7939597e2d0616c98d28629f4f63d79f56c73463903c4260a2d12dba733de18d

General

Target

Earn_from_800_USD_per_day_with_an_initial_deposit_of_100_%24%24%24.-4404xvo9Plny6mc.pdf
Size

422KB
MD5

c7af49ef5f1222a20f8e25d96af99cb7
SHA1

0784d6bff707f764af65705464f0da7948efa7da
SHA256

7939597e2d0616c98d28629f4f63d79f56c73463903c4260a2d12dba733de18d
SHA512

2c425355ede0a3eabad8a73d5fcd9f0034a0744a41fa846de5d501c0f54a781b69ca92a06c5f1f482ed326becec5c32252be6763949bb6b6043b1467d2cf1b95
SSDEEP

12288:IBzGQIxM0wcowUu2w8g6oPUMjB2J3lSYal7aOSXjS:IBzdIvwcowrdhBGMplWOOm

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

AcroRd32.exe

pid	process
4912	AcroRd32.exe
4912	AcroRd32.exe
4912	AcroRd32.exe
4912	AcroRd32.exe
4912	AcroRd32.exe
4912	AcroRd32.exe
4912	AcroRd32.exe
4912	AcroRd32.exe
4912	AcroRd32.exe
4912	AcroRd32.exe
4912	AcroRd32.exe
4912	AcroRd32.exe
4912	AcroRd32.exe
4912	AcroRd32.exe
4912	AcroRd32.exe
4912	AcroRd32.exe
4912	AcroRd32.exe
4912	AcroRd32.exe
4912	AcroRd32.exe
4912	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

4912 AcroRd32.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

AcroRd32.exe

pid process

4912 AcroRd32.exe
4912 AcroRd32.exe
4912 AcroRd32.exe
4912 AcroRd32.exe
4912 AcroRd32.exe
4912 AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4912 wrote to memory of 4680	4912	AcroRd32.exe	RdrCEF.exe
PID 4912 wrote to memory of 4680	4912	AcroRd32.exe	RdrCEF.exe
PID 4912 wrote to memory of 4680	4912	AcroRd32.exe	RdrCEF.exe
PID 4912 wrote to memory of 2080	4912	AcroRd32.exe	RdrCEF.exe
PID 4912 wrote to memory of 2080	4912	AcroRd32.exe	RdrCEF.exe
PID 4912 wrote to memory of 2080	4912	AcroRd32.exe	RdrCEF.exe
PID 4912 wrote to memory of 3440	4912	AcroRd32.exe	RdrCEF.exe
PID 4912 wrote to memory of 3440	4912	AcroRd32.exe	RdrCEF.exe
PID 4912 wrote to memory of 3440	4912	AcroRd32.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3800	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3272	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3272	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3272	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3272	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3272	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3272	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3272	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3272	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3272	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3272	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3272	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3272	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3272	3440	RdrCEF.exe	RdrCEF.exe
PID 3440 wrote to memory of 3272	3440	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Earn_from_800_USD_per_day_with_an_initial_deposit_of_100_%24%24%24.-4404xvo9Plny6mc.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
PID:4680

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
PID:2080

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:3440

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A858DA8C3A4B6B8EEBC6E9AFF33787DB --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3800

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EE1C1FE452E6C7FA968AF2AEACBBCCF7 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EE1C1FE452E6C7FA968AF2AEACBBCCF7 --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3272

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=667688D66D590F00AF65AC3F1E18A449 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=667688D66D590F00AF65AC3F1E18A449 --renderer-client-id=4 --mojo-platform-channel-handle=2152 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4984

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=23B34D47E6B9FCD5A89D94DB59708232 --mojo-platform-channel-handle=2548 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2876

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=22F36DFADB71A3B48432819D6D9556B4 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4260

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=806F8EC2F60C5C4A5D10626E750B5BD1 --mojo-platform-channel-handle=1876 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bit.ly/3CiIqzl
2⤵
PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xc0,0x104,0x7ffe849746f8,0x7ffe84974708,0x7ffe84974718
3⤵
PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bit.ly/3CiIqzl
2⤵
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe849746f8,0x7ffe84974708,0x7ffe84974718
3⤵
PID:4024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1936

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e1661723f09a6aed8290c3f836ef2c2b

SHA1
55e08c810da94c08c5ee54ace181d4347f4e2ae5

SHA256
a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2

SHA512
dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad

Download Submit
memory/1080-157-0x0000000000000000-mapping.dmp

Download
memory/2080-133-0x0000000000000000-mapping.dmp

Download
memory/2876-149-0x0000000000000000-mapping.dmp

Download
memory/3272-139-0x0000000000000000-mapping.dmp

Download
memory/3344-160-0x0000000000000000-mapping.dmp

Download
memory/3440-134-0x0000000000000000-mapping.dmp

Download
memory/3800-136-0x0000000000000000-mapping.dmp

Download
memory/4024-159-0x0000000000000000-mapping.dmp

Download
memory/4260-152-0x0000000000000000-mapping.dmp

Download
memory/4632-158-0x0000000000000000-mapping.dmp

Download
memory/4648-155-0x0000000000000000-mapping.dmp

Download
memory/4680-132-0x0000000000000000-mapping.dmp

Download
memory/4984-144-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads