Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en -
submitted
13-09-2021 17:02
Static task
static1
Behavioral task
behavioral1
Sample
dhq.dll
Resource
win7v20210408
Behavioral task
behavioral2
Sample
dhq.dll
Resource
win10-en
General
-
Target
dhq.dll
-
Size
712KB
-
MD5
6e72b76795624c0cd578c24342453c7c
-
SHA1
7866fe84f3b53267bfe505bcec20467b05a6e074
-
SHA256
ebb22358cc0ce4bc40c76e1c02df8d304fd0b27e9793c7cbcc02f23b4e3c1c89
-
SHA512
279604b40b7d09d18de65ee7ec3c934879ad9d343d80114b1cec3a49d8740cab11b74bc57cea3ed4d2b93e0b98ab5fef8883592186e35234211acd7bc443ffd1
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE ⋅ 2 IoCs
Processes:
adobe1.exeadobe1.exepid process 2700 adobe1.exe 948 adobe1.exe -
Processes:
resource yara_rule behavioral2/memory/948-151-0x0000000013140000-0x000000001338D000-memory.dmp upx behavioral2/memory/948-154-0x0000000013140000-0x000000001338D000-memory.dmp upx behavioral2/memory/3644-156-0x0000000013140000-0x000000001338D000-memory.dmp upx -
Adds Run key to start application ⋅ 2 TTPs 4 IoCs
Processes:
LaunchWinApp.exeLaunchWinApp.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run LaunchWinApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\{B6A807N6-42DF-4W02-93E5-B156B3FA8AL1} = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\svchost.exe" LaunchWinApp.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run LaunchWinApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\{B6A807N6-42DF-4W02-93E5-B156B3FA8AL1} = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\svchost.exe" LaunchWinApp.exe -
Suspicious use of SetThreadContext ⋅ 1 IoCs
Processes:
adobe1.exedescription pid process target process PID 2700 set thread context of 948 2700 adobe1.exe adobe1.exe -
Enumerates physical storage devices ⋅ 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry ⋅ 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
TTPs:
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class ⋅ 1 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: EnumeratesProcesses ⋅ 16 IoCs
Processes:
AcroRd32.exepid process 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe -
Suspicious use of FindShellTrayWindow ⋅ 1 IoCs
Processes:
AcroRd32.exepid process 4000 AcroRd32.exe -
Suspicious use of SetWindowsHookEx ⋅ 6 IoCs
Processes:
AcroRd32.exepid process 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe -
Suspicious use of WriteProcessMemory ⋅ 64 IoCs
Processes:
rundll32.exerundll32.exeAcroRd32.exeRdrCEF.exedescription pid process target process PID 2248 wrote to memory of 996 2248 rundll32.exe rundll32.exe PID 2248 wrote to memory of 996 2248 rundll32.exe rundll32.exe PID 2248 wrote to memory of 996 2248 rundll32.exe rundll32.exe PID 996 wrote to memory of 2700 996 rundll32.exe adobe1.exe PID 996 wrote to memory of 2700 996 rundll32.exe adobe1.exe PID 996 wrote to memory of 2700 996 rundll32.exe adobe1.exe PID 996 wrote to memory of 4000 996 rundll32.exe AcroRd32.exe PID 996 wrote to memory of 4000 996 rundll32.exe AcroRd32.exe PID 996 wrote to memory of 4000 996 rundll32.exe AcroRd32.exe PID 4000 wrote to memory of 2780 4000 AcroRd32.exe RdrCEF.exe PID 4000 wrote to memory of 2780 4000 AcroRd32.exe RdrCEF.exe PID 4000 wrote to memory of 2780 4000 AcroRd32.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 3956 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 864 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 864 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 864 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 864 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 864 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 864 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 864 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 864 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 864 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 864 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 864 2780 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Windows\system32\rundll32.exePID:2248rundll32.exe C:\Users\Admin\AppData\Local\Temp\dhq.dll,#1Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exePID:996rundll32.exe C:\Users\Admin\AppData\Local\Temp\dhq.dll,#1Modifies registry classSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\adobe1.exePID:2700C:\Users\Admin\AppData\Local\Temp\\adobe1.exeExecutes dropped EXESuspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\adobe1.exePID:948C:\Users\Admin\AppData\Local\Temp\\adobe1.exeExecutes dropped EXE
-
C:\Windows\SysWOW64\LaunchWinApp.exePID:3644C:\Windows\system32\LaunchWinApp.exe
-
C:\Windows\SysWOW64\LaunchWinApp.exePID:3608C:\Windows\system32\LaunchWinApp.exeAdds Run key to start application
-
C:\Windows\SysWOW64\LaunchWinApp.exePID:1440C:\Windows\system32\LaunchWinApp.exeAdds Run key to start application
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exePID:4000"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\reader.pdf"Checks processor information in registryModifies Internet Explorer settingsSuspicious behavior: EnumeratesProcessesSuspicious use of FindShellTrayWindowSuspicious use of SetWindowsHookExSuspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exePID:2780"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exePID:3956"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4EF25FF816B0C5DF34EBA38BA7E523EF --mojo-platform-channel-handle=1656 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exePID:864"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6B5ACA40193F4923AB836A395585663F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6B5ACA40193F4923AB836A395585663F --renderer-client-id=2 --mojo-platform-channel-handle=1648 --allow-no-sandbox-job /prefetch:1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exePID:1072"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=30283D475577F1526AF73787DE12A34F --mojo-platform-channel-handle=2068 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exePID:1808"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6E9E63C22FCAE65D32110D31F0CF736B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6E9E63C22FCAE65D32110D31F0CF736B --renderer-client-id=5 --mojo-platform-channel-handle=2208 --allow-no-sandbox-job /prefetch:1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exePID:2056"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5B468DD3659E6FCED98F152892610B6B --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exePID:3068"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B71D5038CE0D64B68736AECB75BF129B --mojo-platform-channel-handle=2524 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
00:00
00:00
Downloads
-
C:\Users\Admin\AppData\Local\Temp\adobe1.exeMD5
fa0469c74632450ff280cda736e3b589
SHA12a125739fc91b38f69c021d8c1e9f66f15da7c1b
SHA2569c85331956b4018e4bccaa097b452c1cc368183d8f2a34e55e251a616a1f2cb9
SHA512291256e19f7ef82e57c4223ae8777aeaf39767dba3adf3c6b39c57b2f6c6d4d292d7ace2d53a8536d9d5973088a5156c41e663f38dc9a2b7b384bbf45184b3e9
-
C:\Users\Admin\AppData\Local\Temp\adobe1.exeMD5
fa0469c74632450ff280cda736e3b589
SHA12a125739fc91b38f69c021d8c1e9f66f15da7c1b
SHA2569c85331956b4018e4bccaa097b452c1cc368183d8f2a34e55e251a616a1f2cb9
SHA512291256e19f7ef82e57c4223ae8777aeaf39767dba3adf3c6b39c57b2f6c6d4d292d7ace2d53a8536d9d5973088a5156c41e663f38dc9a2b7b384bbf45184b3e9
-
C:\Users\Admin\AppData\Local\Temp\adobe1.exeMD5
fa0469c74632450ff280cda736e3b589
SHA12a125739fc91b38f69c021d8c1e9f66f15da7c1b
SHA2569c85331956b4018e4bccaa097b452c1cc368183d8f2a34e55e251a616a1f2cb9
SHA512291256e19f7ef82e57c4223ae8777aeaf39767dba3adf3c6b39c57b2f6c6d4d292d7ace2d53a8536d9d5973088a5156c41e663f38dc9a2b7b384bbf45184b3e9
-
C:\Users\Admin\AppData\Local\Temp\reader.pdfMD5
8dd2a8605148e4e6af1781a9de0d51eb
SHA1dbe09e8abbcee0e909a0c44fd494e9952231a1d5
SHA2564a9e84a374276202ce4468813331c296e150ad568b3cd20b4d6f71be62d8518b
SHA512742f95144ad53c9a7b20888fc0c54144187b82761a335020bad6987489255870d725f35a2d5dd4a84475f735f394f7c79ad322b770f89868c3e5b6d7bfb1a37e
-
C:\Users\Admin\AppData\Roaming\Adobe\svchost.exeMD5
fa0469c74632450ff280cda736e3b589
SHA12a125739fc91b38f69c021d8c1e9f66f15da7c1b
SHA2569c85331956b4018e4bccaa097b452c1cc368183d8f2a34e55e251a616a1f2cb9
SHA512291256e19f7ef82e57c4223ae8777aeaf39767dba3adf3c6b39c57b2f6c6d4d292d7ace2d53a8536d9d5973088a5156c41e663f38dc9a2b7b384bbf45184b3e9
-
memory/864-126-0x0000000077E62000-0x0000000077E6200C-memory.dmp
-
memory/864-129-0x0000000000000000-mapping.dmp
-
memory/948-154-0x0000000013140000-0x000000001338D000-memory.dmp
-
memory/948-152-0x000000001338B560-mapping.dmp
-
memory/948-151-0x0000000013140000-0x000000001338D000-memory.dmp
-
memory/996-115-0x0000000000000000-mapping.dmp
-
memory/1072-133-0x0000000077E62000-0x0000000077E6200C-memory.dmp
-
memory/1072-135-0x0000000000000000-mapping.dmp
-
memory/1440-158-0x0000000000000000-mapping.dmp
-
memory/1808-137-0x0000000077E62000-0x0000000077E6200C-memory.dmp
-
memory/1808-139-0x0000000000000000-mapping.dmp
-
memory/2056-142-0x0000000077E62000-0x0000000077E6200C-memory.dmp
-
memory/2056-145-0x0000000000000000-mapping.dmp
-
memory/2700-116-0x0000000000000000-mapping.dmp
-
memory/2700-120-0x0000000000570000-0x00000000006BA000-memory.dmp
-
memory/2780-122-0x0000000000000000-mapping.dmp
-
memory/3068-149-0x0000000000000000-mapping.dmp
-
memory/3068-147-0x0000000077E62000-0x0000000077E6200C-memory.dmp
-
memory/3608-157-0x0000000000000000-mapping.dmp
-
memory/3644-155-0x0000000000000000-mapping.dmp
-
memory/3644-156-0x0000000013140000-0x000000001338D000-memory.dmp
-
memory/3956-123-0x0000000077E62000-0x0000000077E6200C-memory.dmp
-
memory/3956-125-0x0000000000000000-mapping.dmp
-
memory/4000-119-0x0000000000000000-mapping.dmp
Loading data