8850d6b354a85417efa5bcc8ac2cac08f8840fafca848ef92d5267fa4e955b2f

Resubmissions

21-10-2023 15:47

231021-s8b6msfd8t 10

21-10-2023 14:46

231021-r5ksyagf83 7

Analysis

max time kernel
403s
max time network
265s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2023 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

COTIZACION GRUPO AMA_NECER 19-10-2023.pdf
Size

107KB
MD5

1ba1e989a14431d8a0fbea48d087ec45
SHA1

59b6f1e698f68f6a07647aa9eedea42804be6580
SHA256

8850d6b354a85417efa5bcc8ac2cac08f8840fafca848ef92d5267fa4e955b2f
SHA512

0e8ae4ec2dfe0d9e38e97ddddf55c29559c02ea66d44c7c0873bc0e61cda273d2c49fb24b528cbf9fd5203dcb90e5f0e8f88288ea5fe50c9c5b8dc8a34d62be2
SSDEEP

3072:tU+Yvdg642ZlUsVucdWjOIClE4QMIy6gvrh:tUPvd6mldu0WS10OPh

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

7G0S2K5T6.exe7G0S2K5T6.exe

pid process

5840 7G0S2K5T6.exe
3508 7G0S2K5T6.exe

pid	process
5840	7G0S2K5T6.exe
3508	7G0S2K5T6.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 2 IoCs

Processes:

msedge.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

AcroRd32.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
864	AcroRd32.exe
864	AcroRd32.exe
864	AcroRd32.exe
864	AcroRd32.exe
864	AcroRd32.exe
864	AcroRd32.exe
864	AcroRd32.exe
864	AcroRd32.exe
864	AcroRd32.exe
864	AcroRd32.exe
864	AcroRd32.exe
864	AcroRd32.exe
864	AcroRd32.exe
864	AcroRd32.exe
864	AcroRd32.exe
864	AcroRd32.exe
864	AcroRd32.exe
864	AcroRd32.exe
864	AcroRd32.exe
864	AcroRd32.exe
1260	msedge.exe
1260	msedge.exe
3540	msedge.exe
3540	msedge.exe
1372	identity_helper.exe
1372	identity_helper.exe
5204	msedge.exe
5204	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

5168 7zFM.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

3540 msedge.exe
3540 msedge.exe
3540 msedge.exe
3540 msedge.exe
3540 msedge.exe
3540 msedge.exe
3540 msedge.exe
3540 msedge.exe

pid	process
5168	7zFM.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

7zG.exe7zFM.exe

description	pid	process
Token: SeRestorePrivilege	4576	7zG.exe
Token: 35	4576	7zG.exe
Token: SeSecurityPrivilege	4576	7zG.exe
Token: SeSecurityPrivilege	4576	7zG.exe
Token: SeRestorePrivilege	5168	7zFM.exe
Token: 35	5168	7zFM.exe

Suspicious use of FindShellTrayWindow 38 IoCs

Processes:

AcroRd32.exemsedge.exe7zG.exe7zFM.exe

pid	process
864	AcroRd32.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
4576	7zG.exe
5168	7zFM.exe
3540	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

AcroRd32.exeOpenWith.exe

pid process

864 AcroRd32.exe
864 AcroRd32.exe
864 AcroRd32.exe
864 AcroRd32.exe
864 AcroRd32.exe
864 AcroRd32.exe
5836 OpenWith.exe
864 AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 864 wrote to memory of 4788	864	AcroRd32.exe	RdrCEF.exe
PID 864 wrote to memory of 4788	864	AcroRd32.exe	RdrCEF.exe
PID 864 wrote to memory of 4788	864	AcroRd32.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3120	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 1160	4788	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\COTIZACION GRUPO AMA_NECER 19-10-2023.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3D8963961BCC93677CBCF60FA879F78E --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3120
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=41EE6B8E0592FB5CC78E4FCA8E410966 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=41EE6B8E0592FB5CC78E4FCA8E410966 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1160
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A5948CC1CC45B412620FC8E8B36C1217 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4336
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CAAEDFD18E99C051A17843EE53122B00 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CAAEDFD18E99C051A17843EE53122B00 --renderer-client-id=5 --mojo-platform-channel-handle=1852 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4816
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FEF6FDF952403F82DF02B3D80BFDBE89 --mojo-platform-channel-handle=1856 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4148
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4AB5B677ED9A5B9F2A1DF28325A14C21 --mojo-platform-channel-handle=2588 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://docs.google.com/uc?export=download&id=1FuHdaiuFlFzChdjJA_m-b1rhc8lGTERc
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd108346f8,0x7ffd10834708,0x7ffd10834718
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,459002645521647384,13810315608147519026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,459002645521647384,13810315608147519026,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,459002645521647384,13810315608147519026,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,459002645521647384,13810315608147519026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,459002645521647384,13810315608147519026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,459002645521647384,13810315608147519026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,459002645521647384,13810315608147519026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,459002645521647384,13810315608147519026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,459002645521647384,13810315608147519026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
    3⤵
    PID:1544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,459002645521647384,13810315608147519026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,459002645521647384,13810315608147519026,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3668 /prefetch:8
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,459002645521647384,13810315608147519026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3648 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,459002645521647384,13810315608147519026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,459002645521647384,13810315608147519026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,459002645521647384,13810315608147519026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
    3⤵
    PID:5728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1472

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6104

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap11744:80:7zEvent20205
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4576

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\1765230759.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5168

C:\Users\Admin\Downloads\1765230759\HK-653201\7G0S2K5T6.exe
"C:\Users\Admin\Downloads\1765230759\HK-653201\7G0S2K5T6.exe"
1⤵
- Executes dropped EXE
PID:5840
- C:\windows\SysWOW64\msinfo32.exe
  C:\windows\syswow64\msinfo32.exe
  2⤵
  PID:5284
- C:\Users\Admin\Downloads\1765230759\HK-653201\7G0S2K5T6.exe
  C:\Users\Admin\Downloads\1765230759\HK-653201\7G0S2K5T6.exe CMKAUWWWWWWA
  2⤵
  - Executes dropped EXE
  PID:3508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1

Filesize
264KB

MD5
0b9e74b0747d30ea69bc8bdf745c0ca1

SHA1
1e2505646ed58931e1bd289db0ac7795f9014d0b

SHA256
f1e6bf4f6bb40dc1fd36257738885f1dab3489fafe9e96f1e5ec4622d42a5335

SHA512
0608420711c646ea207b2c7c9330f7b30236de554097c6f299301b48bade1de79831aa5064d290f1710b227604c9cb685014f341eef26e4e2bb1897bd8ba702c

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
3135d687314344bc923a798ede896332

SHA1
4df121716e301c4b1d1283e494740d410b0ed1ca

SHA256
a6f6d1e685227277071b860a6fd0d5cab9321b0eaf3776270826fc2210dd23ee

SHA512
db7a2bc461aba45783824cea02ad390baab488c4bfe11798c00fd8bc2b4fb350e3bbca561b99ce97276675d2e7dfa4acd7f35f124b6ec0cf5d5b4c6e240b77ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
519B

MD5
518faed5504b8f6a57116cacbe1d64cb

SHA1
524ff17eb4cf539f0e1b64bba9f5e05a865bb53e

SHA256
96ec40cb7e08ec3fa1845de170eefe5e78384d84745158a0449179ecf4970523

SHA512
dac0eeb172229f2f28c332cfa469478bb7f2a3a09a038bad7e23a2d316ce74a176ed509cf4936bc378dee1bf18c0ce921f0d5d0c03fdec00083f9b5fdd37b79f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d94eacfc6f8356ec12a737bbdac3543c

SHA1
12a81f3e2e9ccd2db28d78d38ff1cea06f7e40ba

SHA256
5634dc4cf3d16da7824a69a9ae83ac165f287cb2ee80e76afa0731f260eab9f0

SHA512
cbae557d7a4976f62bbb16514cda13e2221908c86258acd60c339344bb759dfd522fe1163a2e663dad2f126e6eeab307553d4acc1697a12fa7dccc0cb037edda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6cce430af5ee08f11ecaf1b65b014083

SHA1
32bb8651aa94fa264d761d34634d870df11f17ba

SHA256
848b6fdbd1ca935badb1bef6120f3544667dbdac0cd66280f193fbe3f361def2

SHA512
4c922b7782a3d18d0bfd083ba276d31c5b29590690056613ae24e410d828a1d40eba64589bf630b4ad64fbd5951c352297ad2ec3866f77ce21bcf61a02ed9d03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
510f94b22720c929cd75407505956669

SHA1
ccd2f1e00c011229eb8fa1dd38b81f125ba46940

SHA256
7a6ffbc8436f533fb3a5211de334606caff621e4a3ed4d4abd6af7ab3cf2d564

SHA512
66b593aea857696d05a9fa8bbc4b9aa666cf7f30a66870ca294b954a3e3d52234e88da33b953c00b43d50dcd050e2bacbeb2c4cc7be01498a23aa835893f2e73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
fd20981c7184673929dfcab50885629b

SHA1
14c2437aad662b119689008273844bac535f946c

SHA256
28b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22

SHA512
b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9469bf9d52367f3b748e9d7cd491e530

SHA1
1001c24206ac9a03790fc6472f7cb0450493605f

SHA256
bab24c94e8bbe19472dc8937c4235f4059c5015fa1260c8849f1719c2d9946b6

SHA512
7d5215e7d36b626cd08b8f9d668177664e5d3cb6425eb7da91d76e9d8bef407ed4f2fc75e5ff7c43b49135a87484249c7c66b951eb19504731c1c87ac0ecbd9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9eb89940cd1e1919955d73e8f8484423

SHA1
3277d84ffb4c9962696be91e7b94c97a3073fe1b

SHA256
23a36d2fddee656735f3dd82bd74528381a0724c0bcef92f06bd7a63f01cb5f6

SHA512
419a4f3e4c5a93f3a1316740fc8451b5d5ac11caa13b1eba9e6341cd8c44956b05be67c7c261e9d14748d5376e23c76933e6d6cabee8613501086c148034c9ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5b7c3a519f06ddae53ce346bc5116b20

SHA1
f67a9af432801bdad4c7fa859f36f14f2f2bf97e

SHA256
1f5a852be11e9d2f7060e5a39784d46d98bf9dd0d2d9c3413f4f0f3d98c9012c

SHA512
ea86675e94e72dd0f8fca42776c559f8bb325287c973fd46b24a22c4c3fe871f83ea1257ac83c11c7c1fa268ffcfe8551fa79751e6f53381bea23487c54379c8

Download Submit
C:\Users\Admin\Downloads\1765230759.7z

Filesize
11.6MB

MD5
aea64ffd43dc6853aa3e3d8d1392d0fb

SHA1
7e21d4efaa997f7adc9099ec7f0c4e23f6e1e175

SHA256
adcf59602cd622d9e856d71c8e5697edd144643211a842c0bd54b572cc78d253

SHA512
12a2f4a2e72716d3358990533d6b88607fccc8986aa41a54b53a5fa8937b5d8da78436cb05a35b4bae9a25bb81e0fb3544dd8ad413616fec5770f89abe079d52

Download Submit
C:\Users\Admin\Downloads\1765230759.7z

Filesize
11.6MB

MD5
aea64ffd43dc6853aa3e3d8d1392d0fb

SHA1
7e21d4efaa997f7adc9099ec7f0c4e23f6e1e175

SHA256
adcf59602cd622d9e856d71c8e5697edd144643211a842c0bd54b572cc78d253

SHA512
12a2f4a2e72716d3358990533d6b88607fccc8986aa41a54b53a5fa8937b5d8da78436cb05a35b4bae9a25bb81e0fb3544dd8ad413616fec5770f89abe079d52

Download Submit
C:\Users\Admin\Downloads\1765230759\HK-653201\7G0S2K5T6.exe

Filesize
15.9MB

MD5
594a5cef56ca8b69db774fbba876a82c

SHA1
bd8ffeac459f0c99535646f1b9b24d09671fbb07

SHA256
43ef83834bed96b2e3eed0ac0f713dab1c78909b1ddd4dc7c945cc9d44dedad4

SHA512
53b51798aa85009b7075e68d3f10e079320fbe4f47f193bc6b07c7e1e62297b3f59023cefaaa3c20baf15ecfc7793a9a440b11a3e532ae5ffc0ec1a3059f7669

Download Submit
C:\Users\Admin\Downloads\1765230759\HK-653201\7G0S2K5T6.exe

Filesize
15.9MB

MD5
594a5cef56ca8b69db774fbba876a82c

SHA1
bd8ffeac459f0c99535646f1b9b24d09671fbb07

SHA256
43ef83834bed96b2e3eed0ac0f713dab1c78909b1ddd4dc7c945cc9d44dedad4

SHA512
53b51798aa85009b7075e68d3f10e079320fbe4f47f193bc6b07c7e1e62297b3f59023cefaaa3c20baf15ecfc7793a9a440b11a3e532ae5ffc0ec1a3059f7669

Download Submit
C:\Users\Admin\Downloads\1765230759\HK-653201\7G0S2K5T6.exe

Filesize
15.9MB

MD5
594a5cef56ca8b69db774fbba876a82c

SHA1
bd8ffeac459f0c99535646f1b9b24d09671fbb07

SHA256
43ef83834bed96b2e3eed0ac0f713dab1c78909b1ddd4dc7c945cc9d44dedad4

SHA512
53b51798aa85009b7075e68d3f10e079320fbe4f47f193bc6b07c7e1e62297b3f59023cefaaa3c20baf15ecfc7793a9a440b11a3e532ae5ffc0ec1a3059f7669

Download Submit
\??\pipe\LOCAL\crashpad_3540_WQTVTVMKAOQKQRTO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/5840-339-0x00000000015C0000-0x00000000015C1000-memory.dmp

Filesize
4KB

Download
memory/5840-338-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/5840-470-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/5840-472-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/5840-492-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/5840-493-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/5840-494-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/5840-332-0x00000000015C0000-0x00000000015C1000-memory.dmp

Filesize
4KB

Download