Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
Advance ve...ce.exe
windows7_x64
3Advance ve...ce.exe
windows10-2004_x64
7AvastProxy.exe
windows7_x64
10AvastProxy.exe
windows10-2004_x64
10Report of ...n).pdf
windows7_x64
1Report of ...n).pdf
windows10-2004_x64
1acrord32.dll
windows7_x64
8acrord32.dll
windows10-2004_x64
8wsc.dll
windows7_x64
1wsc.dll
windows10-2004_x64
1Analysis
-
max time kernel
128s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04/06/2022, 19:33
Static task
static1
Behavioral task
behavioral1
Sample
Advance version of the 2020 Report of the Secretary-General on Peacebuilding and Sustaining Peace.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Advance version of the 2020 Report of the Secretary-General on Peacebuilding and Sustaining Peace.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
AvastProxy.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
AvastProxy.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
Report of the Secretary-General on Peacebuilding and Sustaining Peace (advance version).pdf
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
Report of the Secretary-General on Peacebuilding and Sustaining Peace (advance version).pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
acrord32.dll
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
acrord32.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
wsc.dll
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
wsc.dll
Resource
win10v2004-20220414-en
General
-
Target
Advance version of the 2020 Report of the Secretary-General on Peacebuilding and Sustaining Peace.exe
-
Size
341KB
-
MD5
e16dd9faeca97b4c185426e5672becba
-
SHA1
f32087a346bcc58dedcfe1bc32f221d486a385c7
-
SHA256
c21bfc263890f02763f56b4e9f5cf9113656cf09d7864b53ec2fd2024bdadd60
-
SHA512
582180e0c7b35660114d5b1d4d5c92d75615321a74d160c2c7bc92b91a2c2b7ed758d63e2bbbdb1658992da6fe7ac546d7f4ea9a6c73a4a503989ea6e1a22d6a
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation Advance version of the 2020 Report of the Secretary-General on Peacebuilding and Sustaining Peace.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings Advance version of the 2020 Report of the Secretary-General on Peacebuilding and Sustaining Peace.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 3516 AdobeARM.exe 3516 AdobeARM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4140 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 4140 AcroRd32.exe 3516 AdobeARM.exe 4140 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4440 wrote to memory of 4140 4440 Advance version of the 2020 Report of the Secretary-General on Peacebuilding and Sustaining Peace.exe 79 PID 4440 wrote to memory of 4140 4440 Advance version of the 2020 Report of the Secretary-General on Peacebuilding and Sustaining Peace.exe 79 PID 4440 wrote to memory of 4140 4440 Advance version of the 2020 Report of the Secretary-General on Peacebuilding and Sustaining Peace.exe 79 PID 4140 wrote to memory of 4412 4140 AcroRd32.exe 85 PID 4140 wrote to memory of 4412 4140 AcroRd32.exe 85 PID 4140 wrote to memory of 4412 4140 AcroRd32.exe 85 PID 4140 wrote to memory of 1672 4140 AcroRd32.exe 89 PID 4140 wrote to memory of 1672 4140 AcroRd32.exe 89 PID 4140 wrote to memory of 1672 4140 AcroRd32.exe 89 PID 4140 wrote to memory of 1068 4140 AcroRd32.exe 92 PID 4140 wrote to memory of 1068 4140 AcroRd32.exe 92 PID 4140 wrote to memory of 1068 4140 AcroRd32.exe 92 PID 4140 wrote to memory of 1060 4140 AcroRd32.exe 93 PID 4140 wrote to memory of 1060 4140 AcroRd32.exe 93 PID 4140 wrote to memory of 1060 4140 AcroRd32.exe 93 PID 4140 wrote to memory of 4456 4140 AcroRd32.exe 94 PID 4140 wrote to memory of 4456 4140 AcroRd32.exe 94 PID 4140 wrote to memory of 4456 4140 AcroRd32.exe 94 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 920 4456 RdrCEF.exe 95 PID 4456 wrote to memory of 4604 4456 RdrCEF.exe 96 PID 4456 wrote to memory of 4604 4456 RdrCEF.exe 96 PID 4456 wrote to memory of 4604 4456 RdrCEF.exe 96 PID 4456 wrote to memory of 4604 4456 RdrCEF.exe 96 PID 4456 wrote to memory of 4604 4456 RdrCEF.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\Advance version of the 2020 Report of the Secretary-General on Peacebuilding and Sustaining Peace.exe"C:\Users\Admin\AppData\Local\Temp\Advance version of the 2020 Report of the Secretary-General on Peacebuilding and Sustaining Peace.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Report of the Secretary-General on Peacebuilding and Sustaining Peace (advance version).pdf"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵PID:4412
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵PID:1672
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵PID:1068
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵PID:1060
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DD6070DF754A2F0389B1BA4B86166B91 --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:920
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AF7E0A39184B15D9E71CFAA55AC244A6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AF7E0A39184B15D9E71CFAA55AC244A6 --renderer-client-id=2 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job /prefetch:14⤵PID:4604
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2E2A8CB5649284908F17C1E95275A879 --mojo-platform-channel-handle=2268 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:5116
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D9FFE4248FB82FF490BE5E20706F00FC --mojo-platform-channel-handle=1788 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:5108
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E061600BC3867665E821202B1854F032 --mojo-platform-channel-handle=2380 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:2976
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E296BCA8D351AFFC166D2A5E6BD0CA4C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E296BCA8D351AFFC166D2A5E6BD0CA4C --renderer-client-id=8 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job /prefetch:14⤵PID:3964
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵PID:1496
-
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:19.0 /MODE:33⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3516 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"4⤵PID:3560
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Report of the Secretary-General on Peacebuilding and Sustaining Peace (advance version).pdf
Filesize936KB
MD5bc5f2edf0f23957e0fbbcd845c744eb2
SHA1b0c167333780626ca8bd6b3b2a9fc54f20a59f34
SHA25654b491541376bda85ffb02b9bb40b9b5adba644f08b630fc1b47392625e1e60a
SHA51284f8c65a02dfd9db2286df405d711595e62ba114c8f911b30561b90818d579879542c4af09950ca8b8c2a9f82186e1cecc25933c17fef7c41e0fbf158d5ee102