Analysis
-
max time kernel
106s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
16-09-2022 00:25
Behavioral task
behavioral1
Sample
ltau Club de Pontos - 4948.pdf
Resource
win10v2004-20220901-en
General
-
Target
ltau Club de Pontos - 4948.pdf
-
Size
42KB
-
MD5
a12d257ca8c13049822a3e8184f7b4c1
-
SHA1
dea3302bc312ff8fbd0e559c33aae6c5efd30035
-
SHA256
3788d6149a8a168e3ba3b4b8de34652d3e3c551f2b6a28d2235b1ae14c2e3675
-
SHA512
a87bc33041144a219d41036c12f52d71dc0de1c7ef22628235b3d2a1a3d3a7dd8394af84f5b44972f20550f309a60a010e7f4c154a3de55bc1a7f1db88ca6f97
-
SSDEEP
768:5LlxgbbL1CJumXXOnPZLVR8xx6fqFO0tjMVxYx6mpaYo4en2ckrbWw5D8ZKL:yCJ8PZLUyfH0VMVSx6m9obdkrpuy
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2e492fc7-094c-49bd-abd4-3b04e94cc980.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220916002711.pma setup.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
msedge.exechrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
AcroRd32.exemsedge.exemsedge.exeidentity_helper.exechrome.exechrome.exechrome.exechrome.exepid process 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 960 msedge.exe 960 msedge.exe 3268 msedge.exe 3268 msedge.exe 5548 identity_helper.exe 5548 identity_helper.exe 5960 chrome.exe 5960 chrome.exe 4468 chrome.exe 4468 chrome.exe 1860 chrome.exe 1860 chrome.exe 856 chrome.exe 856 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
Processes:
msedge.exechrome.exepid process 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe -
Suspicious use of FindShellTrayWindow 31 IoCs
Processes:
AcroRd32.exemsedge.exechrome.exepid process 3348 AcroRd32.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
AcroRd32.exepid process 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe 3348 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 3348 wrote to memory of 3748 3348 AcroRd32.exe RdrCEF.exe PID 3348 wrote to memory of 3748 3348 AcroRd32.exe RdrCEF.exe PID 3348 wrote to memory of 3748 3348 AcroRd32.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 3796 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe PID 3748 wrote to memory of 4728 3748 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ltau Club de Pontos - 4948.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3955EA2500EC0666479EBE25782A48D2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3796
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E00977B17F760124557317769B497A21 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E00977B17F760124557317769B497A21 --renderer-client-id=2 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:13⤵PID:4728
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C5E362595D7418AF569CB10C7692F21F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C5E362595D7418AF569CB10C7692F21F --renderer-client-id=4 --mojo-platform-channel-handle=2180 --allow-no-sandbox-job /prefetch:13⤵PID:5012
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BD65596CD457B79F2581A1722B0555CB --mojo-platform-channel-handle=1880 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4828
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E586FA97E8653552C51AEB327C447BE6 --mojo-platform-channel-handle=2560 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4612
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=41D756BF921D787084D6AE2B05B6E2AB --mojo-platform-channel-handle=2664 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4432
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pontosclubitis112.z19.web.core.windows.net/2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:3268 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffced2246f8,0x7ffced224708,0x7ffced2247183⤵PID:3840
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13508395880899744945,10160019229102782676,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1496 /prefetch:23⤵PID:4808
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,13508395880899744945,10160019229102782676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:960 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,13508395880899744945,10160019229102782676,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:83⤵PID:1800
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13508395880899744945,10160019229102782676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:13⤵PID:424
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13508395880899744945,10160019229102782676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:13⤵PID:3424
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,13508395880899744945,10160019229102782676,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4932 /prefetch:83⤵PID:5204
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13508395880899744945,10160019229102782676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:13⤵PID:5268
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13508395880899744945,10160019229102782676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:13⤵PID:5324
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13508395880899744945,10160019229102782676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:13⤵PID:5432
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,13508395880899744945,10160019229102782676,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5856 /prefetch:83⤵PID:5716
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13508395880899744945,10160019229102782676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:13⤵PID:6028
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13508395880899744945,10160019229102782676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:13⤵PID:6044
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,13508395880899744945,10160019229102782676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:83⤵PID:6120
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
PID:5148 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7a0ae5460,0x7ff7a0ae5470,0x7ff7a0ae54804⤵PID:5184
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,13508395880899744945,10160019229102782676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:5548 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pontosclubitis112.z19.web.core.windows.net/2⤵PID:5136
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffced2246f8,0x7ffced224708,0x7ffced2247183⤵PID:5156
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4588
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4468 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcefeb4f50,0x7ffcefeb4f60,0x7ffcefeb4f702⤵PID:4764
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1664,10202909487114335767,1260029593385779923,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1684 /prefetch:22⤵PID:5992
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1664,10202909487114335767,1260029593385779923,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2060 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5960 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1664,10202909487114335767,1260029593385779923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2312 /prefetch:82⤵PID:4820
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1664,10202909487114335767,1260029593385779923,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:12⤵PID:1808
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1664,10202909487114335767,1260029593385779923,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:3656
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1664,10202909487114335767,1260029593385779923,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:12⤵PID:4596
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,10202909487114335767,1260029593385779923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4584 /prefetch:82⤵PID:2804
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,10202909487114335767,1260029593385779923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4728 /prefetch:82⤵PID:3360
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,10202909487114335767,1260029593385779923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4556 /prefetch:82⤵PID:3140
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1664,10202909487114335767,1260029593385779923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4752 /prefetch:82⤵PID:5920
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1664,10202909487114335767,1260029593385779923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1860 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,10202909487114335767,1260029593385779923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5172 /prefetch:82⤵PID:1408
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1664,10202909487114335767,1260029593385779923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4724 /prefetch:82⤵PID:5848
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,10202909487114335767,1260029593385779923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5200 /prefetch:82⤵PID:2008
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1664,10202909487114335767,1260029593385779923,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:12⤵PID:6104
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1664,10202909487114335767,1260029593385779923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:856
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04Filesize
471B
MD5c10a8a488174f5ce89ae284595fd1f45
SHA1579e1bfa4fdc7387568530a99e758d387e18547c
SHA256a1f8f3d77bc8653995ae2950c21abb8a666066e3b9ecdd1db70ec3115962ccdf
SHA5127dff855735a69e39c1ef4429e03e99b5cc14c57d18de695c4e5db83d4e1335e81628d0fa10ca98aaf5a77ac1378ae6a2f0c9a0b30370c464f557003360a75897
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04Filesize
400B
MD589145b4f8b8d4e407c3dcb1eff4a5e61
SHA1a840fb611fd970f3f08dfdffc84642d4ff2f79df
SHA25617773a2d570518facf125656c095e9c5f60b3b05d1ca0741871eceeaad67a6c0
SHA512fe8ba332671087799cb2bc4c30c6125b777d8dbf8f4de7640e1adfd602068d370f35560225da0cafd800342c9c0267cd06e67b4dfb526edc0495f4083c8fac70
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD566bc9611dd085dd5e1366c94b84456cd
SHA1613339f5891bf2c9e54ef565c54eb18be42d65fb
SHA25627b4949b239ca2e2ce7812dd455868d97ce9c4851bb46eb0d7d5827285dd6c22
SHA512196973df9961ef3c91af4836cabe58b6e7df8aa410867ec6769b1407eea99532faf7c6efd351d4ef81f0ab12527756fd146fbe02220c93b9ced8368bd0488be6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnkFilesize
2KB
MD5ab07b4694cf26fd675f05aed28d3e760
SHA1ebb502861cfca264c4b869f1dade95a0d1f45054
SHA256ef593c657f7ec0713721d6a1c5c667cd8ce29cdb45f43ee2b556f67d6e597498
SHA512767c2f0060860e7151437b4d11e934783c46a84b1e867c32bca0a9852c39d859f826aea9c6d95c260094760bf6daea69270e1491b46e1a6a57f089c48aedac3e
-
\??\pipe\LOCAL\crashpad_3268_TDKVWVLIBCAPNRNZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_4468_XUUSRFCDVVVXFOAYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/424-167-0x0000000000000000-mapping.dmp
-
memory/960-162-0x0000000000000000-mapping.dmp
-
memory/1800-165-0x0000000000000000-mapping.dmp
-
memory/3268-158-0x0000000000000000-mapping.dmp
-
memory/3424-169-0x0000000000000000-mapping.dmp
-
memory/3748-135-0x0000000000000000-mapping.dmp
-
memory/3796-137-0x0000000000000000-mapping.dmp
-
memory/3840-159-0x0000000000000000-mapping.dmp
-
memory/4432-156-0x0000000000000000-mapping.dmp
-
memory/4612-153-0x0000000000000000-mapping.dmp
-
memory/4728-140-0x0000000000000000-mapping.dmp
-
memory/4808-161-0x0000000000000000-mapping.dmp
-
memory/4828-150-0x0000000000000000-mapping.dmp
-
memory/5012-145-0x0000000000000000-mapping.dmp
-
memory/5136-170-0x0000000000000000-mapping.dmp
-
memory/5148-187-0x0000000000000000-mapping.dmp
-
memory/5156-171-0x0000000000000000-mapping.dmp
-
memory/5184-188-0x0000000000000000-mapping.dmp
-
memory/5204-174-0x0000000000000000-mapping.dmp
-
memory/5268-176-0x0000000000000000-mapping.dmp
-
memory/5324-178-0x0000000000000000-mapping.dmp
-
memory/5432-180-0x0000000000000000-mapping.dmp
-
memory/5548-189-0x0000000000000000-mapping.dmp
-
memory/5716-182-0x0000000000000000-mapping.dmp
-
memory/6028-184-0x0000000000000000-mapping.dmp
-
memory/6044-186-0x0000000000000000-mapping.dmp