bandook | 8850d6b354a85417efa5bcc8ac2cac08f8840fafca848ef92d5267fa4e955b2f

Resubmissions

21-10-2023 15:47

231021-s8b6msfd8t 10

21-10-2023 14:46

231021-r5ksyagf83 7

Analysis

max time kernel
1200s
max time network
1206s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2023 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

COTIZACION GRUPO AMA_NECER 19-10-2023.pdf
Size

107KB
MD5

1ba1e989a14431d8a0fbea48d087ec45
SHA1

59b6f1e698f68f6a07647aa9eedea42804be6580
SHA256

8850d6b354a85417efa5bcc8ac2cac08f8840fafca848ef92d5267fa4e955b2f
SHA512

0e8ae4ec2dfe0d9e38e97ddddf55c29559c02ea66d44c7c0873bc0e61cda273d2c49fb24b528cbf9fd5203dcb90e5f0e8f88288ea5fe50c9c5b8dc8a34d62be2
SSDEEP

3072:tU+Yvdg642ZlUsVucdWjOIClE4QMIy6gvrh:tUPvd6mldu0WS10OPh

Score

10^/10

bandook persistence rat trojan upx

Malware Config

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 10 IoCs

resource	yara_rule
behavioral1/memory/4520-710-0x0000000013140000-0x0000000014C76000-memory.dmp	family_bandook
behavioral1/memory/4520-709-0x0000000013140000-0x0000000014C76000-memory.dmp	family_bandook
behavioral1/memory/4520-714-0x0000000013140000-0x0000000014C76000-memory.dmp	family_bandook
behavioral1/memory/4520-727-0x0000000013140000-0x0000000014C76000-memory.dmp	family_bandook
behavioral1/memory/4520-728-0x0000000013140000-0x0000000014C76000-memory.dmp	family_bandook
behavioral1/memory/4520-729-0x0000000013140000-0x0000000014C76000-memory.dmp	family_bandook
behavioral1/memory/4520-732-0x0000000013140000-0x0000000014C76000-memory.dmp	family_bandook
behavioral1/memory/4520-734-0x0000000013140000-0x0000000014C76000-memory.dmp	family_bandook
behavioral1/memory/4092-775-0x0000000013140000-0x0000000014C76000-memory.dmp	family_bandook
behavioral1/memory/4092-778-0x0000000013140000-0x0000000014C76000-memory.dmp	family_bandook

Executes dropped EXE 2 IoCs

pid	Process
1264	7G0S2K5T6.exe
1844	7G0S2K5T6.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4520-707-0x0000000013140000-0x0000000014C76000-memory.dmp	upx
behavioral1/memory/4520-708-0x0000000013140000-0x0000000014C76000-memory.dmp	upx
behavioral1/memory/4520-710-0x0000000013140000-0x0000000014C76000-memory.dmp	upx
behavioral1/memory/4520-709-0x0000000013140000-0x0000000014C76000-memory.dmp	upx
behavioral1/memory/4520-714-0x0000000013140000-0x0000000014C76000-memory.dmp	upx
behavioral1/memory/4520-727-0x0000000013140000-0x0000000014C76000-memory.dmp	upx
behavioral1/memory/4520-728-0x0000000013140000-0x0000000014C76000-memory.dmp	upx
behavioral1/memory/4520-729-0x0000000013140000-0x0000000014C76000-memory.dmp	upx
behavioral1/memory/4520-732-0x0000000013140000-0x0000000014C76000-memory.dmp	upx
behavioral1/memory/4520-734-0x0000000013140000-0x0000000014C76000-memory.dmp	upx
behavioral1/memory/4092-775-0x0000000013140000-0x0000000014C76000-memory.dmp	upx
behavioral1/memory/4092-778-0x0000000013140000-0x0000000014C76000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-356073083-3299209671-3108880702-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WJF = "C:\\Users\\Admin\\AppData\\Roaming\\WJF\\WJF.exe"	msinfo32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-356073083-3299209671-3108880702-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-356073083-3299209671-3108880702-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
4692	msedge.exe
4692	msedge.exe
4508	msedge.exe
4508	msedge.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1460	identity_helper.exe
1460	identity_helper.exe
5056	PowerShell.exe
5056	PowerShell.exe
5056	PowerShell.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4520	msinfo32.exe
4520	msinfo32.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4408	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeRestorePrivilege	828	7zG.exe
Token: 35	828	7zG.exe
Token: SeSecurityPrivilege	828	7zG.exe
Token: SeSecurityPrivilege	828	7zG.exe
Token: SeDebugPrivilege	5056	PowerShell.exe
Token: SeDebugPrivilege	4408	taskmgr.exe
Token: SeSystemProfilePrivilege	4408	taskmgr.exe
Token: SeCreateGlobalPrivilege	4408	taskmgr.exe
Token: 33	4408	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4408	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1160	AcroRd32.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
828	7zG.exe
4692	msedge.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe
4408	taskmgr.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe
1160	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 340	1160	AcroRd32.exe	83
PID 1160 wrote to memory of 340	1160	AcroRd32.exe	83
PID 1160 wrote to memory of 340	1160	AcroRd32.exe	83
PID 1160 wrote to memory of 4692	1160	AcroRd32.exe	84
PID 1160 wrote to memory of 4692	1160	AcroRd32.exe	84
PID 4692 wrote to memory of 2128	4692	msedge.exe	85
PID 4692 wrote to memory of 2128	4692	msedge.exe	85
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 112	340	RdrCEF.exe	86
PID 340 wrote to memory of 3548	340	RdrCEF.exe	87
PID 340 wrote to memory of 3548	340	RdrCEF.exe	87
PID 340 wrote to memory of 3548	340	RdrCEF.exe	87
PID 340 wrote to memory of 3548	340	RdrCEF.exe	87
PID 340 wrote to memory of 3548	340	RdrCEF.exe	87
PID 340 wrote to memory of 3548	340	RdrCEF.exe	87
PID 340 wrote to memory of 3548	340	RdrCEF.exe	87
PID 340 wrote to memory of 3548	340	RdrCEF.exe	87
PID 340 wrote to memory of 3548	340	RdrCEF.exe	87
PID 340 wrote to memory of 3548	340	RdrCEF.exe	87
PID 340 wrote to memory of 3548	340	RdrCEF.exe	87
PID 340 wrote to memory of 3548	340	RdrCEF.exe	87
PID 340 wrote to memory of 3548	340	RdrCEF.exe	87
PID 340 wrote to memory of 3548	340	RdrCEF.exe	87
PID 340 wrote to memory of 3548	340	RdrCEF.exe	87
PID 340 wrote to memory of 3548	340	RdrCEF.exe	87

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\COTIZACION GRUPO AMA_NECER 19-10-2023.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:340
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=395A321FC500B271D2A6786149F33B3A --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:112
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3482CEF1919F635A9F98360BE25F587E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3482CEF1919F635A9F98360BE25F587E --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3548
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=08FC774D4FAFEE1878EA1E75E836E637 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=08FC774D4FAFEE1878EA1E75E836E637 --renderer-client-id=4 --mojo-platform-channel-handle=2148 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3896
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7775E485B646F45BE34E724D38F093EF --mojo-platform-channel-handle=2728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2768
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E447721AC3387FE04DAD8A1333F14C38 --mojo-platform-channel-handle=1968 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3900
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6C4CD0B87256E6163CC7429F79EB23E7 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://docs.google.com/uc?export=download&id=1FuHdaiuFlFzChdjJA_m-b1rhc8lGTERc
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffacf46f8,0x7ffffacf4708,0x7ffffacf4718
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,5899050261652309050,17666516898576434171,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,5899050261652309050,17666516898576434171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,5899050261652309050,17666516898576434171,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5899050261652309050,17666516898576434171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5899050261652309050,17666516898576434171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:2884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5899050261652309050,17666516898576434171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5899050261652309050,17666516898576434171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5899050261652309050,17666516898576434171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2020,5899050261652309050,17666516898576434171,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3456 /prefetch:8
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5899050261652309050,17666516898576434171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
    3⤵
    PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5899050261652309050,17666516898576434171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
    3⤵
    PID:1596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5899050261652309050,17666516898576434171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,5899050261652309050,17666516898576434171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
    3⤵
    PID:3952
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,5899050261652309050,17666516898576434171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5899050261652309050,17666516898576434171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,5899050261652309050,17666516898576434171,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5420 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3068

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap23286:80:7zEvent16940
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:828

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
"PowerShell.exe" -noexit -command Set-Location -literalPath 'C:\Users\Admin\Downloads\1765230759\HK-653201'
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Users\Admin\Downloads\1765230759\HK-653201\7G0S2K5T6.exe
"C:\Users\Admin\Downloads\1765230759\HK-653201\7G0S2K5T6.exe"
1⤵
- Executes dropped EXE
PID:1264
- C:\windows\SysWOW64\msinfo32.exe
  C:\windows\syswow64\msinfo32.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Users\Admin\Downloads\1765230759\HK-653201\7G0S2K5T6.exe
  C:\Users\Admin\Downloads\1765230759\HK-653201\7G0S2K5T6.exe CMKAUWWWWWWA
  2⤵
  - Executes dropped EXE
  PID:1844
- - C:\windows\SysWOW64\msinfo32.exe
    C:\windows\syswow64\msinfo32.exe
    3⤵
    - Adds Run key to start application
    PID:4092

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1

Filesize
264KB

MD5
ef46ec58a6d25561480e233cdec2884d

SHA1
90d1f431d0925945547e2838cd842561cdc4d798

SHA256
6dbcf6dbe0edf752a02e6c763f9048d2fd057af8f0ce804a57d84ba5c6b8ebb4

SHA512
db5c7bbde295ef9f06ab78986df804870c8c9839b633e7591491b0d8b4a3feb0abbf76ac77dbd2ef09b70fa29896128557346c248ae72b5b722184d9c3e37f10

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
c42dbe94883b3bbf0442ab09b4be1572

SHA1
90f48b12c903634da63166daa625ba98eac8173e

SHA256
deee34578a28d5bfae311bfe93fcf4ddd574aaad00030e5d4267fdd1c84a78a3

SHA512
21d94ccf3d7c6e02da6f359b47187735883400bf43d9903de3496909e27488d23ce42dd68706021ac7612f2318813f32b6dcac561e8710fba1ab09bab44ee804

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0477e8d5f2ca61e6037746d359e0e27

SHA1
025ecbf1ee3429c252baca04b648b0b1c343d5b6

SHA256
5247adecb13d0664e188ba65524419d0b4960e948b267bd1a059e71218b49d5a

SHA512
f04dd3db67545bd46ea597d514272df57d6040ec8a3d391d2bfed09d5a1ab96943fa5013f850ea5c3b56617a0a12949ea75ecac892fd167a329ee8fe01189c5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
519B

MD5
b28f0c91b527e612ec92d5734152ee37

SHA1
15d8f7cc1c51e8cf9ac25d3abf3d901324857c8b

SHA256
fa610629c6a82ece3dfc181dd08f1fe926b03e4143832c22d4265ec46106eedc

SHA512
76dd65deee3c229ac80110a95a584c7dbe9e22c23021ed17ced70e625380b592c4d0370b57eda509f205070e69d715389291f4d0a6ae136ccc18bcccde4b8d50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9102197e6fb7950f23bc102aad362881

SHA1
c9eb8bc61ea2a2bb8c2480169167ca2730fb5445

SHA256
15a8603bcb70286d6a3190a613960431bda6c476ce583d76e40e1d30f4ddb610

SHA512
da4a49b45d7dee048a4b76ad4e4748f94ed05a8682b509006c2f85b1c31f45a766a6b59b202d4059aff2351e2c46813c0814d09316759e0bb5d9a62605734532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
93dc1202a8bd8ea42ab49a9ca2dc10bd

SHA1
8d6476aae5906a1b289e7a5f54c197966c361061

SHA256
c6f0f9897f54b8d1c6146a6e674df38d3f332d63852604f1de27b1b6cbdb74f5

SHA512
b630954e78381195a04e8e9c3cd348e811f667227a1145c29263b373fcfa845ca924576320e02e83f6e3c3c14717169eed9ecd6d0a225eec88786959c8cb87b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
934ec9b55ebd10f4cb12aaab0b9ba30d

SHA1
c866554ead9b60663a1aab8300c7c01cfe6a47c9

SHA256
a07754e46f59475298a113ae69941dcd3c81ef20a2fc1fddcc4e4ca26d80231c

SHA512
7b1c7bf658008d6347e6dad64b85df28165baa0e4040c1403953323b5d783b1a01c6a9e1a3af92ef1420b6c2914c23da2d01ff5b0402a1658de2df5466ecd81d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
78ddf646b677edfdc3743730d0ae969b

SHA1
2834692ca105a5387afcafc2179d8e1021909ae2

SHA256
0b0187771ab2a3ca3d3d74fdc473d3baa8844d2da2ec6961ea9014f43896b99b

SHA512
2f67041538953615c6804c362dbad816089d1a5ed603478d491e52029f7678aa5b1a1fceb913445ececc98886a54a1491d0a0fd8f5cc695601dcc48d05a16206

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7d06c2c945c9521577392104a8b0ad8d

SHA1
9ac516ce36a7b232902288c3ec75e09fd434d20b

SHA256
e500f6e655541d89f3682871b776b2d36e12929b190c698da5641f4dd178e8b6

SHA512
319fc60ff62e775566e7ff7a9ded17b73e1c641b9895175aacc627ee0a71cf6597c9296c20235bc7718631080e0cf5e9c6b8d8cf6c8007a474f57ffa170a81b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
527c2c08e070f1a81fbdf2ddedccb2ab

SHA1
2ea89cb47846cd3d5dfd33ca0deaf2a1ffa53cc3

SHA256
325e85dd3113255bc193ba6f2e3b50bb8e48904d3ffa2d4e1f90a535d0718eb8

SHA512
97d8500f780321c847ae871dd19d7c464bc407b8bdf0434548f7440804aa4b71f62306a10282db6ac2ada6dbf1dc9adb155bd7d8c7d9344150f2178c12548f62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2487953f637e0125fa6c14e32997bd1c

SHA1
4266a87542a4402d84dddecb80a77b7de02c045b

SHA256
c322401d8d5cdda0c308606cd0759b0c55a06d8812ccc20278f9f93ec16a5b35

SHA512
84006d7c86e12baf0b7289b842b05c2c7c443db11fc081fec8e496c4a07ed849023ee0b9842e4db8886c3d757a682e040bae5b051f02567d5a41cf2f314e0d8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2qx2n2u2.bh4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\WJF\WJF.exe

Filesize
15.9MB

MD5
594a5cef56ca8b69db774fbba876a82c

SHA1
bd8ffeac459f0c99535646f1b9b24d09671fbb07

SHA256
43ef83834bed96b2e3eed0ac0f713dab1c78909b1ddd4dc7c945cc9d44dedad4

SHA512
53b51798aa85009b7075e68d3f10e079320fbe4f47f193bc6b07c7e1e62297b3f59023cefaaa3c20baf15ecfc7793a9a440b11a3e532ae5ffc0ec1a3059f7669

Download Submit
C:\Users\Admin\Downloads\1765230759.7z

Filesize
11.6MB

MD5
aea64ffd43dc6853aa3e3d8d1392d0fb

SHA1
7e21d4efaa997f7adc9099ec7f0c4e23f6e1e175

SHA256
adcf59602cd622d9e856d71c8e5697edd144643211a842c0bd54b572cc78d253

SHA512
12a2f4a2e72716d3358990533d6b88607fccc8986aa41a54b53a5fa8937b5d8da78436cb05a35b4bae9a25bb81e0fb3544dd8ad413616fec5770f89abe079d52

Download Submit
C:\Users\Admin\Downloads\1765230759.7z

Filesize
11.6MB

MD5
aea64ffd43dc6853aa3e3d8d1392d0fb

SHA1
7e21d4efaa997f7adc9099ec7f0c4e23f6e1e175

SHA256
adcf59602cd622d9e856d71c8e5697edd144643211a842c0bd54b572cc78d253

SHA512
12a2f4a2e72716d3358990533d6b88607fccc8986aa41a54b53a5fa8937b5d8da78436cb05a35b4bae9a25bb81e0fb3544dd8ad413616fec5770f89abe079d52

Download Submit
C:\Users\Admin\Downloads\1765230759\HK-653201\7G0S2K5T6.exe

Filesize
15.9MB

MD5
594a5cef56ca8b69db774fbba876a82c

SHA1
bd8ffeac459f0c99535646f1b9b24d09671fbb07

SHA256
43ef83834bed96b2e3eed0ac0f713dab1c78909b1ddd4dc7c945cc9d44dedad4

SHA512
53b51798aa85009b7075e68d3f10e079320fbe4f47f193bc6b07c7e1e62297b3f59023cefaaa3c20baf15ecfc7793a9a440b11a3e532ae5ffc0ec1a3059f7669

Download Submit
C:\Users\Admin\Downloads\1765230759\HK-653201\7G0S2K5T6.exe

Filesize
15.9MB

MD5
594a5cef56ca8b69db774fbba876a82c

SHA1
bd8ffeac459f0c99535646f1b9b24d09671fbb07

SHA256
43ef83834bed96b2e3eed0ac0f713dab1c78909b1ddd4dc7c945cc9d44dedad4

SHA512
53b51798aa85009b7075e68d3f10e079320fbe4f47f193bc6b07c7e1e62297b3f59023cefaaa3c20baf15ecfc7793a9a440b11a3e532ae5ffc0ec1a3059f7669

Download Submit
C:\Users\Admin\Downloads\1765230759\HK-653201\7G0S2K5T6.exe

Filesize
15.9MB

MD5
594a5cef56ca8b69db774fbba876a82c

SHA1
bd8ffeac459f0c99535646f1b9b24d09671fbb07

SHA256
43ef83834bed96b2e3eed0ac0f713dab1c78909b1ddd4dc7c945cc9d44dedad4

SHA512
53b51798aa85009b7075e68d3f10e079320fbe4f47f193bc6b07c7e1e62297b3f59023cefaaa3c20baf15ecfc7793a9a440b11a3e532ae5ffc0ec1a3059f7669

Download Submit
memory/1264-712-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/1264-679-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/1264-726-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/1264-706-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/1264-703-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/1264-702-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/1264-701-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/1264-681-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/1264-680-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/1264-676-0x00000000031E0000-0x00000000031E1000-memory.dmp

Filesize
4KB

Download
memory/1264-677-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/1264-678-0x00000000031E0000-0x00000000031E1000-memory.dmp

Filesize
4KB

Download
memory/1844-705-0x00000000015F0000-0x00000000015F1000-memory.dmp

Filesize
4KB

Download
memory/1844-711-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/1844-713-0x00000000015F0000-0x00000000015F1000-memory.dmp

Filesize
4KB

Download
memory/1844-715-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/1844-719-0x0000000000400000-0x00000000013F5000-memory.dmp

Filesize
16.0MB

Download
memory/4092-778-0x0000000013140000-0x0000000014C76000-memory.dmp

Filesize
27.2MB

Download
memory/4092-775-0x0000000013140000-0x0000000014C76000-memory.dmp

Filesize
27.2MB

Download
memory/4520-732-0x0000000013140000-0x0000000014C76000-memory.dmp

Filesize
27.2MB

Download
memory/4520-727-0x0000000013140000-0x0000000014C76000-memory.dmp

Filesize
27.2MB

Download
memory/4520-707-0x0000000013140000-0x0000000014C76000-memory.dmp

Filesize
27.2MB

Download
memory/4520-708-0x0000000013140000-0x0000000014C76000-memory.dmp

Filesize
27.2MB

Download
memory/4520-710-0x0000000013140000-0x0000000014C76000-memory.dmp

Filesize
27.2MB

Download
memory/4520-709-0x0000000013140000-0x0000000014C76000-memory.dmp

Filesize
27.2MB

Download
memory/4520-728-0x0000000013140000-0x0000000014C76000-memory.dmp

Filesize
27.2MB

Download
memory/4520-729-0x0000000013140000-0x0000000014C76000-memory.dmp

Filesize
27.2MB

Download
memory/4520-734-0x0000000013140000-0x0000000014C76000-memory.dmp

Filesize
27.2MB

Download
memory/4520-714-0x0000000013140000-0x0000000014C76000-memory.dmp

Filesize
27.2MB

Download
memory/5056-373-0x000002634AE60000-0x000002634AE70000-memory.dmp

Filesize
64KB

Download
memory/5056-353-0x000002634AE30000-0x000002634AE52000-memory.dmp

Filesize
136KB

Download
memory/5056-382-0x000002634B450000-0x000002634B46E000-memory.dmp

Filesize
120KB

Download
memory/5056-372-0x000002634AE60000-0x000002634AE70000-memory.dmp

Filesize
64KB

Download
memory/5056-358-0x000002634AE60000-0x000002634AE70000-memory.dmp

Filesize
64KB

Download
memory/5056-359-0x000002634AE60000-0x000002634AE70000-memory.dmp

Filesize
64KB

Download
memory/5056-534-0x00007FFFE8830000-0x00007FFFE92F1000-memory.dmp

Filesize
10.8MB

Download
memory/5056-371-0x00007FFFE8830000-0x00007FFFE92F1000-memory.dmp

Filesize
10.8MB

Download
memory/5056-361-0x000002634B4D0000-0x000002634B546000-memory.dmp

Filesize
472KB

Download
memory/5056-360-0x000002634B400000-0x000002634B444000-memory.dmp

Filesize
272KB

Download
memory/5056-357-0x00007FFFE8830000-0x00007FFFE92F1000-memory.dmp

Filesize
10.8MB

Download