Resubmissions
17-03-2022 11:50
220317-nzwrgadcd8 1017-03-2022 11:47
220317-nxz14sdcc9 1017-03-2022 11:43
220317-nvn6tsbfar 1017-03-2022 11:40
220317-nsw4nadcb7 117-03-2022 11:36
220317-nqrfdsbehp 1017-03-2022 11:31
220317-nmv96sbegl 1Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-de-20220113 -
submitted
17-03-2022 11:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://1drv.ms/u/s!AnWE7BCdi_7hgxBogqt9g3XXAdK7?e=C53B24
Resource
win10v2004-de-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
https://1drv.ms/u/s!AnWE7BCdi_7hgxBogqt9g3XXAdK7?e=C53B24
Score
10/10
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs
-
Executes dropped EXE 5 IoCs
pid Process 4604 armsvc.exe 1312 AdobeARM.exe 4320 MSICEAA.tmp 4760 RdrServicesUpdater.exe 3996 armsvc.exe -
Sets file execution options in registry 2 TTPs
-
Loads dropped DLL 48 IoCs
pid Process 4528 MsiExec.exe 1508 MsiExec.exe 1508 MsiExec.exe 1900 MsiExec.exe 1900 MsiExec.exe 1900 MsiExec.exe 1900 MsiExec.exe 1900 MsiExec.exe 1900 MsiExec.exe 1900 MsiExec.exe 1900 MsiExec.exe 1900 MsiExec.exe 1900 MsiExec.exe 1900 MsiExec.exe 1900 MsiExec.exe 1900 MsiExec.exe 1900 MsiExec.exe 1900 MsiExec.exe 1900 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 1900 MsiExec.exe 1900 MsiExec.exe 1900 MsiExec.exe 1900 MsiExec.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Elevation.tmp MsiExec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\PlayStore_icon.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\desktop-connector-files-select\js\selector.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\fss\img\tools\check_2x.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\uss-search\css\main-selector.css RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\scan-files\images\themeless\appstore.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\themes\dark\s_invite_24.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\s_signed_out.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\activity-badge\js\nls\pl-pl\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\js\nls\hu-hu\ui-strings.js RdrServicesUpdater.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ccme_base_non_fips.dll msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\large_trefoil.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-files\js\selector.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\sign-services-auth\css\main-selector.css RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\signatures\images\nub.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\themes\dark\s_delete_18.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\files\dev\nls\sl-si\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\exportpdfupsell-app\images\example_icons2x.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\exportpdfupsell-app\js\nls\fi-fi\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\fullscreen.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js RdrServicesUpdater.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\TrackedSend.aapp msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\hi_contrast\core_icons__retina_hiContrast_bow.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\sign-services-auth\js\nls\it-it\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\app-center\js\nls\ru-ru\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\add-account\js\nls\nb-no\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\PlayStore_icon.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\fil_get.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\app\dev\nls\sv-se\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\s_backarrow_default.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\win8-scrollbar\themes\dark\arrow-right-pressed.gif RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view-2x.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\fullscreen-press.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\aicuc\js\plugins\exportpdf-selector.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\combinepdf\js\nls\fi-fi\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\unified-share\js\nls\fr-ma\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\search-summary\js\nls\tr-tr\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\download.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\sample-files\js\nls\zh-cn\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\exportpdfupsell-app\js\nls\ru-ru\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\sign-services-auth\js\nls\tr-tr\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-computer\js\nls\ru-ru\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\app\dev\nls\ja-jp\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\adc_logo.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\ob-preview\images\themeless\scan_poster.jpg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\sample-files\js\nls\ro-ro\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\home\images\icons_ie8.gif RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\HighBeamCardLogo.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\zh-hk_get.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\combinepdf\images\rhp_world_icon.png RdrServicesUpdater.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\files\dev\nls\fi-fi\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\css\main-cef.css RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-recent-files\js\nls\ca-es\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\themes\dark\apple-touch-icon-144x144-precomposed.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_2x.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\sign-services-auth\js\nls\cs-cz\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\sign-services-auth\js\nls\es-es\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\aicuc\js\nls\nb-no\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\themes\dark\s_export_18.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\task-handler\images\example_icons2x.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\themes\dark\s_replace_signer_18.svg RdrServicesUpdater.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI3397.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB203.tmp msiexec.exe File opened for modification C:\Windows\Installer\1ce7aaa.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce7ae5.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce7ae6.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSI3356.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7FF9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA353.tmp msiexec.exe File created C:\Windows\Installer\1ce7ad1.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSICEAA.tmp msiexec.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\FDFFile_8.ico msiexec.exe File created C:\Windows\Installer\1ce7aec.HDR msiexec.exe File created C:\Windows\Installer\1ce7af6.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSIA59.tmp msiexec.exe File opened for modification C:\Windows\Installer\1ce7a7f.msp msiexec.exe File opened for modification C:\Windows\Installer\MSIBC64.tmp msiexec.exe File opened for modification C:\Windows\Installer\1ce7abf.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce7ae4.HDR msiexec.exe File created C:\Windows\Installer\1ce7aea.HDR msiexec.exe File created C:\Windows\Installer\1ce7ab4.HDR msiexec.exe File created C:\Windows\Installer\1ce7acd.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce7af5.HDR msiexec.exe File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\XFDFFile_8.ico msiexec.exe File created C:\Windows\Installer\1ce7ade.HDR msiexec.exe File created C:\Windows\Installer\1ce7aef.HDR msiexec.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\PDFFile_8.ico msiexec.exe File opened for modification C:\Windows\Installer\1ce7aeb.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSIA431.tmp msiexec.exe File created C:\Windows\Installer\1ce7a8d.HDR msiexec.exe File created C:\Windows\Installer\1ce7a93.HDR msiexec.exe File created C:\Windows\Installer\1ce7aae.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce7ad0.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce7af2.HDR msiexec.exe File created C:\Windows\Installer\1ce7af3.HDR msiexec.exe File created C:\Windows\Installer\1ce7af5.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSIA2E5.tmp msiexec.exe File created C:\Windows\Installer\1ce7aa4.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce7ab2.HDR msiexec.exe File created C:\Windows\Installer\1ce7abc.HDR msiexec.exe File created C:\Windows\Installer\1ce7ae9.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce7af7.HDR msiexec.exe File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\FDFFile_8.ico msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\1ce7a99.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce7aa4.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSIA73F.tmp msiexec.exe File created C:\Windows\Installer\1ce7acb.HDR msiexec.exe File created C:\Windows\Installer\1ce7ace.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce7ae8.HDR msiexec.exe File created C:\Windows\Installer\1ce7aee.HDR msiexec.exe File created C:\Windows\Installer\1ce7aff.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSI32E6.tmp msiexec.exe File created C:\Windows\Installer\1ce7a7f.msp msiexec.exe File created C:\Windows\Installer\1ce7a86.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce7ac1.HDR msiexec.exe File created C:\Windows\Installer\1ce7add.HDR msiexec.exe File created C:\Windows\Installer\1ce7ae4.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSI3890.tmp msiexec.exe File created C:\Windows\Installer\1ce7ae6.HDR msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\1ce7a95.HDR msiexec.exe File created C:\Windows\Installer\1ce7ab8.HDR msiexec.exe File created C:\Windows\Installer\1ce7ac1.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce7add.HDR msiexec.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SDXHelper.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 SDXHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SDXHelper.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS SDXHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily SDXHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SDXHelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}\AppName = "RdrCEF.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF" msiexec.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\AppName = "AcroRd32.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\ msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\Policy = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\AppName = "AcroBroker.exe" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\Policy = "3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}\AppName = "AcroRd32.exe" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\Policy = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppPath = "C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\AppName = "AcroRd32.exe" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\Policy = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}\Policy = "3" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\Policy = "3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\Compatibility Flags = "1024" msiexec.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights MsiExec.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\AppName = "AdobeCollabSync.exe" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}\Policy = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppName = "AdobeARM.exe" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B} msiexec.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Adobe.AcrobatSearch.1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41C5FFFE-36DD-415D-9ED0-2976A342A1C8}\1.0\ = "PDFShellServer 1.0 Type Library" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5007373A-20D7-458F-9FFB-ABC900E3A831}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdfxml\OpenWithProgids\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EF-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{671B6145-4169-4ADD-9AF3-E6990EB2B325}\ = "IBitmapConsumer" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{673E8454-7646-11D1-B90B-00A0C9259304}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9F2FE81-F764-4BD0-AFA5-5DE841DDB625}\ = "IGetPDDomNode" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\OpenWithProgids MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05BFD3F1-6319-4F30-B752-C7A22889BCC4}\1.0\0\win32\ = "C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.dll" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDXFileType\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9B4CD3E7-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroPDF.PDF.1\CLSID\ = "{CA8A9780-280D-11CF-A24D-444553540000}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\ProgID\ = "AcroPDF.PDF.1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.acrobatsecuritysettings\ = "Adobe Acrobat Security Settings Document" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AFormAut.App.1\CLSID\ = "{7CD069A1-50AA-11D1-B8F0-00A0C9259304}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}\ MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08A9E040-9A9C-4F42-B5F5-2029B8F17E1D}\ = "IAcroAXDoc" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{198F17AE-B921-4308-9543-288D426A5C2B}\ = "IPDomElement" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81F9B44F-BA3A-4F5D-9B51-090C74A9B3A4}\TypeLib\Version = "3.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{673E8454-7646-11D1-B90B-00A0C9259304}\TypeLib msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\AcroRD32.exe\shell\Read\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\acrobat2018\shell\open\ddeexec\ = "[HandleAcroURL(\"%1\")]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3F1-4981-101B-9CA8-9240CE2738AE}\ = "CAcroPDBookmark" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{671B6145-4169-4ADD-9AF3-E6990EB2B325} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\68AB67CA7DA700005205CA31A0E42800\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Adobe\\ARM\\Reader_19.010.20069\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B813CE7-7C10-4F84-AD06-9DF76D97A9AA}\NumMethods\ = "7" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.fdf\OpenWithProgids\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C52A2CC-66F1-4B2B-A9E4-9723791F0BBD}\ = "IAdobeInitializeWithStream" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{17F2E344-8227-4AA7-A25A-E89424566BBA}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XDPDoc\shell\Read msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BBAA0E44-3862-490C-8E63-AC2D2D6EF733}\ msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{EE5A151A-AD2A-4CEE-AD65-228B59F5B4AD} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.pdx\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\acrobat\shell\open\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" / u \"%1\"" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml.1\ = "Adobe Acrobat PDFXML Document" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EC-4981-101B-9CA8-9240CE2738AE}\TypeLib\Version = "1.1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36DE898D-AD48-40A5-B4B2-123F916BFBAB}\TypeLib\Version = "3.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{41738EEA-442F-477F-92CF-2889BD6CD7E7}\1.0 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{41C5FFFE-36DD-415D-9ED0-2976A342A1C8}\1.0\HELPDIR msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\DocObject\ msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AcroExch.SecStore\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\EnableFullPage\.xdp MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroPDF.PDF.1\ msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\VersionIndependentProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24DA047B-40C0-4018-841B-6B7409F730FC}\TypeLib\ = "{05BFD3F1-6319-4F30-B752-C7A22889BCC4}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\acrobat\shell\open\command MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\VersionIndependentProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EB-4981-101B-9CA8-9240CE2738AE}\TypeLib\ = "{E64169B3-3592-47D2-816E-602C5C13F328}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B813CE7-7C10-4F84-AD06-9DF76D97A9AA}\TypeLib\Version = "1.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24DA047B-40C0-4018-841B-6B7409F730FC}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\Programmable msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D3F22039-E3CF-4FC4-9A30-426A46056B8C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62776AC3-A015-4BA5-A1C7-DCD765881249}\ProxyStubClsid32\ = "{671B6145-4169-4ADD-9AF3-E6990EB2B325}" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\AcroRD32.exe\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EF-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{03C2AEA5-BEFA-4C84-A187-C9245AC784F6}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{198F17AE-B921-4308-9543-288D426A5C2B}\ProxyStubClsid32 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 2600 chrome.exe 2600 chrome.exe 1268 chrome.exe 1268 chrome.exe 2724 chrome.exe 2724 chrome.exe 2364 chrome.exe 2364 chrome.exe 4888 chrome.exe 4888 chrome.exe 5108 chrome.exe 5108 chrome.exe 2168 chrome.exe 2168 chrome.exe 4344 AdobeARMHelper.exe 4344 AdobeARMHelper.exe 4344 AdobeARMHelper.exe 4344 AdobeARMHelper.exe 4344 AdobeARMHelper.exe 4344 AdobeARMHelper.exe 4344 AdobeARMHelper.exe 4344 AdobeARMHelper.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4992 chrome.exe 4992 chrome.exe 4992 chrome.exe 4992 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4344 AdobeARMHelper.exe Token: SeIncreaseQuotaPrivilege 4344 AdobeARMHelper.exe Token: SeSecurityPrivilege 2376 msiexec.exe Token: SeCreateTokenPrivilege 4344 AdobeARMHelper.exe Token: SeAssignPrimaryTokenPrivilege 4344 AdobeARMHelper.exe Token: SeLockMemoryPrivilege 4344 AdobeARMHelper.exe Token: SeIncreaseQuotaPrivilege 4344 AdobeARMHelper.exe Token: SeMachineAccountPrivilege 4344 AdobeARMHelper.exe Token: SeTcbPrivilege 4344 AdobeARMHelper.exe Token: SeSecurityPrivilege 4344 AdobeARMHelper.exe Token: SeTakeOwnershipPrivilege 4344 AdobeARMHelper.exe Token: SeLoadDriverPrivilege 4344 AdobeARMHelper.exe Token: SeSystemProfilePrivilege 4344 AdobeARMHelper.exe Token: SeSystemtimePrivilege 4344 AdobeARMHelper.exe Token: SeProfSingleProcessPrivilege 4344 AdobeARMHelper.exe Token: SeIncBasePriorityPrivilege 4344 AdobeARMHelper.exe Token: SeCreatePagefilePrivilege 4344 AdobeARMHelper.exe Token: SeCreatePermanentPrivilege 4344 AdobeARMHelper.exe Token: SeBackupPrivilege 4344 AdobeARMHelper.exe Token: SeRestorePrivilege 4344 AdobeARMHelper.exe Token: SeShutdownPrivilege 4344 AdobeARMHelper.exe Token: SeDebugPrivilege 4344 AdobeARMHelper.exe Token: SeAuditPrivilege 4344 AdobeARMHelper.exe Token: SeSystemEnvironmentPrivilege 4344 AdobeARMHelper.exe Token: SeChangeNotifyPrivilege 4344 AdobeARMHelper.exe Token: SeRemoteShutdownPrivilege 4344 AdobeARMHelper.exe Token: SeUndockPrivilege 4344 AdobeARMHelper.exe Token: SeSyncAgentPrivilege 4344 AdobeARMHelper.exe Token: SeEnableDelegationPrivilege 4344 AdobeARMHelper.exe Token: SeManageVolumePrivilege 4344 AdobeARMHelper.exe Token: SeImpersonatePrivilege 4344 AdobeARMHelper.exe Token: SeCreateGlobalPrivilege 4344 AdobeARMHelper.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeSecurityPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1312 AdobeARM.exe 1312 AdobeARM.exe 1312 AdobeARM.exe 1312 AdobeARM.exe -
Suspicious use of SendNotifyMessage 27 IoCs
pid Process 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1268 chrome.exe 1312 AdobeARM.exe 1312 AdobeARM.exe 1312 AdobeARM.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1416 SDXHelper.exe 1312 AdobeARM.exe 1312 AdobeARM.exe 1312 AdobeARM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1268 wrote to memory of 3028 1268 chrome.exe 65 PID 1268 wrote to memory of 3028 1268 chrome.exe 65 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2868 1268 chrome.exe 66 PID 1268 wrote to memory of 2600 1268 chrome.exe 67 PID 1268 wrote to memory of 2600 1268 chrome.exe 67 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68 PID 1268 wrote to memory of 1676 1268 chrome.exe 68
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://1drv.ms/u/s!AnWE7BCdi_7hgxBogqt9g3XXAdK7?e=C53B241⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97f414f50,0x7ff97f414f60,0x7ff97f414f702⤵PID:3028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1612 /prefetch:22⤵PID:2868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1980 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 /prefetch:82⤵PID:1676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3004 /prefetch:12⤵PID:3684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:12⤵PID:1444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4312 /prefetch:82⤵PID:1772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:12⤵PID:684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3256 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5072 /prefetch:82⤵PID:2984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4624 /prefetch:82⤵PID:2744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5240 /prefetch:82⤵PID:2716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5332 /prefetch:82⤵PID:1136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5320 /prefetch:82⤵PID:1996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5612 /prefetch:82⤵PID:1016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5468 /prefetch:82⤵PID:1052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5816 /prefetch:82⤵PID:2820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:12⤵PID:4196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:12⤵PID:4264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2304 /prefetch:82⤵PID:3424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2728 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=980 /prefetch:82⤵PID:4276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1088 /prefetch:82⤵PID:2500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3700 /prefetch:82⤵PID:2896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5888 /prefetch:82⤵PID:3448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5292 /prefetch:82⤵PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4900 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,9831988901986289103,1368939631873306976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4308 /prefetch:82⤵PID:5052
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2728
-
C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe"C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:1416
-
C:\ProgramData\Adobe\ARM\S\20771\AdobeARMHelper.exe"C:\ProgramData\Adobe\ARM\S\20771\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\20771" /MODE:3 /PRODUCT:Reader /VERSION:19.0 /LANG:ENU1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344 -
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\20771" /MODE:3 /PRODUCT:Reader /VERSION:19.0 /LANG:ENU2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1312
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2376 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7E15ABC9067FC2FE59E76A82A74C6DC02⤵
- Loads dropped DLL
PID:4528
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5D3A640F74B708255D10A25805D9CD2C E Global\MSI00002⤵
- Loads dropped DLL
PID:1508
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AC20ECED16531C0BE9A612A7F74A8B6B2⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:1900
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 23183BD11330B0705A052F9CAE09FCB8 E Global\MSI00002⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4332
-
-
C:\Windows\Installer\MSICEAA.tmp"C:\Windows\Installer\MSICEAA.tmp" /b 2 120 02⤵
- Executes dropped EXE
PID:4320
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe" 19.010.20098 19.010.20069.02⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4760
-
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"1⤵
- Executes dropped EXE
PID:4604
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"1⤵
- Executes dropped EXE
PID:3996