Analysis
-
max time kernel
178s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
24-03-2022 13:38
Behavioral task
behavioral1
Sample
Dunning Letter-WILLIAMS & CONNOLLY-USD-2022-03-23.pdf
Resource
win10v2004-en-20220113
0 signatures
0 seconds
General
-
Target
Dunning Letter-WILLIAMS & CONNOLLY-USD-2022-03-23.pdf
-
Size
33KB
-
MD5
99342d637ebde3bb9e3774eec97faddc
-
SHA1
0d9215fdc49bf4e9af2aa0b1268a2f90bc0969be
-
SHA256
f5b0a0b4772220593a5f4b5e43838c07fbd6ffe30979c756fc4724d086d15ce4
-
SHA512
cc7702b820a87b7dda33401104d940953ca5760ab4d7fd756ce0bb655b9e43fb97ad88881fcfa60eb8400eabd640d9805ebdc2dee871513e7891dc0522c90675
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 2132 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
AcroRd32.exeAdobeARM.exepid process 2132 AcroRd32.exe 2132 AcroRd32.exe 2132 AcroRd32.exe 2132 AcroRd32.exe 2132 AcroRd32.exe 2132 AcroRd32.exe 1616 AdobeARM.exe 2132 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 2132 wrote to memory of 2184 2132 AcroRd32.exe RdrCEF.exe PID 2132 wrote to memory of 2184 2132 AcroRd32.exe RdrCEF.exe PID 2132 wrote to memory of 2184 2132 AcroRd32.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 2936 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe PID 2184 wrote to memory of 3476 2184 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dunning Letter-WILLIAMS & CONNOLLY-USD-2022-03-23.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F785F181CB533FA01384E2DAA664E231 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2F6A9364FEB8FDC8B0AD8D2A0321383A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2F6A9364FEB8FDC8B0AD8D2A0321383A --renderer-client-id=2 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F6B35B15A3F93C4C0D20A7AC730FEDF6 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DD4798AC3CAA0FF756CC8A95256432C1 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7F3F4790629249EBB79756FCB0BBC015 --mojo-platform-channel-handle=1704 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0EBE2EB9F5BB976E583ABCF6F6060884 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0EBE2EB9F5BB976E583ABCF6F6060884 --renderer-client-id=8 --mojo-platform-channel-handle=2420 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=78A38B0E3B1607142FB2FA4EFEE133EC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=78A38B0E3B1607142FB2FA4EFEE133EC --renderer-client-id=10 --mojo-platform-channel-handle=2572 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:19.0 /MODE:32⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"3⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1300-143-0x0000000000000000-mapping.dmp
-
memory/1616-149-0x0000000000000000-mapping.dmp
-
memory/1616-161-0x0000000000000000-mapping.dmp
-
memory/2184-133-0x0000000000000000-mapping.dmp
-
memory/2936-135-0x0000000000000000-mapping.dmp
-
memory/3312-146-0x0000000000000000-mapping.dmp
-
memory/3476-138-0x0000000000000000-mapping.dmp
-
memory/3512-162-0x0000000000000000-mapping.dmp
-
memory/3924-157-0x0000000000000000-mapping.dmp
-
memory/4012-152-0x0000000000000000-mapping.dmp