infinitylock | hxxp://malwarewatch[.]org

Resubmissions

03-08-2024 19:41

240803-yd9fjsxgpb 10

03-08-2024 19:38

240803-ycw4tsxgkh 7

03-08-2024 19:34

240803-yadvgatajk 10

13-05-2024 19:48

240513-yh3tkacb38 10

Analysis

max time kernel
213s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 19:48

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://malwarewatch.org

Score

10^/10

infinitylock bootkit persistence ransomware

Malware Config

Signatures

InfinityLock Ransomware
Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
ransomware infinitylock
Executes dropped EXE 1 IoCs

Processes:

sys3.exe

pid process

5736 sys3.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

113 camo.githubusercontent.com
120 camo.githubusercontent.com
143 raw.githubusercontent.com
144 raw.githubusercontent.com
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

[email protected]sys3.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 [email protected]
File opened for modification \??\PHYSICALDRIVE0 sys3.exe

pid	process
5736	sys3.exe

flow	ioc
113	camo.githubusercontent.com
120	camo.githubusercontent.com
143	raw.githubusercontent.com
144	raw.githubusercontent.com

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	[email protected]
File opened for modification	\??\PHYSICALDRIVE0	sys3.exe

Drops file in Program Files directory 64 IoCs

Processes:

[email protected]

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pl_get.svg.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\msedgeupdateres_pt-PT.dll.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Home.aapp.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PPKLite.api.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\editpdf.svg.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\bg_patterns_header.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Microsoft.VCLibs.x86.14.00.appx.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sv-se\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_ja_135x40.svg.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\TableTextService.dll.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_id.dll.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\msedgeupdateres_ru.dll.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ViewerPS.dll.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Close2x.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\file_icons.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ccloud.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nl-nl\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\adodb.dll.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_ca.dll.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AXE8SharedExpat.dll.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef.pak.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\IA32.api.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark2x.gif.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-down-pressed.gif.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\es-es\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\be_get.svg.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\th_get.svg.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\faf-main.css.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\MSFT_PackageManagement.strings.psd1.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\MSFT_PackageManagementSource.schema.mfl.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\pe.dll.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_received.gif.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\plugin.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\core_icons.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fr-fr\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\natives_blob.bin.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_issue.gif.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_2x.gif.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_int_2x.gif.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\msedgeupdateres_ur.dll.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-144x144-precomposed.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-default_32.svg.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\zh-cn_get.svg.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_fil.dll.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_ml.dll.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619	[email protected]

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

[email protected]taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	[email protected]
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	[email protected]
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "118"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exetaskmgr.exemsedge.exe

pid	process
2948	msedge.exe
2948	msedge.exe
3248	msedge.exe
3248	msedge.exe
4392	identity_helper.exe
4392	identity_helper.exe
6060	msedge.exe
6060	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
5260	msedge.exe
5260	msedge.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

taskmgr.exe[email protected]sys3.exe

description	pid	process
Token: SeDebugPrivilege	4912	taskmgr.exe
Token: SeSystemProfilePrivilege	4912	taskmgr.exe
Token: SeCreateGlobalPrivilege	4912	taskmgr.exe
Token: SeDebugPrivilege	4400	[email protected]
Token: 33	4912	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4912	taskmgr.exe
Token: SeShutdownPrivilege	5736	sys3.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe
4912	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

876 LogonUI.exe

pid	process
876	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3248 wrote to memory of 3224	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 3224	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1268	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2948	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2948	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2080	3248	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://malwarewatch.org
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85efe46f8,0x7ff85efe4708,0x7ff85efe4718
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4276 /prefetch:8
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2244 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6204 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,13707963284536786816,1240677369002786674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1372

C:\Users\Admin\Desktop\[email protected]
"C:\Users\Admin\Desktop\[email protected]"
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4912

C:\Users\Admin\Desktop\[email protected]
"C:\Users\Admin\Desktop\[email protected]"
1⤵
- Writes to the Master Boot Record (MBR)
PID:1628
- C:\Users\Admin\AppData\Local\Temp\sys3.exe
  C:\Users\Admin\AppData\Local\Temp\\sys3.exe
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of AdjustPrivilegeToken
  PID:5736

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa389d855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
16B

MD5
4c03fb962cb0eeaf3480d85c18b22f6a

SHA1
262dddc140def622ef9a71f7db930f327356dcd4

SHA256
7e0aca6c834267272f1358fd4f2a2a9c263c92bb6903a2a15b1a4001b92b8b43

SHA512
fda270b50e35de276d5710c9db3c5006120df9cc4f2c499ca93367625667c3f467040b75275b7855f2d0bc8c1c174d4b40679fcd44ad50b6c6bfb4a1b119da6e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
720B

MD5
eaac084d219eaa61468726a3c2ccc029

SHA1
73aa9063406506f6469be3e83bbe2a3e93795e09

SHA256
232840f6e6b2191f469fbb4cf2f1141ed665f020010b78d2ecf4cf028777f37a

SHA512
f1b698d387546e65d4e838735e6c53e800ff8aa489b42cfdb9c2c16742962137dab9f87ca4cb0b3183732d2f1408442370a6a449b3ca0e4675613d8cebaa3013

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
688B

MD5
8f60009b1ba29bb4f9d239a5f214de00

SHA1
aed78f0b809e32338dafa5f48342a9b812ec36a8

SHA256
f28eacd0b0822679b5767a2e0985c4e03efefd3a96346f9fd323e92554e27a32

SHA512
f25638b60912bd8a22e1a970235734cab03bfa066aa8740ea42f4eaa9dff44a09600566b48bdbec988260bf126a8c9cfa8bed2fc3127484d503c830fb4280edd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
1KB

MD5
54a9d41d258fbabc3dc6e7a2e0efe819

SHA1
e2fe602cce23b2aec5908964f7a1a9108406515d

SHA256
998d01936c70eebb20a5a302a8b155ab24abe5386e8e0d816355902ef95d2bf9

SHA512
c840acde9619ff299a8c8b8eb844bfdce568f57e59f3a7c2cf0df067015893453493deedf8726473924f6831fb8917f51baf9706b06ed298610eb2f9b02873e0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
448B

MD5
46108145f0fa1a3ac8395859a469cf9a

SHA1
4b48d22d7ff52a3f21cd0fbd33ba4ad1b1ce0c62

SHA256
96917e1c52e0825de6871f0152baaa6eb9e767bd12f1b7550dfb0fd1f241260f

SHA512
33816e6a29e2b4c0607fcf044bbe9b8ddd77b62f8a084073620293f6a7032dfb90e6e7e6cda12ebcb5e98fd182a823e52d4e6c0008413e40b659d92629536734

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
624B

MD5
9a0a97690a77bdb0504cd39a7d6afffe

SHA1
08e2bd0445ca39bd56aa0f9c96ce0e2c4813756a

SHA256
5455bfe3e17c674de5aed0ca4c21c8144a78c9e88038a5a9493fceeac38c6c19

SHA512
c684b338894367387d6662508149082218756e7ab3a7e5bf8f7c8e5ec6c69c00669b3c290fc7d235605f93d412b83d3a8a4b8103b5455c55acc32c970e9479f1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
400B

MD5
1b1934702689ca7855356b124c1c4a54

SHA1
9b20b917fcc42cfe9199e82c5a0d846b058596f7

SHA256
b29331263c7895a83375198fcc61a8bcbe1e9204105fe36091172eb86a2c4288

SHA512
3ab49c75dcc45dadb4c4c4dc24ed8fd3c2c651508355c7f1c008bbeff2f8949545bb9448d20e384f2910e426adf94eb15d073ffb06fe1c9e44ec4fcd45d50f85

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
560B

MD5
fc4cc7b45b727626e7fe10afdd757ff2

SHA1
203fcf5cf981593a277db2e6dd1d9cd37ebb659a

SHA256
24b3995e0b7090c76db352e1ee881c715c7b79647e01a0973b76b0a3cce71108

SHA512
0fa61f24d6cf10d2c125fa205b2837c1706a4bbdab3593cfa30f3f91f0b1100bcc7d801c60ab47ed074fe757fc94de4e18ec5cc2d01d37d59c405e9da01b4304

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
400B

MD5
a1f3c0f0017947d55f1ece256db5658a

SHA1
fc78bcd86a919dc235ac85fe42761c2956f160b9

SHA256
1d3da78381b2e93fd9844ec2ad570f6fd59f4756eef00e649c6d23d2ec6d035f

SHA512
e2fa31a6180471a37405014d22ed83b5dcc18b3a97b343b675eb2ee8b7b7b04baadab56db47fddc8e2e149669072b0ca72d3bdbeec9b4af9d2d2006077ca2d51

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
560B

MD5
4a360a9ee2ac88d007d6d08343e204b8

SHA1
03a40e89e024170f0f33a7c2314bab47211cb90b

SHA256
6a383849a64bc1279b00ff669f2bf83541c0b7e4490152b940633066333d0b06

SHA512
42dc11a1d75dff6a907ab1fe207991c55b60fa941b3db04ed5ca9e07c7ff0e56a371f4369a80a59bd2f431d527a0a94bc2ed89ffc29df9e5982706f3f7d25246

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
400B

MD5
dda2464977b9c6474f80ad2f3da01a95

SHA1
c10964c074341258ede9d73e7f3a7568bf0c29f9

SHA256
612f7beeebe160e89d35bd7fd6604380d4f606d94c55f3dd3bfb3ce4860b78de

SHA512
e7442a3b65d807279bf7597fa21ac469ffc39ad2ce97413c63a7eb5d22411d317fe8e6e572f441578cd4ec2db8420e26facec274dd1cc5fa476ce024f9584cd7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
560B

MD5
99d3ebd946b65388c9bccd8a7c1ccfeb

SHA1
51ba69f94db9e9e5587e4a4a9ed9828bc7c291fd

SHA256
ed69d90a191d25c33d51683038add2605b12f8c7c4baea1fa768380723ce2d9c

SHA512
1c1aa9b0215e58516cbf71e79a21b30f1e92bf6afebbcae669bded1c3b74e6e0c6d6ea902a265ef6573c281ac7f1595815c25eb6099212691a6fc28dfbe79255

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
7KB

MD5
504344aad8444d67ef072a03d0370613

SHA1
8d21a2df4c4c8ad2e5b0a7aad4222a781ad1b78b

SHA256
031292890fe51ff7eaa4cd06db2ed26c99285f961af99eb092b3bca6ef090924

SHA512
6cb5258d94a64aa612cd3f7da80b0ed9ece38187232de7c0382564cce1f7bf0f8be5e1b345cc82ed3dbfcd74e05b1941f0d617fcec9de0e3893b8d677dcd0087

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
7KB

MD5
979f6255d6b0f4631f61aa8bc927f8fc

SHA1
e10db0248eda7713a150d346a8316b1a4e9bc1e2

SHA256
c828c64dbe4dbbe695ac988ea0e70562891918f7a5327cbd49de72f131e75571

SHA512
a568c9cd9124104c816bd6931eaacad1c55a4e3cde6440fef9e5e447b0b2261302dd0d02c7bdd14fb9373a32937f132ce60b6ad1b6790909675c43b3c0b04c7d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
15KB

MD5
9b546e4621e97e24b28dacad8e572338

SHA1
01169eeefd41a24b41a8e4c6d744d8f478f72f56

SHA256
fa678096d3c918fe99899c797e801fd2c31cb8f2ef9a900b78c929a9198a5219

SHA512
5fad0be7d8d077fe45825e2dc3df4bb90bd0ce66a46b205bd568a6eaccd21ddf8d8dbbab7d2fb3bcf61303c0a0058a1507e6e388d47011155fccbcf6d483be74

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
8KB

MD5
d14e970657333654b70efd08aa228b47

SHA1
0c24101c6c88237598f9ddc1813aafb52fb87e03

SHA256
dcbd55c4523c5ef57b4197ef41d713fae0fa9bb834cb3fa3feaad53b03811caf

SHA512
23259ea7e9b6118e2d5dbffcc1be0787265c6c131c86c833a2a31c78ad07d2db3df6b104e7e7c2b2956a005e5075689c16cf3502be16efb015da04635f15d303

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
17KB

MD5
a25a8b65173c700c53429f245124b8dd

SHA1
2583994bfdd3efe152ba2eadc3ccd1cffeda7590

SHA256
307657834dca43041c3c07ac8a978117e586254451f3050e8890f311af33f5c1

SHA512
df0bb118b9d3bc6434622ec2347297cc35f30e603ad22d6795a700c8c0b531a62f4b15a44a94d1799b026453827f02b60bdaa7a80d71b329a55a7d67de257014

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
192B

MD5
03c222f4d89962bb66d70fcef10a10b7

SHA1
9cb44b99d4e12d67fa6fa32bbbbf6c1a8141fad0

SHA256
2ce96e72371271099e94b80e5def40077d216336778da80485dea3a5355b38f2

SHA512
20968216458d6240c34ffd4f68a5b1156847385ed5ca1756d65618c6807a1452e7fd23ef73fcad99357ce1e8552ef1ef97b9a12b4036dc2377c1ffe6cdb9c3e2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
704B

MD5
07e4aa8f911f367588a181bfd5e90803

SHA1
9c64d9ec405f2f358c5523887d793b25734a8e27

SHA256
a1915cd07b0e14db13e971d082eea15cef3f44ad6948ad3cb30ae26f60a3ed9d

SHA512
7145054f03f7d6adbea65b0cfdcf3b57afd9a2a449db2afca18374cc8c79d970cd1fd297e5fc42f2a5ce0a7209d0c391d496a00aa21a4b7ad8756c95783a44be

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
8KB

MD5
a6222e4adc8016a5d856ed6585440c95

SHA1
036ea039345d66ba7a27006cb8f69c954b4cd63b

SHA256
01b8fd1b965a80f8b9264678594fc55387b6b15be0942d940c38ffaff86ab521

SHA512
6a39b395ec9d1769c178fe6b21e5f5575570baaeb3bbf9da592104d57c21121cf77bf270fd6ecbb6ea75046f3b22ac9f42d00566bdabf02bb541ff6930983e3b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
19KB

MD5
0f598fa8b3a6f69b98d99ce9d02e30bb

SHA1
1b04b34a84b2548604f584cf9288fd3c9cb6d463

SHA256
632e3a9eb98c232ddc0edd9b9d1af0ef8b6139cc8a85b26bde354fa514da225a

SHA512
4cb88e23b22eb8e0e883933e5c0ed006ca09839c5c583f800284d425f321bdf371ec37137bf1e7205a7212d2c3fcc5a555d7e9d715d72b06aed2cca21cd470a5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
832B

MD5
a883fca721a30d785de7bb61f16c2150

SHA1
14c4502df80e6ebb4092b41f19ec826d89743ccf

SHA256
df3356b669dc443e2fc904a66cc6a758a605ef589baa3205822ba9c65ad18a42

SHA512
6666cbc02abb5f7dbde0a5fdcfc581f89d3000cbf95de90b28e53998909dfed535ccb916ccd1e84421c3ea5a75d862139a9ae47519872732fe531570ff787272

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
1KB

MD5
198bd9cbee44683d7158ea98faf162ca

SHA1
5572c13ee49f3af9770b6f4b5663d8303071a734

SHA256
19d72aaf8ce825e0fc37a8af98104af40bb85a9ae572af740f44dcdc31156e53

SHA512
aac8dfbf9c59d1976b42ffac692fbf3920dff50c6a1503caeb77f86bc6c55b40f4e0cabfba5fd63c532e19f6a5058a3b5fd98843a81db174da052a5ff1f4c23b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
1KB

MD5
631fee1cbb8e5cac4873f672a15ac0b8

SHA1
46443a379bd74ba5ebecb9ca5f435481cfdf3cfd

SHA256
b709055b5f147029711086e2596888083619fa4affaf1e5f6e10377cf67b3b56

SHA512
69f68eb9a15ee693b36f82957842144505a1df2d2d9f5a22f02c5dc87b450eb87d9a7e0257b94adf6e8f639cf0eea6eacbfd65214758cbb9513da81e46fe7611

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main.css.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
816B

MD5
db9ca7939293df1e074e21a3cb0ec1c2

SHA1
cb0eb0b30eea937e3c7f94f79a57be0704f11e42

SHA256
6f2333386a3b1f1e57cb3e54e3ac0e86a9f00e8def64a37040ed5b7d5e7a7972

SHA512
ebebc6ae18378e74e075ecc38de55f73ff6012b67bf4dc72992a30e73de382a76f9882f41f63634a26a6d04fb74a305efc982fe8934b142b7fcacff1868d9a5f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
2KB

MD5
c8d0782ff1d923f2775fbf50d0886031

SHA1
f123a2ae31bd5289ae5d859cc272bc18629afb75

SHA256
52558d3d97d642d09f4c5d03bba031ff93f2f3b4c4a5f3e923321402c1a11501

SHA512
7544994d9288238f61e688d9de1a9a3b758142d926267997e3c36147650808ece2fadc8c352943f0a4a97371240d6256d235bc94a895f31373fc1e0b6733150a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
2KB

MD5
cae9cffb24570416c12151115e477f87

SHA1
2b3395cfa3faae2b8c2ef8112b84305b772c863c

SHA256
fb6e0309b0fbf452760745d9b5c67a137d94cc4c20a75ca803fa10931f56c22a

SHA512
12f4e56e9ab061249de1c2890c8843c15b390511fc62e5e98f6358954b3c81c4783e4ea73270a46daf6510312b939aab5dd7ed76653ce5deb5977dbc06882b33

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
4KB

MD5
52b78f84020d8b99ee6abb561824a18d

SHA1
0532cf3192c0ee5aa081251a1919d7cc1bec45d6

SHA256
ca16335bab448f2dd39fee4d263ec523901fc6372666a36ace826b95da82795d

SHA512
3391a1ae3dbc51648dd57bf08faffa6807e85a1e945705c874e19342667bae2a0ba01d093ccd6dba4e651ae8d49192b1bc82fb1eedba29dae6d1f3c75a681953

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
304B

MD5
323ba2984277e6dc435be4c44ff66957

SHA1
d286b1b08b1d15a5d4bbbb49db4803670b02240f

SHA256
48bde9e14ab86fb8a4049051af8b19a43a601061a573d814ab2a5b92340c4d33

SHA512
91e38496ed52d4a875033f17ad5aa1ea630d7bbdda5681171b65adcf9a28658c7ea324d1085844899170d660e14255e0f4a64027e7adc85bb2e4bfb7db5651ba

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
400B

MD5
b4bfa8be8a0c0e1992863659b50a9bad

SHA1
59f1feed5576a5234803285943963bfa8b890643

SHA256
2f189bfdb4c61c1d07b5271f2edcd18c9165b4210298fb59f6ec994f30cf8e20

SHA512
9e5ca34d10dbd284ceacb71e69ed8adbdcceb095b4ac8157e52660d929fb6c7aabc1a216c089d4f1052c761c59d9d65ac70bc69a6c424464d02bd5d2d9b302a6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
1008B

MD5
917d4de04bc54f3d4134096d772d6a8d

SHA1
bbe115d1ec01061363b8dc4f51c5f1dee0bbdce3

SHA256
c0abd300d9c91876092a54111a9f0a472ef3f5cc543a900bb227604e2345dc23

SHA512
1844a4612a3b7792375610a818e28250486ce1997cdfcef29eb90a913deb57196216453e9593dff563492e50f85311ec448dd8b90c504327d4f3579da518470c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
1KB

MD5
e6808bb8113180ffb01ef14c37b2e4db

SHA1
f52b3a64e9334110461b47281d325cb34f934a39

SHA256
eb7ff42741f4622abf027922a906a640a9602ea5d045d481e08673185f51d6d2

SHA512
6e8c4487d525c4d92bd67fe60872e660543eaefe7e53aa1881bc47f9f4f2797811465412b88755ea8016bcab2e8ca9741025f16b6f13e175c98f3abb6936bcd3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
2KB

MD5
564fb903a25564d0595cb59373d2ef97

SHA1
f84485ad5e5b1cf97d570d89b9ce72c75d26c7d9

SHA256
ba1fd0d244482af2720463436bfa9ab8c6b50e8373c731ca3a56eebed19823a5

SHA512
92bf1783c6bab6494901c93f45bd298bc19208f0d25956d01213532fe2d21439ea8e9b72b76573d3fc165906411c590687c8fae141abae72a19840d5eb8e35c7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
848B

MD5
12d48daeafaa98eb7182375ffdbe4fb5

SHA1
554bff77240406d34f00b633618b39fc6b504bcc

SHA256
52ea360f09d94b0b234e437a2870b896d7a729dd2b01d5b51073be5bfd9f94a7

SHA512
ecc66befd908c4a856042a86c5267ecf261ae315941a296cdaa865b87e9ddd68c1d59198a067bc5c61b8377a0ac9816ef9485ef1e04bdee222469397e8fb7268

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.A58C304B31C4497046DD2F14479FE4F6154AC2A27144F5FACB305130687CD619

Filesize
32KB

MD5
c25d716fd1173651f9e088dd906e4b96

SHA1
1a0d8384bcfda4bdbc30f798ef101c6ee0722cde

SHA256
5813aa7f607f071005a8fab15607af4bab49b13fbaacf439a8d23ea8811f9b79

SHA512
bb5a4d9cff7acbb8ae893144f0c3625eae56e7c1cae8c7ddc0f21a42d4a403312847592d7682f1961f3221c2c4dd652785ee2fa5a0ef3ec3c6eecf9857f4cffd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c337e6b0c0e39d7ddf22245b25173e3a

SHA1
0b70ea6eed82755d6810a657ea65efb78f6a631e

SHA256
30f5e6ffcd498162995c389ac80bba46f9307a04f9ba468437b72236ec82afc0

SHA512
e8bdda621345e0425d1551216d7984b239a15efe043991ddf7c29897940d1cee154f2da5efde47bca7f5c4085339f44e5db0c8e88cb227c48e3fd84790c0adb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
055edb4fbdbb435ab584765b2b64932a

SHA1
77af31da47be2c1972ce1b75f0742259e8a4dfa6

SHA256
3fe69367b1b852661de330188670958242bfdf6a8283113112e0c3af46f3d0b0

SHA512
2bf07d3f6bc2eded3ae44383ea38ae5423786c7148063c158bbfb6775bc470407af5b088f7c07645255fc935b663ecb9f43dd3d43b5452cc05b7d699f1d52aa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4aea6dada0e1eac082bddd8fd8b244ee

SHA1
66356af103541621591975e82fa763b2702d87b6

SHA256
c755428a16ce55f0b353c90696d3ff80f094a0d948543f4560c3de73ee7f9eee

SHA512
5f3ada592cc02bf4d3e9346d3a17c77241bcf1aa81921d9e0ae007d76dfa466e9fdb335970485b6422adf66940ec11e34b5bd62ece842c67f669499e02079977

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
46a133104a806e0a9b469aaf00506ad3

SHA1
0e012bc87fc25f4f8e13ea9d7d4f25f4df7fd62f

SHA256
e97270300371a069f6de36267788ef69e577a4f88a1140c150a3f9185d77dd93

SHA512
e8a7d4256523edf394ab1b74a0524c667cc5f985b1cf4dbb4fdcedbd267fbf8cd285a482dc8c99fdbdb8e4a1ff0b2c379f89612249d6b24413eb4e349104559f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3d6c5f4ecfebba67165337d5281569f2

SHA1
6d6f4e0848cf833344c892a315d5a779fd0571dc

SHA256
ced766a7d5327bc23a70277dd6cdc630dfacd7256a8176d6f914eeb466b1dd68

SHA512
e023d585a8f3a2976f6775dfa785fc121d6ceef3306405c9b41d82b393e6f11b14adad1e9a4348cfa1374d11e67f402eb8d1cc6e953deb4f7277d09f4161c245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a9e292a26c236752da1e404de52a5a06

SHA1
b1a6f14903602e04b1ace173f1d95e7dcba0c5fc

SHA256
657a5336405f9d0d2e207e2ec0f00ca8c966549bb3b01983ce133a053abcf4cc

SHA512
d9c636c047bb9bdb3a16fc58e21173b6affe976e8e56e66396b85e3cf0612640c0cb9bbd2800fd3cd15a6cbdf332f7d70c57510f3021d9d2a692ccb03b966c36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a7a103c6153c60c7051a631bdc22855c

SHA1
d6b91551098b8e2f8369a46a8e99e2aacbd9431c

SHA256
ec40c5c79e811e8553e7363e178dd865c7c646e0898a5cb051fab4af58801665

SHA512
d4beab110fa6bad15f5633e71b744dc0552d681560fed67e67c00a8bde51c166e0223e83caecd12e71ee3aec79ae46effd6898329f138eca9565a8d2f99019d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1ff447b974eae1f7e9a0ef0e9f3bbfe7

SHA1
e5a4bbbc91b1aa32ff158cd7a9b0fe9d13c259a9

SHA256
3343a9750e22e5993af49d8f7ec92abbe803b6f9aa751706175f8b04f8386813

SHA512
54e8812383b8a70caf17d196f4a9dbaacb630ef35d6da3c393d5ecf5482e908609cb4e98afbb093b2ba46fcf302bbec11b39b78826981095b663485ccc45440a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
379ed27ac93586fd2f60b137c0c1c293

SHA1
becfd3e421adf62fbaddcf03c9af78f82de4c21a

SHA256
271bbece0d9e78546d2479e6cbab943343aab31a9a3ff7e1ccccc888e0f1280f

SHA512
27131e43d040eeff8127c3cc66569bc5184bde5302d39dec15973e65c18991a3e801113b091fcc6e5506e3323354b4d2e26e9e5cfa7d225b37c1d2569aca9ed6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4def136d4e8dafa70eb529149e139fd2

SHA1
f6274dab05cb1d0d4539b9e96c259ccfcc9e64e9

SHA256
d1295a1069695b81d162268763b5a60f0f70d013bc561d22867a65cd17710cd0

SHA512
038a3d6de7736cf5ea59be8b722fd3c5a085ad61e6de91a0dc79f1a362256cceda7b5f3b53923df400208a720952230a15ae39bdc76009c94fa55e22481f25c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
31197d3228c399a441cb26b66f155ba4

SHA1
c5a6d452865180730309e1276753aaed7e2eb30b

SHA256
93effe5f4ae18258e305070130d0e6c854bf1a7a936213c99b7f5507bfc2afd7

SHA512
a9e424fde1685b2906d6370813ad25cb9e0956bac7ca7f43b620d8b311ba11437f537a96b49b4f3eb863c1bbf6a1f7d7a903deb3f531550bfbb30244233dc1d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
482b1c69c345575d41bafd034ee8831a

SHA1
c220c91b8d1ede98fa438d991c65e0d31b8570c9

SHA256
d1dfc4fda395a5c119a6a9ae55c7ef129389d57c18b9179f8db38c8d5652f053

SHA512
29500ece098c3e8c370764f1e00a462dfdad1c81c3f80e5cb41949bc141485d7c95884206c25c5d9e005e269a9de823c1a1cda53b2ecd2d331b2adbb4e6e0751

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f81bd8e04a5811bb39b07e9e84d3537f

SHA1
b8021acc84579f071ec91cc7209084b5568d29be

SHA256
f7aeb5c9d89ad5500b06e730f42147f4eb6db8c7bcc673bda9769f5e9aa2f807

SHA512
114f8b82480bf5ab6f07c16963c3a5f9b21026131dbcfaf17307908cd8ad5fa0e9c48185c01398231213452cd0c3cde5fc35c5adbd7ed30bda7a431279deb7a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1da1569c3467ff37f58584a41fd8d9dc

SHA1
afa08008bb62ae06c096cb26267ad52a9c680d30

SHA256
74592b4d4bb7b65f0cde3297da6dd74c4d7e8db35ca756bb9af3c51893d72240

SHA512
2b49d172ecf4de8f29d6490657b70bd9aecc472db4e570d4efea112b76462ee1e50bdc5c5fb1d89130bfdac658da4568dc8e6c6136bed2d1c3bfb39e6ef7df97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
138592135da1db54ba5467b7ef2360b3

SHA1
6c40f1ecfdd06f2173d683a4885afd7bc04b4692

SHA256
39395df16c325a38e7461289b18abde5ab17b14928d1b1240e926036da914188

SHA512
3399470cbf8a8f7d5a6e69701e12b1857472d11f4119183601f9c0da023636e58ccf812ca7db3e3fd07662e676ca20c2b764353465f6048f8afd7ece3f348d57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2a3971681238528676b456cdcf957b29

SHA1
3d91c60736cf2161e80646faf1f0b719fcfc9b10

SHA256
93f6f9d264f22ebb319fceb72e8c560ae142b1a39b01b72afd9902226d99e6b1

SHA512
97d018d9bc9970a172875064d5bb1fd046e6959703bd313a91a2b5125293ea21c24c1391433320c8a2151e00ab9cd296e2dcf91df49334be9b2e86ec3eb572ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57972f.TMP

Filesize
539B

MD5
fef4baa53f1fcf5c374c5754cef5b1c6

SHA1
ac7fab9e79a25cf9314719f1c127277e623c641c

SHA256
334b89f068e9f816c93c352a104228f169777e341b9c9e892ddfe423e1dc8209

SHA512
2d2bf27610513b36b0b2e68c4514177b413967f9f1755322800723f2d9fecc3cb962d1de1ce3ef01a00d79516012088bc504499d17a9042ebce76c00e7c8bc83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0bd79925ee873753a79875bae9055bcd

SHA1
e02327b5116e8d891a438bfe2c4866df9bf5d92a

SHA256
359b5f6843669ba71da1bf8a36477c84ed20fdd21221835d93c6208e1b9bf93a

SHA512
61988013e821e7268745774f32bbdba5275e3c6c96785d953a0ba4846de92e729c30df9ba026a963d416959e6b2f14a92d9940a158152f6348ab79cf9de6e8c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
586647c255c7d438bec7dd8acc670bbf

SHA1
1b77026b69f8cc1f0e58be1ee8b574ae2390185d

SHA256
e85f7909eb8131814c65b2b7cfd5646357193c3d4b44fa64543fd7d1616223a0

SHA512
b1ffc5ffe9c79b733619ce9ad4c1ed7f173d7ab273604fc51b1a1bedae2598b01831930f38b950bbf04e735e3d090d42d688b82b7050eb2646671a7be0ebf868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
23c0eb762c1cf3598da6d7d0d91678bf

SHA1
25509551147bfbcdff270c5a495de592f502aac7

SHA256
8dd561cd2557d575f5da6aad3a2a9356d657660bc5ff3519718690b2b19e1869

SHA512
906a264c4133986e72a3f7b59fd5a35269045cf3714240e74b03fd9caa41cf3e6c164af59e9cd392ba5122c268c48f566d06af401413b807a85e7731cacc710f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7a0c2c9ca4247761c60f01c6f8555d4d

SHA1
d316eca6bae31c01f0f8d3036425b3af9381b26b

SHA256
7120c72bb20b724e411c992948e91fdf0da549c80a57d43afee0b77a0071e07d

SHA512
03624d91ec1ba5aff692ae5d3c730cd61ab1b6c30cadd5c08b857f81a9ee62dec3ee52adec911572ff73c1d0c88da565c4cd4198fbb45d0a69fa54a02473b305

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bd6f4ff0-4579-4cf4-9e44-a881dbdf5bc7.tmp

Filesize
11KB

MD5
bc96b055730c44514b0cd830e775916d

SHA1
014df299472c1f41eda5fa785524ff758038f908

SHA256
895fc1d9b890910d374b355521886b78dd530643a886e8d7796e14d320d7c84d

SHA512
cca8e213c53ec18488f0ff582226366f22a283a6751eebe1e9eabbcb673b4dc30738ab5f9b6c78453eb1946ac43022db731373d86c1f698e2870d7cdafc89a42

Download Submit
C:\Users\Admin\AppData\Local\Temp\sys3.exe

Filesize
136KB

MD5
70108103a53123201ceb2e921fcfe83c

SHA1
c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3

SHA256
9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d

SHA512
996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

Download Submit
C:\Users\Admin\AppData\Local\Temp\systm.txt

Filesize
48B

MD5
07e3589ce173a5f12986f44253b0bc8a

SHA1
7263c370da58a626831aa45fabefd8f8911a7450

SHA256
69365cd85daf13bf52d9a8b1f0dd4d7658d0b4a364c8cd799e15f8a1bb05b896

SHA512
3cf692a2b3004f0ef5488f5674b6c8adb9dcaab52be1ee9cae709e6a8688af443d735a060796f086d0bc1c4e6ea18f7b8ebe2517e418911dd1946b0aef7ef857

Download Submit
C:\Users\Admin\Downloads\InfinityCrypt.zip

Filesize
33KB

MD5
5569bfe4f06724dd750c2a4690b79ba0

SHA1
05414c7d5dacf43370ab451d28d4ac27bdcabf22

SHA256
cfa4daab47e6eb546323d4c976261aefba3947b4cce1a655dde9d9d6d725b527

SHA512
775bd600625dc5d293cfebb208d7dc9b506b08dd0da22124a7a69fb435756c2a309cbd3d813fc78543fd9bae7e9b286a5bd83a956859c05f5656daa96fcc2165

Download Submit
C:\Users\Admin\Downloads\PowerPoint.zip

Filesize
66KB

MD5
196611c89b3b180d8a638d11d50926ed

SHA1
aa98b312dc0e9d7e59bef85b704ad87dc6c582d5

SHA256
4c10d3ddeba414775ebb5af4da5b7bb17ae52a92831fe09244f63c36b2c77f34

SHA512
19d60abf83b4a4fe5701e38e0c84f9492232ceb95b267ae5859c049cea12fee2328a5d26ffd850e38307fb10cb3955b7e5e49d916856c929442d45b87071d724

Download Submit
\??\pipe\LOCAL\crashpad_3248_VPIJBENAHEIPUDES

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1628-3717-0x000000002AA00000-0x000000002AA24000-memory.dmp

Filesize
144KB

Download
memory/1628-3712-0x000000002AA00000-0x000000002AA24000-memory.dmp

Filesize
144KB

Download
memory/4400-440-0x0000000005860000-0x0000000005E04000-memory.dmp

Filesize
5.6MB

Download
memory/4400-443-0x0000000005520000-0x0000000005576000-memory.dmp

Filesize
344KB

Download
memory/4400-442-0x0000000005240000-0x000000000524A000-memory.dmp

Filesize
40KB

Download
memory/4400-441-0x00000000052B0000-0x0000000005342000-memory.dmp

Filesize
584KB

Download
memory/4400-439-0x0000000005160000-0x00000000051FC000-memory.dmp

Filesize
624KB

Download
memory/4400-438-0x0000000000780000-0x00000000007BC000-memory.dmp

Filesize
240KB

Download
memory/4400-3533-0x0000000006580000-0x00000000065E6000-memory.dmp

Filesize
408KB

Download
memory/4912-3089-0x00000268FCA70000-0x00000268FCA71000-memory.dmp

Filesize
4KB

Download
memory/4912-3094-0x00000268FCA70000-0x00000268FCA71000-memory.dmp

Filesize
4KB

Download
memory/4912-3093-0x00000268FCA70000-0x00000268FCA71000-memory.dmp

Filesize
4KB

Download
memory/4912-3090-0x00000268FCA70000-0x00000268FCA71000-memory.dmp

Filesize
4KB

Download
memory/4912-3083-0x00000268FCA70000-0x00000268FCA71000-memory.dmp

Filesize
4KB

Download
memory/4912-3095-0x00000268FCA70000-0x00000268FCA71000-memory.dmp

Filesize
4KB

Download
memory/4912-3084-0x00000268FCA70000-0x00000268FCA71000-memory.dmp

Filesize
4KB

Download
memory/4912-3091-0x00000268FCA70000-0x00000268FCA71000-memory.dmp

Filesize
4KB

Download
memory/4912-3085-0x00000268FCA70000-0x00000268FCA71000-memory.dmp

Filesize
4KB

Download
memory/4912-3092-0x00000268FCA70000-0x00000268FCA71000-memory.dmp

Filesize
4KB

Download
memory/5736-3719-0x000000002AA00000-0x000000002AA24000-memory.dmp

Filesize
144KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads