umbral | 9ff459396b1f4de8dbca8a866ff3b9e4a46c48a9dc1071812a256fe21349caf9

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Big clean script (1).exe
Size

230KB
MD5

b23d20593d9176d95302568243f60052
SHA1

fef1aa01b7a41a8255d71309c7c5badf48a7a907
SHA256

9ff459396b1f4de8dbca8a866ff3b9e4a46c48a9dc1071812a256fe21349caf9
SHA512

13a9f86ca7b7df87b4174875fb3d7a7552986a6484297c841037b054d3bf01eab724f3b080f9f1984cc58912e0a50953f5d1e2355dca1cc5366eca4870400d3e
SSDEEP

6144:lloZM+rIkd8g+EtXHkv/iD4M8RobhS6FDAxDeebSzb8e1muQTSi:noZtL+EP8M8RobhS6FDAxDeebIHQz

Score

10^/10

umbral discovery stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral2/memory/1236-1-0x000001E2D7040000-0x000001E2D7080000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ip-api.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4580	2172	WerFault.exe	125

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008110495d4aa4cb41b6757eb2472c6e5100000000020000000000106600000001000020000000829f94036149a4a9ec3b580c36c19fe4ec085bd9e67227b99efc9e68a6cbc76e000000000e8000000002000020000000c5747c5c128f92984c37f84172733f30c5cb3171f39ab328c0194948cb3e7ad120000000e395e9395abf4d47f8bf3bb63ee6eec3e001aeaf5d66629be7dcbc1ea3883f7f40000000b350c732a050893be287aac4f94f4d916ee4b839b7ec9013241318f023fc444450b7f52287754f39a7407196e3f874052d2a2de1ab0f48f54b823a3664dea81c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1041477033"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10298c41f12fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31141873"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31141873"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008110495d4aa4cb41b6757eb2472c6e5100000000020000000000106600000001000020000000c9dcd81c1b2776c2545b7f8d35119b1c48ecaa3edcd1fbc6450a17b3f7956762000000000e80000000020000200000002d65cdd2d321a0819895c98cde7dd6c0232f9c7695bf1e900b388e1d13f621da20000000f8a49ea042940e6448c698f78249a07c9156713533c7c0bca77f22bb6396f0534000000018bc43a2591f0a4d1314e459b0c81d30436431ff91a2ba1dc3d3ffaee33a65fed965a239ea4bc28b236cf35033b3716489d13ac09d27a7baf11336ae96872707	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b88941f12fdb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1041477033"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{69BAD2DA-9BE4-11EF-A7EA-520873AEBE93} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\easmx_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\easmx_auto_file\shell\Read\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\easmx_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\.easmx	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\easmx_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\.easmx\ = "easmx_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\easmx_auto_file\shell\Read	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1436	WINWORD.EXE
1436	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
3788	identity_helper.exe
3788	identity_helper.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4568	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	1236	Big clean script (1).exe
Token: SeIncreaseQuotaPrivilege	2912	wmic.exe
Token: SeSecurityPrivilege	2912	wmic.exe
Token: SeTakeOwnershipPrivilege	2912	wmic.exe
Token: SeLoadDriverPrivilege	2912	wmic.exe
Token: SeSystemProfilePrivilege	2912	wmic.exe
Token: SeSystemtimePrivilege	2912	wmic.exe
Token: SeProfSingleProcessPrivilege	2912	wmic.exe
Token: SeIncBasePriorityPrivilege	2912	wmic.exe
Token: SeCreatePagefilePrivilege	2912	wmic.exe
Token: SeBackupPrivilege	2912	wmic.exe
Token: SeRestorePrivilege	2912	wmic.exe
Token: SeShutdownPrivilege	2912	wmic.exe
Token: SeDebugPrivilege	2912	wmic.exe
Token: SeSystemEnvironmentPrivilege	2912	wmic.exe
Token: SeRemoteShutdownPrivilege	2912	wmic.exe
Token: SeUndockPrivilege	2912	wmic.exe
Token: SeManageVolumePrivilege	2912	wmic.exe
Token: 33	2912	wmic.exe
Token: 34	2912	wmic.exe
Token: 35	2912	wmic.exe
Token: 36	2912	wmic.exe
Token: SeIncreaseQuotaPrivilege	2912	wmic.exe
Token: SeSecurityPrivilege	2912	wmic.exe
Token: SeTakeOwnershipPrivilege	2912	wmic.exe
Token: SeLoadDriverPrivilege	2912	wmic.exe
Token: SeSystemProfilePrivilege	2912	wmic.exe
Token: SeSystemtimePrivilege	2912	wmic.exe
Token: SeProfSingleProcessPrivilege	2912	wmic.exe
Token: SeIncBasePriorityPrivilege	2912	wmic.exe
Token: SeCreatePagefilePrivilege	2912	wmic.exe
Token: SeBackupPrivilege	2912	wmic.exe
Token: SeRestorePrivilege	2912	wmic.exe
Token: SeShutdownPrivilege	2912	wmic.exe
Token: SeDebugPrivilege	2912	wmic.exe
Token: SeSystemEnvironmentPrivilege	2912	wmic.exe
Token: SeRemoteShutdownPrivilege	2912	wmic.exe
Token: SeUndockPrivilege	2912	wmic.exe
Token: SeManageVolumePrivilege	2912	wmic.exe
Token: 33	2912	wmic.exe
Token: 34	2912	wmic.exe
Token: 35	2912	wmic.exe
Token: 36	2912	wmic.exe
Token: SeShutdownPrivilege	740	unregmp2.exe
Token: SeCreatePagefilePrivilege	740	unregmp2.exe
Token: SeShutdownPrivilege	2172	wmplayer.exe
Token: SeCreatePagefilePrivilege	2172	wmplayer.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
2172	wmplayer.exe
4156	iexplore.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
1436	WINWORD.EXE
1436	WINWORD.EXE
1436	WINWORD.EXE
1436	WINWORD.EXE
1436	WINWORD.EXE
1436	WINWORD.EXE
1436	WINWORD.EXE
1436	WINWORD.EXE
4156	iexplore.exe
4156	iexplore.exe
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe
3512	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 2912	1236	Big clean script (1).exe	85
PID 1236 wrote to memory of 2912	1236	Big clean script (1).exe	85
PID 4664 wrote to memory of 536	4664	msedge.exe	109
PID 4664 wrote to memory of 536	4664	msedge.exe	109
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 1372	4664	msedge.exe	110
PID 4664 wrote to memory of 4904	4664	msedge.exe	111
PID 4664 wrote to memory of 4904	4664	msedge.exe	111
PID 4664 wrote to memory of 5008	4664	msedge.exe	112
PID 4664 wrote to memory of 5008	4664	msedge.exe	112
PID 4664 wrote to memory of 5008	4664	msedge.exe	112
PID 4664 wrote to memory of 5008	4664	msedge.exe	112
PID 4664 wrote to memory of 5008	4664	msedge.exe	112
PID 4664 wrote to memory of 5008	4664	msedge.exe	112
PID 4664 wrote to memory of 5008	4664	msedge.exe	112
PID 4664 wrote to memory of 5008	4664	msedge.exe	112
PID 4664 wrote to memory of 5008	4664	msedge.exe	112
PID 4664 wrote to memory of 5008	4664	msedge.exe	112
PID 4664 wrote to memory of 5008	4664	msedge.exe	112
PID 4664 wrote to memory of 5008	4664	msedge.exe	112
PID 4664 wrote to memory of 5008	4664	msedge.exe	112
PID 4664 wrote to memory of 5008	4664	msedge.exe	112
PID 4664 wrote to memory of 5008	4664	msedge.exe	112
PID 4664 wrote to memory of 5008	4664	msedge.exe	112
PID 4664 wrote to memory of 5008	4664	msedge.exe	112
PID 4664 wrote to memory of 5008	4664	msedge.exe	112

C:\Users\Admin\AppData\Local\Temp\Big clean script (1).exe
"C:\Users\Admin\AppData\Local\Temp\Big clean script (1).exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2912

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\StartPush.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\SwitchExport.svg
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcc81b46f8,0x7ffcc81b4708,0x7ffcc81b4718
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,6502999066857716405,10359107425990390954,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,6502999066857716405,10359107425990390954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,6502999066857716405,10359107425990390954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6502999066857716405,10359107425990390954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6502999066857716405,10359107425990390954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,6502999066857716405,10359107425990390954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,6502999066857716405,10359107425990390954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4864

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2172
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2312
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 2952
  2⤵
  - Program crash
  PID:4580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:4820

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4156 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2172 -ip 2172
1⤵
PID:4844

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4568
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\LimitBackup.easmx"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3512
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2420
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=122B9EF3A92EE579F85879EE75E53D80 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=122B9EF3A92EE579F85879EE75E53D80 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:4864
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FE188010D82596391D1432CD2B6EFD07 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3616
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FADCEF7AB6ABD141ECD357CEC2C75C1E --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:2232
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=33E1852A00BD461AB06F17F458143933 --mojo-platform-channel-handle=2024 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1828
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D664016CC3C4FA707D1BFA5A33425A86 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
b8d2f7ef7ebdcdec4f26ad754eebc717

SHA1
4dbbccc63366028104f1a47124162f909133b501

SHA256
9414797c1fce1236f1b332dd963f83b2416731db425fcfae4ec9caa7c6dfe53d

SHA512
5a2651d744197673ca953c64687a8ff9b5976b9f155c38caa6c93aa0aabe826892b3d73921eb2893d32430919f052c3412cb54438355d6a2a8b0811742960557

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
79a9ce59b2be2f198d949b13caa09189

SHA1
01bed5099354277ad44196b1456312d484aa6def

SHA256
c961ad8d71e9cdc74d9e5cba1f63301e19bf00238903cd4100204f945a610e34

SHA512
8d3fbb021fa569dd13299265249a2fac414f04f531c169ade1e4867bc67580bd4779192d497f11086b3aeb8aa85111cb3e344a1893468059328994eb141c9aa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bcb54bec05e688a29d1b85a92ef5fe0e

SHA1
206a4d47b4c15943197d9872666c2d50d2a0e09f

SHA256
26f3949147b1b9ca344f0cb30465a1ed68c73cfe7af6048609e1befbe2cbf91a

SHA512
f4bb1879546095b97cfb30defe53a3e6a661b7d30bd0741a301bd648c685f3704da38d1b9b8fcc0ffe0f2873ddd93d87e988e5a8b3875d0998ee370f574b87c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
289a60d6d52d1fba4a0d7c38cf015f6c

SHA1
4e230db6ea34c59df5a9406361f8ef533d4b7229

SHA256
1a0c09cd377b2f0971078580a1d4145dac1515d25f15bb7a08a2aff145cedaad

SHA512
7abe65f5431c6580742f93897065534ad706aa00eeac3570f886b69ea143b0d9c76a959ed14e81d752fa4332ec57d0ae9cd732fa6b1c73f37a1067c9a7066eaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
384KB

MD5
063793e4ba784832026ec8bc3528f7f1

SHA1
687d03823d7ab8954826f753a645426cff3c5db4

SHA256
cb153cb703aea1ba1afe2614cffb086fa781646a285c5ac37354ee933a29cedd

SHA512
225910c24052dfdf7fca574b12ecef4eb68e990167010f80d7136f03ac6e7faa33233685cbf37b38ee626bb22ff3afeee39e597080e429be3ec241fb30af40c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
c3c0aa7ebfa421d4916f68b4a10d0ad7

SHA1
ca34b4e56fe47e5da456ea55b95ecbb9d680bf1c

SHA256
c0ea3b00fb80b9c21a3da236d9e6d38667fe6d3366c46004c934495960bc9f8a

SHA512
b755d8e20a0e1a58a6043402d970d9b7cca429bcc1867d779876f36d5002dc15b3c3d9f69c64ccf74713220d4a0887d032404f38f4448a09854448abc17d0a81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
e380897753656f2ec29b97597411bdec

SHA1
7ce482c11550cf9368960302ce094163eedd5c6a

SHA256
13e8c0208f7be7ae0163c3d83b27a0bc73e9df2deda306edd0607cca6a530f56

SHA512
80887bcbdff4606e96f192553822b37a0cb105972f383e4dcc0ade32453d710d0813d0eab7de4e7bbd52207af5ae2e3d5b12211a075738a4e8a44471127e7cb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Filesize
2KB

MD5
ff021ff930617020d132e29b89b4ae48

SHA1
e74b1ffdc47cf0ab45dd2778fedfec84be54f009

SHA256
ba6b2b3c9b7f0cdf665d26648391bfdc5725d85d6119f6b22588370ddd9ac4f5

SHA512
bae7432dcc28cf71c7344065be01ddaf1895e33e14b01f285ac3bce0b83ff215982eb4128b67bc117ecbfcd001a053a6fe362c68a86fb161d6e51934365f8256

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Filesize
2KB

MD5
96e5db64aba5433627311d2c8c50b19c

SHA1
c89fe1241910f7f9b1d1b46faede6d3cc047f81c

SHA256
0181b79813b58f5817cf764ef5ad18cdd5876e18505d6755d3c6a345691c3eb4

SHA512
95a528f4260543bd6d6b5e9e6e52bc096abf70d21260cd945a1b4aeb2ea0977a5d350504be6cf7b70cf3dbce2ac83ff150ade1078e2401bf75f39cdc9c2eb8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
5433eab10c6b5c6d55b7cbd302426a39

SHA1
c5b1604b3350dab290d081eecd5389a895c58de5

SHA256
23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131

SHA512
207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
7a7d01355f9f8b84a43edaaa37dca25f

SHA1
683e5b9d542f622b086662eb77937271b767f84e

SHA256
beb1d82bf1265c153b2ba1d3564502c4ed4faa6a19a856a78795b5cf185fb84d

SHA512
c10405e8b8222e16b4fc7d19d2a5dc380064906c0c78bbc9ae0b658042ffc4e15c0df39a65744729fe75015ddda7dc50800efde9fbdc92295bf763b3ea47130c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
329B

MD5
b3e8002628fde959b7a79314cd163fc4

SHA1
d46d4b1724e8d1f3a1ccde93ddcb7d45f5021968

SHA256
03d2596a43442cfe8c6b5923835beec4fae4640746b6f90e93f7f65db415df70

SHA512
26e1ab7377a8223a6383e17b7e601099eb6d6f9d278ddfd8c496994e7433dde5950abf23c20970020ecc9a3aa6cdef7c16ef2c301b1ca7ccee0e134d64722e8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
3KB

MD5
591c39c98f7e6ca23ce1061827b4286a

SHA1
54de2ff5f1a42dbe70cfc13ee1de057431e37ccd

SHA256
5104061b984fbed63236ef4fe7bacf4ff1ffac3fef3961e3bb3873b861440b2a

SHA512
d08d620f23d3dec1756efa7b9e69ee9ed7a2c6735c182effb873748bb663a7470fab4129593f84ae2596722a6461f8ca9b266daf3be989ebb77e9a50e282a33b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms~RFe582d16.TMP

Filesize
1KB

MD5
878a3d64aaff90cc212f94fc5deb1bef

SHA1
28bc2e1b5a6ceeaa986c54d7eb10ea2febe8db1d

SHA256
b687530ac962a3275bf6dfe44a6fcdea7237184522ee47c4d4246a8f0dd1afc8

SHA512
f31ff21f6c3e1482627f316533f2740960223ae2906b06a1d64b3367f7c338289329180ebbda3280ae1f54cecf63d99aee8ca35514e304c77c2f7f6c510805bf

Download Submit
memory/1236-2-0x00007FFCC8280000-0x00007FFCC8D41000-memory.dmp

Filesize
10.8MB

Download
memory/1236-4-0x00007FFCC8280000-0x00007FFCC8D41000-memory.dmp

Filesize
10.8MB

Download
memory/1236-1-0x000001E2D7040000-0x000001E2D7080000-memory.dmp

Filesize
256KB

Download
memory/1236-0-0x00007FFCC8283000-0x00007FFCC8285000-memory.dmp

Filesize
8KB

Download
memory/1436-9-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/1436-11-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/1436-65-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/1436-12-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/1436-20-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/1436-22-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/1436-23-0x00007FFCA40B0000-0x00007FFCA40C0000-memory.dmp

Filesize
64KB

Download
memory/1436-24-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/1436-21-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/1436-19-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/1436-13-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/1436-14-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/1436-18-0x00007FFCA40B0000-0x00007FFCA40C0000-memory.dmp

Filesize
64KB

Download
memory/1436-17-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/1436-66-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/1436-67-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/1436-68-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/1436-69-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/1436-16-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/1436-15-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/1436-10-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/1436-7-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/1436-8-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/1436-6-0x00007FFCE634D000-0x00007FFCE634E000-memory.dmp

Filesize
4KB

Download
memory/1436-5-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/2172-228-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-229-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-230-0x0000000000D90000-0x0000000000DA0000-memory.dmp

Filesize
64KB

Download
memory/2172-223-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-233-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-234-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-235-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/2172-236-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/2172-237-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/2172-238-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/2172-239-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-240-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/2172-241-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-242-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-243-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-244-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-246-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-251-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-250-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-249-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-247-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-252-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-253-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-254-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/2172-256-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-257-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-258-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/2172-259-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/2172-260-0x0000000000D90000-0x0000000000DA0000-memory.dmp

Filesize
64KB

Download
memory/2172-261-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-262-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-263-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/2172-264-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/2172-266-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/2172-265-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/2172-268-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/2172-267-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-269-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-270-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-271-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-273-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-274-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-278-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-277-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-276-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-275-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-279-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-224-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-225-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-226-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-227-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download
memory/2172-221-0x0000000009D20000-0x0000000009D30000-memory.dmp

Filesize
64KB

Download