Overview
overview
3Static
static
3Onedrives/...AO.htm
windows7_x64
1Onedrives/...AO.htm
windows10-2004_x64
1Onedrives/...GC.htm
windows7_x64
1Onedrives/...GC.htm
windows10-2004_x64
1Onedrives/...O.html
windows7_x64
1Onedrives/...O.html
windows10-2004_x64
1Onedrives/...P.html
windows7_x64
1Onedrives/...P.html
windows10-2004_x64
1Onedrives/...LO.htm
windows7_x64
1Onedrives/...LO.htm
windows10-2004_x64
1Onedrives/...FE.htm
windows7_x64
1Onedrives/...FE.htm
windows10-2004_x64
1Onedrives/...TR.htm
windows7_x64
1Onedrives/...TR.htm
windows10-2004_x64
1Onedrives/...an.pdf
windows7_x64
1Onedrives/...an.pdf
windows10-2004_x64
1Onedrives/...A.html
windows7_x64
1Onedrives/...A.html
windows10-2004_x64
1Onedrives/...bg.png
windows7_x64
3Onedrives/...bg.png
windows10-2004_x64
3Onedrives/...F1.png
windows7_x64
3Onedrives/...F1.png
windows10-2004_x64
3Onedrives/...ion.js
windows7_x64
1Onedrives/...ion.js
windows10-2004_x64
1Analysis
-
max time kernel
177s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
08-05-2022 22:31
Behavioral task
behavioral1
Sample
Onedrives/Onedrive1/AO.htm
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Onedrives/Onedrive1/AO.htm
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
Onedrives/Onedrive1/GC.htm
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
Onedrives/Onedrive1/GC.htm
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
Onedrives/Onedrive1/GNO.html
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
Onedrives/Onedrive1/GNO.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
Onedrives/Onedrive1/GP.html
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
Onedrives/Onedrive1/GP.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
Onedrives/Onedrive1/LO.htm
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
Onedrives/Onedrive1/LO.htm
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
Onedrives/Onedrive1/OFE.htm
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
Onedrives/Onedrive1/OFE.htm
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
Onedrives/Onedrive1/OTR.htm
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
Onedrives/Onedrive1/OTR.htm
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
Onedrives/Onedrive1/Starting-Business-plan.pdf
Resource
win7-20220414-en
Behavioral task
behavioral16
Sample
Onedrives/Onedrive1/Starting-Business-plan.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
Onedrives/Onedrive1/YA.html
Resource
win7-20220414-en
Behavioral task
behavioral18
Sample
Onedrives/Onedrive1/YA.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
Onedrives/Onedrive1/images/landing-devices-bg.png
Resource
win7-20220414-en
Behavioral task
behavioral20
Sample
Onedrives/Onedrive1/images/landing-devices-bg.png
Resource
win10v2004-20220414-en
Behavioral task
behavioral21
Sample
Onedrives/Onedrive1/ojomu/OF1.png
Resource
win7-20220414-en
Behavioral task
behavioral22
Sample
Onedrives/Onedrive1/ojomu/OF1.png
Resource
win10v2004-20220414-en
Behavioral task
behavioral23
Sample
Onedrives/Onedrive1/verification.js
Resource
win7-20220414-en
Behavioral task
behavioral24
Sample
Onedrives/Onedrive1/verification.js
Resource
win10v2004-20220414-en
General
-
Target
Onedrives/Onedrive1/Starting-Business-plan.pdf
-
Size
354KB
-
MD5
6ad61eadacda1c9cb7284d63324e87e7
-
SHA1
5def73c0afbe79e7979e86f30d3a3c3de7b90162
-
SHA256
8bd268a1f1a237e479f07d836d44c80e2f44909b9f9c58067b1da1646dccfdda
-
SHA512
29fe01fcf8cb16b0ecf8257c4c9f7bb433c4b6a2d12aef825c27405caa2433613f9e35f534842a1b22ad88190c99dd4a54fda6fba4835aa9e2d723a9d117668d
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
AcroRd32.exepid process 5072 AcroRd32.exe 5072 AcroRd32.exe 5072 AcroRd32.exe 5072 AcroRd32.exe 5072 AcroRd32.exe 5072 AcroRd32.exe 5072 AcroRd32.exe 5072 AcroRd32.exe 5072 AcroRd32.exe 5072 AcroRd32.exe 5072 AcroRd32.exe 5072 AcroRd32.exe 5072 AcroRd32.exe 5072 AcroRd32.exe 5072 AcroRd32.exe 5072 AcroRd32.exe 5072 AcroRd32.exe 5072 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 5072 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exeAdobeARM.exepid process 5072 AcroRd32.exe 5072 AcroRd32.exe 5072 AcroRd32.exe 5072 AcroRd32.exe 4716 AdobeARM.exe 5072 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 5072 wrote to memory of 4768 5072 AcroRd32.exe RdrCEF.exe PID 5072 wrote to memory of 4768 5072 AcroRd32.exe RdrCEF.exe PID 5072 wrote to memory of 4768 5072 AcroRd32.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 2524 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe PID 4768 wrote to memory of 5044 4768 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Onedrives\Onedrive1\Starting-Business-plan.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=39CDCB10AC5939BEAFDC95D933102B9A --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BE15C501EC755C2FDA31FBAED994CCE4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BE15C501EC755C2FDA31FBAED994CCE4 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9C63D2BDDD2BCD1291366A09E317EE05 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9C63D2BDDD2BCD1291366A09E317EE05 --renderer-client-id=4 --mojo-platform-channel-handle=2180 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DF3E0691C70FCA117F17E00191922447 --mojo-platform-channel-handle=2552 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6CB839871106A84BA74A46E5F53CE8B6 --mojo-platform-channel-handle=2648 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EBE8EF4A8DACBC4DB78B1268AF830CF3 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:19.0 /MODE:32⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1524-146-0x0000000000000000-mapping.dmp
-
memory/2380-139-0x0000000000000000-mapping.dmp
-
memory/2524-132-0x0000000000000000-mapping.dmp
-
memory/2628-149-0x0000000000000000-mapping.dmp
-
memory/2708-141-0x0000000000000000-mapping.dmp
-
memory/2720-155-0x0000000000000000-mapping.dmp
-
memory/4716-154-0x0000000000000000-mapping.dmp
-
memory/4768-130-0x0000000000000000-mapping.dmp
-
memory/5044-135-0x0000000000000000-mapping.dmp
-
memory/5064-152-0x0000000000000000-mapping.dmp