                                                                                                                        SHA1

                                                                                                                                        be848190344933e38e0d40f0d56854594f113c42

                                                                                                                                        SHA256

                                                                                                                                        5f7b6321625dbc7901a8c22fc70d1902654aef3e47499d9e243ad7c2f83a0ac5

                                                                                                                                        SHA512

                                                                                                                                        49c10020c012cf89cfe27f31e51ca844c8ae0de9c21d3f491e5cab2b737693e1e09b37b4b8aeb1745524b0adce4a19ecc7d158b6eb97bcf2ba59c13569c200b1

                                                                                                                                        Download Submit
                                                                                                                                      • C:\Windows\Installer\MSIF34.tmp
                                                                                                                                        MD5

                                                                                                                                        4184a5369d3bd6592b1db5cd2ac465ef

                                                                                                                                        SHA1

                                                                                                                                        be848190344933e38e0d40f0d56854594f113c42

                                                                                                                                        SHA256

                                                                                                                                        5f7b6321625dbc7901a8c22fc70d1902654aef3e47499d9e243ad7c2f83a0ac5

                                                                                                                                        SHA512

                                                                                                                                        49c10020c012cf89cfe27f31e51ca844c8ae0de9c21d3f491e5cab2b737693e1e09b37b4b8aeb1745524b0adce4a19ecc7d158b6eb97bcf2ba59c13569c200b1

                                                                                                                                        Download Submit
                                                                                                                                      • \??\pipe\LOCAL\crashpad_2128_TOAWFMBYYWKTDEQM
                                                                                                                                        MD5

                                                                                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                        SHA1

                                                                                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                        SHA256

                                                                                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                        SHA512

                                                                                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                        Download Submit
                                                                                                                                      • memory/1952-186-0x00007FFEC7150000-0x00007FFEC7151000-memory.dmp
                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download
                                                                                                                                      • memory/3368-240-0x0000020782310000-0x0000020782314000-memory.dmp
                                                                                                                                        Filesize

                                                                                                                                        16KB

                                                                                                                                        Download
                                                                                                                                      • memory/3368-239-0x000002077FF60000-0x000002077FF70000-memory.dmp
                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download
                                                                                                                                      • memory/3368-238-0x000002077F550000-0x000002077F560000-memory.dmp
                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                        Download
                                                                                                                                      • memory/3368-241-0x00000207826B0000-0x00000207826B4000-memory.dmp
                                                                                                                                        Filesize

                                                                                                                                        16KB

                                                                                                                                        Download
                                                                                                                                      • memory/3368-242-0x00000207825A0000-0x00000207825A4000-memory.dmp
                                                                                                                                        Filesize

                                                                                                                                        16KB

                                                                                                                                        Download
                                                                                                                                      • memory/3368-243-0x0000020782340000-0x0000020782341000-memory.dmp
                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download
                                                                                                                                      • memory/3368-244-0x0000020782340000-0x0000020782344000-memory.dmp
                                                                                                                                        Filesize

                                                                                                                                        16KB

                                                                                                                                        Download
                                                                                                                                      • memory/3368-245-0x0000020782330000-0x0000020782331000-memory.dmp
                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download
                                                                                                                                      • memory/3368-246-0x0000020782330000-0x0000020782334000-memory.dmp
                                                                                                                                        Filesize

                                                                                                                                        16KB

                                                                                                                                        Download
                                                                                                                                      • memory/3368-247-0x0000020782230000-0x0000020782231000-memory.dmp
                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download